Cisco NME-X-23ES-1G User Guide - Page 140

16- and 36-Port Ethernet Switch Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Configuration Examples for the 16- and 36-Port Ethernet Switch Module The following example shows that the switch accepts addresses on network 36.0.0.0 subnets and denies all packets coming from 56.0.0.0 subnets. The ACL is then applied to packets entering Gigabit Ethernet interface 0/1: Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255 Switch(config)# access-list 2 deny 56.0.0.0 0.255.255.255 Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip access-group 2 in The following example shows how to create and display an extended access list to deny Telnet access from any host in network 171.69.198.0 to any host in network 172.20.52.0 and permit any others (the eq keyword after the destination address means to test for the TCP destination port number equaling Telnet): Switch(config)# access-list 102 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnet Switch(config)# access-list 102 permit tcp any any Switch(config)# end Switch# show access-lists Extended IP access list 102 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnet permit tcp any any The following example shows an extended ACL with a network connected to the Internet, and any host on the network being able to form TCP Telnet and SMTP connections to any host on the Internet: Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 23 Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 eq 25 Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip access-group 102 in SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The same port numbers are used throughout the life of the connection. Mail packets coming in from the Internet have a destination port of 25. Because the secure system behind the switch always accepts mail connections on port 25, the incoming services are controlled. Creating Named Standard and Extended ACLs Example The following example shows how you can delete individual ACEs from a named ACL: Switch(config)# ip access-list extended border-list Switch(config-ext-nacl)# no permit ip host 10.1.1.3 any The following example shows the Marketing_group ACL allowing any TCP Telnet traffic to the destination address and wildcard 171.69.0.0 0.0.255.255 and denying any other TCP traffic. It permits any other IP traffic: Switch(config)# ip access-list extended marketing_group Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet Switch(config-ext-nacl)# deny tcp any any Switch(config-ext-nacl)# permit ip any any The ACLs are applied to permit Gigabit Ethernet port 0/1, which is configured as a Layer 2 port, with the Marketing_group ACL applied to incoming traffic. Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip access-group marketing_group in ... 140 Cisco IOS Release 12.2(2)XT, 12.2(8)T, and 12.2(15)ZJ