Cisco 7604 Configuration Guide - Page 302

Applying an Access List to an Interface Chapter 15 Permitting or Denying Network Access Applying an Access List to an Interface To apply an extended access list to the inbound or outbound direction of an interface, enter the following command: hostname(config)# access-group access_list_name {in | out} interface interface_name [per-user-override] You can apply one access list of each type (extended and EtherType) to both directions of the interface. See the "Inbound and Outbound Access List Overview" section on page 15-1 for more information about access list directions. The per-user-override keyword allows dynamic access lists that are downloaded for user authorization to override the access list assigned to the interface. For example, if the interface access list denies all traffic from 10.0.0.0, but the dynamic access list permits all traffic from 10.0.0.0, then the dynamic access list overrides the interface access list for that user. See the "Configuring RADIUS Authorization" section for more information about per-user access lists. The per-user-override keyword is only available for inbound access lists. For connectionless protocols, you need to apply the access list to the source and destination interfaces if you want traffic to pass in both directions. For example, you can allow BGP in an EtherType access list in transparent mode, and you need to apply the access list to both interfaces. The following example illustrates the commands required to enable access to an inside web server with the IP address 209.165.201.12 (this IP address is the address visible on the outside interface after NAT): hostname(config)# access-list ACL_OUT extended permit tcp any host 209.165.201.12 eq www hostname(config)# access-group ACL_OUT in interface outside You also need to configure NAT for the web server. The following access lists allow all hosts to communicate between the inside and hr networks, but only specific hosts to access the outside network: hostname(config)# access-list ANY extended permit ip any any hostname(config)# access-list OUT extended permit ip host 209.168.200.3 any hostname(config)# access-list OUT extended permit ip host 209.168.200.4 any hostname(config)# access-group ANY in interface inside hostname(config)# access-group ANY in interface hr hostname(config)# access-group OUT out interface outside For example, the following sample access list allows common EtherTypes originating on the inside interface: hostname(config)# access-list ETHER ethertype permit ipx hostname(config)# access-list ETHER ethertype permit bpdu hostname(config)# access-list ETHER ethertype permit mpls-unicast hostname(config)# access-group ETHER in interface inside The following access list allows some EtherTypes through the FWSM, but denies all others: hostname(config)# access-list ETHER ethertype permit 0x1234 hostname(config)# access-list ETHER ethertype permit bpdu hostname(config)# access-list ETHER ethertype permit mpls-unicast hostname(config)# access-group ETHER in interface inside hostname(config)# access-group ETHER in interface outside The following access list denies traffic with EtherType 0x1256 but allows all others on both interfaces: hostname(config)# access-list nonIP ethertype deny 1256 hostname(config)# access-list nonIP ethertype permit any hostname(config)# access-group ETHER in interface inside 15-4 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01