| |
|
|
ip access-list
Defines an IP access list by name and enters access-list configuration mode.
Syntax: [no] ip access-list {standard|extended} name
standard
Defines a standard access list.
extended
Defines an extended access list.
name
Name of this access list. Names may be up to 256 characters and may consist of any alpha-numeric characters, the underscore (_), and the hyphen (-). Case is significant.
Description: Access lists are filters that enable you to restrict the routing information a router learns from or advertises to a neighbor. Standard access lists create filters based on permit/deny, prefix, and prefix don't-care-bits. Extended access lists enable you to specify the type of protocol, network mask, and mask don't-care-bits as well as the elements that you can configure with a standard access list. Extended lists enable you to define range filters with masks and are more flexible for range matching. For further information on access-lists see the access-list command on page 4.
NOTE Only extended access-lists can be used to filter data traffic that traverses the fabric. Only standard access-lists are used for inbound and outbound server based filtering.
Access lists implicitly deny all access that is not expressly permitted. The following line is auto-appended to all access-lists:
deny ip any any
If it is desirable to over-ride this implicit denial statement, enter a permit ip any any statement as the last entry in the access-list.All IP access lists can be named.
Use the ip access-list command to define a named access list. This command names the access list and changes the command mode to access-list configuration mode. This command is used for address based filtering in standard mode and packet based filtering in extended mode.
Enter the IP address and network mask for each system the access list controls. Use the permit and deny commands to specify whether that system is permitted access.
Once in access-list configuration mode, use the attributes listed in Table 5-1 to build configuration commands.
Use the [permit|deny] source source-mask syntax to create a standard address-based IP access list entry. Add entries to the list by repeating the command for different IP addresses.
Use the [permit|deny] source source-mask destination destination-mask syntax to create an extended address-based IP access list entry. Add entries to the list by repeating the command for different IP addresses.
Use the [permit|deny] ip source source-mask destination destination-mask [tos [range tos-range | tos-value | tos-keyword]] [length [range length-range | bytes]] [sample sample-tag-name] [log] [rate-limit bits-per-second] syntax to create an IP extended packet-based access list entry to filter any IP protocol packet, including ICMP, TCP, and UDP, based on their source, destination, protocol, destination port, connection state.
Use the [permit|deny] icmp source source-mask destination destination-mask [icmp-type [icmp-code] | icmp-message] [log] [sample sample-tag-name] [rate-limit ratelimit-tag-name] syntax to create an ICMP packet-based IP access list entry to filter any ICMP protocol packet, based on their source, destination, protocol, destination port, connection state.
Use the [permit|deny] igmp source source-mask destination destination-mask [igmp-type] [log] [sample sample-tag-name] [rate-limit ratelimit-tag-name] syntax to create an IGMP packet-based IP access list entry to filter any IGMP protocol packet, based on their source, destination, protocol, destination port, connection state.
Use the [permit|deny] tcp source source-mask [operator operand] destination destination-mask [operator operand] [established] [fragment] [log] [sample] [rate-limit] syntax to create a TCP protocol packet-based IP access list entry to filter individual packets based on their source, destination, protocol, destination port, connection state and fragmentation.
Use the [permit|deny] udp source source-mask [operator operand] destination destination-mask [operator operand] [tos [range tos-range | tos-value | tos-keyword]] [length [range length-range | bytes]] [sample sample-tag-name] [log] [rate-limit bits-per-second] [fragment] syntax to create a UDP protocol packet-based IP access list entry to filter individual packets based on their source, destination, protocol, destination port, connection state and fragmentation.
Use the route-map, neighbor distribute-list, and neighbor filter-list commands to apply address-based access lists to routes.
Use the ip access-group interface configuration command to apply packet-based access lists to an interface.
Use the no ip access list command to delete a named access list.
Note that a deny any any statement is automatically appended to all access lists.
Factory Default: No IP access lists defined.
Command Mode: Configuration.
Example 1: In the following example, the ip access-list, deny, and permit commands create a standard access list named ISP1_inbound that only allows hosts on the 2 specified networks:
router(config)#ip access-list standard ISP1_inbound
router(config-std-nacl)#permit 205.5.1.121 0.0.0.255
router(config-std-nacl)#permit 128.20.0.0 0.0.255.255
router(config-std-nacl)#exit
router(config)#
Example 2: In the following example:
- An extended IP access-list is configured named src-filter set to deny packets from network 12.160/16 with a sample rate of 1 in 100 packets, and to sample packets from network 191/8.
- All other packets are permitted without sampling.
- IP access-list src-filter is associated with interface pos 1/14/1 for packets forwarded across the fabric.
- An extended IP access-list is configured named forme and is configured with ACLs that deny telnet traffic from network 10.10/16.
- The forme IP access-list is made the default inbound filter for messages intended for the server. In this case there is no implicit deny all filter at the end. The Avici default forme list is added to any user input.
router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
router(config)#ip access-list extended src_filter
router(config-ext-nacl)#deny ip 12.160.0.0 0.0.255.255 sample src-100-d
router(config-ext-nacl)#permit ip 191.0.0.0 0.255.255.255 sample src-100-p
router(config-ext-nacl)#permit ip any any
router(config-ext-nacl)#exit
router(config)#interface pos 1/14/1
router(config-if)#ip access-group src_filter in
router(config-if)#exit
router(config)#ip access-group extended forme
router(config-ext-nacl)#deny tcp 10.10.0.0 0.0.255.255 any eq telnet
router(config-ext-nacl)#deny tcp any eq telnet 10.10.0.0 0.0.255.255
router(config-ext-nacl)#exit
router(config)#ip default-access-group forme control-in
router(config)#end
router#
Related Commands: access-list
ip as-path access-list
ip community-list
show access-lists
show ip access-lists
neighbor distribute-list
neighbor filter-list
| |
|
|
Copyright © 2004
Avici Systems Inc.
Avici® and TSR®
is a registered trademark of Avici Systems Inc.
IPriori™, Composite Links™, SSR™, QSR, and NSR® are
trademarks of Avici Systems Inc.
Source
File Name: Routing_Pol.fm
HTML File Name: Routing_Pol7.html
Last Updated: 05/10/04 at 16:38:37