Cisco 3560G 48TS Software Configuration Guide - Page 497

Chapter 27 Configuring Network Security with ACLs Configuring IP ACLs Beginning in privileged EXEC mode, follow these steps to create an extended ACL using names: Step 1 Step 2 Command configure terminal ip access-list extended name Step 3 {deny | permit} protocol {source [source-wildcard] | host source | any} {destination [destination-wildcard] | host destination | any} [precedence precedence] [tos tos] [established] [log] [time-range time-range-name] Step 4 Step 5 Step 6 end show access-lists [number | name] copy running-config startup-config Purpose Enter global configuration mode. Define an extended IP access list using a name and enter access-list configuration mode. Note The name can be a number from 100 to 199. In access-list configuration mode, specify the conditions allowed or denied. Use the log keyword to get access list logging messages, including violations. See the "Creating a Numbered Extended ACL" section on page 27-10 for definitions of protocols and other keywords. • host source-A source and source wildcard of source 0.0.0.0. • host destination-A destination and destination wildcard of destination 0.0.0.0. • any-A source and source wildcard or destination and destination wildcard of 0.0.0.0 255.255.255.255. Return to privileged EXEC mode. Show the access list configuration. (Optional) Save your entries in the configuration file. To remove a named extended ACL, use the no ip access-list extended name global configuration command. When you are creating standard extended ACLs, remember that, by default, the end of the ACL contains an implicit deny statement for everything if it did not find a match before reaching the end. For standard ACLs, if you omit the mask from an associated IP host address access list specification, 0.0.0.0 is assumed to be the mask. After you create an ACL, any additions are placed at the end of the list. You cannot selectively add ACL entries to a specific ACL. However, you can use no permit and no deny access-list configuration mode commands to remove entries from a named ACL. This example shows how you can delete individual ACEs from the named access list border-list: Switch(config)# ip access-list extended border-list Switch(config-ext-nacl)# no permit ip host 10.1.1.3 any Being able to selectively remove lines from a named ACL is one reason you might use named ACLs instead of numbered ACLs. After creating a named ACL, you can apply it to interfaces (see the "Applying an IP ACL to an Interface" section on page 27-19) or VLANs (see the "Configuring VLAN Maps" section on page 27-29). 78-16156-01 Catalyst 3560 Switch Software Configuration Guide 27-15