HP Cisco MDS 9120 Cisco MDS 9000 Family Command Reference Guide - Release 4.x - Page 647

Chapter 11 I Commands ip access-group Send documentation comments to [email protected] ip access-group To apply an access list to an interface, use the ip access-group command in interface mode. Use the no form of this command to negate a previously issued command or revert to factory defaults. ip access-group access-list-name [in | out] Syntax Description access-list-name in out Specifies the IP access list name. The maximum length is 64 alphanumeric characters and the text is case insensitive. Specifies that the group is for ingress traffic. Specifies that the group is for egress traffic. Defaults The access list is applied to both ingress and egress traffic. Command Modes Interface mode. Command History Release 1.2(1) Modification This command was introduced. Usage Guidelines The ip access-group command controls access to an interface. Each interface can only be associated with one access list. The access group becomes active immediately. We recommend creating all rules in an access list, before creating the access group that uses that access list. If you create an access group before an access list, the access list is created and all packets in that interface are dropped, because the access list is empty. The access-group configuration for the ingress traffic applies to both local and remote traffic. The access-group configuration for the egress traffic applies only to local traffic. You can apply a different access list for each type of traffic. Examples The following example creates an access group called aclPermit for both the ingress and egress traffic (default): switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. switch(config)# ip access-list aclPermit permit ip any any switch(config)# interface Gigabitethernet 3/1 switch(config-if)# ip access-group aclPermit The following example deletes the access group called aclPermit: switch(config-if)# no ip access-group aclPermit The following example creates an access group called aclDenyTcp (if it does not already exist) for ingress traffic: OL-18089-01, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family Command Reference 11-41