Cisco 3845 Software Guide - Page 472

Configuring IPv4 ACLs Chapter 26 Configuring Network Security with ACLs SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The same port numbers are used throughout the life of the connection. Mail packets coming in from the Internet have a destination port of 25. Outbound packets have the port numbers reversed. Because the secure system of the network always accepts mail connections on port 25, the incoming and outgoing services are separately controlled. The ACL must be configured as an input ACL on the outbound interface and an output ACL on the inbound interface. In this example, the network is a Class B network with the address 128.88.0.0, and the mail host address is 128.88.1.2. The established keyword is used only for the TCP to show an established connection. A match occurs if the TCP datagram has the ACK or RST bits set, which show that the packet belongs to an existing connection. Gigabit Ethernet interface 1 is the interface that connects the router to the Internet. Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 established Switch(config)# access-list 102 permit tcp any host 128.88.1.2 eq 25 Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip access-group 102 in Named ACLs This example creates a standard ACL named internet_filter and an extended ACL named marketing_group. The internet_filter ACL allows all traffic from the source address 1.2.3.4. Switch(config)# ip access-list standard Internet_filter Switch(config-ext-nacl)# permit 1.2.3.4 Switch(config-ext-nacl)# exit The marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard 171.69.0.0 0.0.255.255 and denies any other TCP traffic. It permits ICMP traffic, denies UDP traffic from any source to the destination address range 171.69.0.0 through 179.69.255.255 with a destination port less than 1024, denies any other IP traffic, and provides a log of the result. Switch(config)# ip access-list extended marketing_group Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet Switch(config-ext-nacl)# deny tcp any any Switch(config-ext-nacl)# permit icmp any any Switch(config-ext-nacl)# deny udp any 171.69.0.0 0.0.255.255 lt 1024 Switch(config-ext-nacl)# deny ip any any log Switch(config-ext-nacl)# exit The Internet_filter ACL is applied to outgoing traffic and the marketing_group ACL is applied to incoming traffic on a Layer 3 port. Switch(config)# interface gigabitethernet0/2 Switch(config-if)# no switchport Switch(config-if)# ip address 2.0.5.1 255.255.255.0 Switch(config-if)# ip access-group Internet_filter out Switch(config-if)# ip access-group marketing_group in Time Range Applied to an IP ACL This example denies HTTP traffic on IP on Monday through Friday between the hours of 8:00 a.m. and 6:00 p.m (18:00). The example allows UDP traffic only on Saturday and Sunday from noon to 8:00 p.m. (20:00). Switch(config)# time-range no-http Switch(config)# periodic weekdays 8:00 to 18:00 ! Switch(config)# time-range udp-yes Switch(config)# periodic weekend 12:00 to 20:00 26-24 Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01