Home » Dell Manuals » Hubs & Switches » Dell N3200-ON » Manual Viewer

Dell N3200-ON EMC Networking N-Series Switches User Guide version 6.6.3 - Page 756

Complete ACL Example, and automatic sequence numbering of the ACLs is demonstrated.

Get Dell N3200-ON PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 756 highlights

Complete ACL Example The following example is a complete inbound ACL that allows access for hosts connected to gi1/0/1 with IP address in 10.1.1.x range to send IP packets to 192.168.0.X hosts on gi1/0/2. IP packets not from 10.1.1.x addresses or not addressed to 192.168.0.x hosts are dropped. Packets with protocols other than IP, DNS, ARP, or ICMP are dropped. Allowing ICMP supports the 10.1.1.x hosts in reliably receiving and initiating TCP connections and pinging through the switch. This example also allows ARP and DNS packets to any destination and is suitable for a Layer-2 switch. Both administrator-specified and automatic sequence numbering of the ACLs is demonstrated. console#config console(config)#mac access-list extended Allow-ARP console(config-mac-access-list)#permit any any arp console(config-mac-access-list)#exit console(config)#ip access-list Allow-10-1-1-x console(config-ip-acl)#10 permit ip 10.1.1.0 0.0.0.255 any console(config-ip-acl)#20 permit ip any 192.168.0.0 0.0.0.255 console(config-ip-acl)#30 permit icmp 10.1.1.0 0.0.0.255 any console(config-ip-acl)#40 permit ip 0.0.0.0 255.255.255.255 any console(config-ip-acl)#50 permit udp any any eq domain console(config-ip-acl)#exit console(config)#interface gi1/0/1 console(config-if-gi1/0/1)#mac access-group Allow-ARP in 10 console(config-if-gi1/0/1)#ip access-group Allow-10-1-1-x in 20 console(config-if-gi1/0/1)#exit Another list on the 192.168.0.x network attached port (gi1/0/2) is configured for this example. Because the two access lists are complementary/end-to-end, it is necessary to allow ICMP packets to travel between the attached hosts. Specific sequence numbering of the ACLs rules is shown here. console(config)#ip access-list Allow-192-168-0-x console(config-ip-acl)#10 permit ip 192.168.0.0 0.0.0.255 10.1.1.0 0.0.0.255 console(config-ip-acl)#20 permit icmp 192.168.0.0 0.0.0.255 any console(config-ip-acl)#30 permit udp any any eq domain console(config-ip-acl)#exit console(config)#interface gi1/0/2 console(config-if-gi1/0/2)#mac access-group Allow-ARP in 10 console(config-if-gi1/0/2)#ip access-group Allow-192-168-0-x in 20 756 Access Control Lists

Section	Page
Introduction	55
About This Document	55
Audience	56
Document Conventions	56
Additional Documentation	57
Switch Feature Overview	59
System Management Features	60
Multiple Management Options	60
System Time Management	60
Log Messages	61
System Reset	61
Integrated DHCP Server	61
Management of Basic Network Information	62
IPv6 Management Features	62
Dual Software Images	62
File Management	63
Switch Database Management Templates	63
Automatic Installation of Firmware and Configuration	63
sFlow	64
SNMP Alarms and Trap Logs	64
CDP Interoperability Through ISDP	65
Remote Monitoring (RMON)	65
Stacking Features	65
Mixed and Single Series Stacking	65
Single IP Management	66
Master Failover with Transparent Transition	67
Nonstop Forwarding on the Stack	67
Hot Add/Delete and Firmware Synchronization	67
Security Features	68
Configurable Access and Authentication Profiles	68
Password-Protected Management Access	68
Strong Password Enforcement	68
TACACS+ Client	68
RADIUS Support	69
SSH/SSL	69
Inbound Telnet Control	69
Denial of Service	69
Port Protection	70
Captive Portal	71
802.1X Authentication (IEEE 802.1X)	71
MAC-Based 802.1X Authentication	72
802.1X Monitor Mode	72
Port Security	73
Access Control Lists (ACLs)	73
Time-Based ACLs	73
IP Source Guard (IPSG)	74
DHCP Snooping	74
Dynamic ARP Inspection	74
Protected Ports (Private VLAN Edge)	74
Green Technology Features	75
Energy Detect Mode	75
Energy Efficient Ethernet	75
Power Utilization Reporting	76
Power over Ethernet (PoE) Features	76
PD Detection	76
Legacy (Reduced Capacitor) Detection	76
Classification	77
Port Start Up	77
Overload Detection and Port Shutdown	77
Disconnect Detection	77
IC Thermal Monitoring	77
Over-Temperature Protection	78
4-Pair Ports	78
IEEE 802.3bt Capability	79
PoE Port Capabilities and Power Limits	80
Key PoE Plus Features	82
Power Over Ethernet (PoE) Support	83
PoE Plus Support	83
PoE 60W Support	83
Powered Device Detection	84
PoE Power Management Modes	84
Power Management in Guard Band	86
PoE Plus Default Settings	88
Switching Features	89
Flow Control Support (IEEE 802.3x)	89
Head of Line Blocking Prevention	89
Jumbo Frames Support	89
Auto-MDI/MDIX Support	89
VLAN-Aware MAC-based Switching	89
Back Pressure Support	90
Auto-negotiation	90
Storm Control	90
Port Mirroring	91
Static and Dynamic MAC Address Tables	91
Link Layer Discovery Protocol (LLDP)	91
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	92
Connectivity Fault Management (IEEE 802.1ag)	93
Cisco Protocol Filtering	93
DHCP Layer-2 Relay	93
Virtual Local Area Network Supported Features	94
VLAN Support	94
Port-Based VLANs	94
IP Subnet-based VLAN	94
MAC-based VLAN	94
IEEE 802.1v Protocol-Based VLANs	94
Voice VLAN	95
GARP and GVRP Support	95
Guest VLAN	95
Unauthorized VLAN	95
Double VLANs	95
Spanning Tree Protocol Features	97
Spanning Tree Protocol (STP)	97
Spanning Tree Port Settings	97
Rapid Spanning Tree	97
Multiple Spanning Tree	97
Bridge Protocol Data Unit (BPDU) Guard	98
BPDU Filtering	98
RSTP-PV and STP-PV	98
Link Aggregation Features	99
Link Aggregation	99
Link Aggregate Control Protocol (LACP)	100
Multi-Switch LAG (MLAG)	100
Routing Features	101
Address Resolution Protocol (ARP) Table Management	101
VLAN Routing	101
IP Configuration	101
Open Shortest Path First (OSPF)	102
Border Gateway Protocol (BGP)	102
Virtual Routing and Forwarding (VRF)	102
BOOTP/DHCP Relay Agent	103
IP Helper and DHCP Relay	103
Routing Information Protocol	103
Router Discovery	103
Routing Table	103
Virtual Router Redundancy Protocol (VRRP)	104
Tunnel and Loopback Interfaces	104
IPv6 Routing Features	105
IPv6 Configuration	105
IPv6 Routes	105
OSPFv3	105
DHCPv6	105
Quality of Service (QoS) Features	106
Differentiated Services (DiffServ)	106
Class Of Service (CoS)	106
Auto Voice over IP (VoIP)	106
Internet Small Computer System Interface (iSCSI) Optimization	107
Layer-2 Multicast Features	107
MAC Multicast Support	107
IGMP Snooping	107
IGMP Snooping Querier	108
MLD Snooping	108
Multicast VLAN Registration	108
Layer-3 Multicast Features	109
Distance Vector Multicast Routing Protocol	109
Internet Group Management Protocol	109
IGMP Proxy	109
Protocol Independent Multicast—Dense Mode	109
Protocol Independent Multicast—Sparse Mode	110
Protocol Independent Multicast—Source Specific Multicast	110
Protocol Independent Multicast IPv6 Support	110
MLD/MLDv2 (RFC2710/RFC3810)	110
Hardware Overview	111
Dell EMC Networking N1100-ON Series Switch Hardware	111
N1100-ON Series Front Panel	111
N1100-ON Series Power Supply	114
N1100-ON Series Ventilation System	114
N1100-ON Series Thermal Shutdown	114
N1100-ON Series LED Definitions	114
Power Consumption for N1100-ON Series PoE Switches	118
N1100-ON Series Wall Installation	119
Dell EMC Networking N1500 Series Switch Hardware	121
N1500 Series Front Panel	121
N1500 Series Back Panel	124
N1500 Series LED Definitions	126
Power Consumption for N1500 Series PoE Switches	128
Dell EMC Networking N2000 Series Switch Hardware	129
N2000 Series Front Panel	130
N2000 Series Back Panel	133
N2000 Series LED Definitions	135
Power Consumption for N2000 Series PoE Switches	138
Dell EMC Networking N2100-ON Series Switch Hardware	140
N2100-ON Series Front Panel	140
N2100-ON Series Back Panel	142
N2100-ON Series LED Definitions	142
Power Consumption for N2100-ON Series PoE Switches	146
Dell EMC Networking N2200-ON Series Switch Hardware	149
N2200-ON Series Front Panel	149
N2200-ON Series Rear Panel	149
N2200X-ON Series Switch Ports	150
N2200-ON Series Console Port	151
N2200-ON Series USB Port	152
N2200-ON Series Reset Button	152
N2200-ON Series Port and System LEDs	152
N2200-ON Series Stack Master LED and Stack Number Display	152
N2200-ON Series Power Supplies	153
N2200-ON Series LED Definitions	154
Dell EMC Networking N3000E-ON Series Switch Hardware	158
Front Panel	158
Back Panel	164
LED Definitions	166
Power Consumption for PoE Switches	171
Dell EMC Networking N3100-ON Series Switch Hardware	173
N3100-ON Series Front Panel	173
N3100-ON Series Back Panel	175
N3100-ON Series LED Definitions	175
Power Consumption for N3100-ON Series PoE Switches	180
Dell EMC Networking N3200-ON Series Switch Hardware	183
N3200-ON Series Front Panel	183
N3200-ON Series Rear Panel	183
N3200-ON Series Switch Ports	184
N3200-ON Series Console Port	185
N3200-ON Series USB Port	186
N3200-ON Series Reset Button	186
N3200-ON Series Port and System LEDs	187
N3200-ON Series Stack Master LED and Stack Number Display	187
N3200-ON Series Power Supplies	187
N3200-ON Series LED Definitions	188
Switch MAC Addresses	201
Using Dell EMC OpenManage Switch Administrator	203
About Dell EMC OpenManage Switch Administrator	203
Starting the Application	204
Understanding the Interface	205
Using the Switch Administrator Buttons and Links	207
Defining Fields	208
Understanding the Device View	208
Using the Device View Port Features	208
Using the Device View Switch Locator Feature	209
Using the Command-Line Interface	211
Accessing the Switch Through the CLI	211
Console Connection	211
Telnet Connection	212
Understanding Command Modes	213
Entering CLI Commands	215
Using the Question Mark to Get Help	215
Using Command Completion	216
Entering Abbreviated Commands	216
Negating Commands	216
Command Output Paging	216
Understanding Error Messages	217
Recalling Commands from the History Buffer	217
Default Settings	219
Setting the IP Address and Other Basic Network Information	223
IP Address and Network Information Overview	223
What Is the Basic Network Information?	223
Why Is Basic Network Information Needed?	224
How Is Basic Network Information Configured?	225
What Is Out-of-Band Management and In-Band Management?	225
Default Network Information	228
Configuring Basic Network Information (Web)	229
Out-of-Band Interface	229
IP Interface Configuration (Default VLAN IP Address)	230
Route Entry Configuration (Switch Default Gateway)	232
Domain Name Server	234
Default Domain Name	235
Host Name Mapping	236
Dynamic Host Name Mapping	237
Configuring Basic Network Information (CLI)	238
Enabling the DHCP Client on the OOB Port	238
Enabling the DHCP Client on the Default VLAN	238
Managing DHCP Leases	239
Configuring Static Network Information on the OOB Port	240
Configuring Static Network Information on the Default VLAN	241
Configuring and Viewing Additional Network Information	242
Basic Network Information Configuration Examples	244
Configuring Network Information Using the OOB Port	244
Configuring Network Information Using the Serial Interface	246
Stacking	249
Stacking Overview	249
Dell EMC Networking Stacking Compatibility	253
How is the Stack Master Selected?	254
Adding a Switch to the Stack	255
Removing a Switch from the Stack	256
How is the Firmware Updated on the Stack?	257
What is Stacking Standby?	257
What is Nonstop Forwarding?	258
Switch Stack MAC Addressing and Stack Design Considerations	261
NSF Network Design Considerations	261
Why is Stacking Needed?	262
Default Stacking Values	262
Managing and Monitoring the Stack (Web)	264
Unit Configuration	264
Stack Summary	265
Stack Firmware Synchronization	266
Supported Switches	267
Stack Port Summary	268
Stack Port Counters	269
Stack Port Diagnostics	269
NSF Summary	270
Checkpoint Statistics	271
Managing the Stack (CLI)	272
Configuring Stack Member, Stack Port, SFS and NSF Settings	272
Viewing and Clearing Stacking and NSF Information	274
Connecting to the Management Console from a Stack Member	275
Stacking and NSF Usage Scenarios	275
Basic Failover	275
Preconfiguring a Stack Member	277
NSF in the Data Center	279
NSF and VoIP	280
NSF and DHCP Snooping	281
NSF and the Storage Access Network	282
NSF and Routed Access	284
Authentication, Authorization, and Accounting	287
AAA Introduction	287
Methods	288
Method Lists	289
Access Lines	290
Enabling SSH Access	291
Access Lines (AAA)	291
Access Lines (Non-AAA)	292
Authentication	293
Authentication Access Types	293
Authentication Manager	294
Using RADIUS	303
Using TACACS+	308
Dynamic ACL Overview	310
Authentication Examples	317
Public Key SSH Authentication Example	325
Associating a User With an SSH Key	334
Authorization	336
Exec Authorization Capabilities	336
Authorization Examples	338
RADIUS Change of Authorization	340
TACACS Authorization	344
Accounting	348
RADIUS Accounting	348
IEEE 802.1X	351
What is IEEE 802.1X?	351
What are the 802.1X Port Authentication Modes?	352
What are Authentication Host Modes	353
What is MAC Authentication Bypass?	354
What is the Role of 802.1X in VLAN Assignment?	356
What is Monitor Mode?	360
How Does the Authentication Server Assign DiffServ Policy or ACLs?	362
What is the Internal Authentication Server?	362
Default 802.1X Values	363
Configuring IEEE 802.1X (Web)	364
Captive Portal	388
Captive Portal Overview	388
Default Captive Portal Behavior and Settings	396
Configuring Captive Portal (Web)	398
Configuring Captive Portal (CLI)	414
Captive Portal Configuration Example	420
In Case Of Problems in Captive Portal Deployment	424
Monitoring and Logging System Information	425
System Monitoring Overview	425
What System Information Is Monitored?	425
Why Is System Information Needed?	426
Where Are Log Messages Sent?	426
What Are the Severity Levels?	427
What Are the System Startup and Operation Logs?	427
What Is the Log Message Format?	428
What Factors Should Be Considered When Configuring Logging?	430
Default Log Settings	431
Monitoring System Information and Configuring Logging (Web)	432
Device Information	432
System Health	434
System Resources	435
Unit Power Usage History	436
Integrated Cable Test for Copper Cables	437
Optical Transceiver Diagnostics	438
Log Global Settings	439
RAM Log	440
Log File	442
SYSLOG Server	442
Email Alert Global Configuration	445
Email Alert Mail Server Configuration	445
Email Alert Subject Configuration	447
Email Alert To Address Configuration	448
Email Alert Statistics	448
Monitoring System Information and Configuring Logging (CLI)	450
Viewing System Information and Enabling the Locator LED	450
Running Cable Diagnostics	450
Configuring Local Logging	452
Configuring Remote Logging	453
Configuring Mail Server Settings	454
Configuring Email Alerts for Log Messages	455
Logging Configuration Examples	457
Configuring Local and Remote Logging	457
Configuring Email Alerting	460
Managing General System Settings	463
System Settings Overview	463
Why Does System Information Need to Be Configured?	464
What Are SDM Templates?	465
Why is the System Time Needed?	468
How Does SNTP Work?	468
What Configuration Is Required for Plug-In Modules?	469
Default General System Information	469
Configuring General System Settings (Web)	470
System Information	470
CLI Banner	473
SDM Template Preference	474
Clock	475
SNTP Global Settings	476
SNTP Authentication	477
SNTP Server	479
Summer Time Configuration	482
Time Zone Configuration	483
Card Configuration	484
Slot Summary	485
Supported Cards	486
Power Over Ethernet Global Configuration	487
Power Over Ethernet Unit Configuration	488
Power Over Ethernet Interface Configuration	489
Configuring System Settings (CLI)	491
Configuring System Information	491
Configuring the Banner	492
Managing the SDM Template	493
Configuring SNTP Authentication and an SNTP Server	493
Setting the System Time and Date Manually	495
Configuring the Expansion Slots	496
Viewing Slot Information	497
Configuring PoE Settings	497
General System Settings Configuration Examples	499
Configuring System and Banner Information	499
Configuring SNTP	502
Configuring the Time Manually	504
SNMP	505
SNMP Overview	505
What Is SNMP?	505
What Are SNMP Traps?	506
Why Is SNMP Needed?	507
Default SNMP Values	507
Configuring SNMP (Web)	509
SNMP Global Parameters	509
SNMP View Settings	510
Access Control Group	512
SNMPv3 User Security Model (USM)	514
Communities	517
Notification Filter	519
Notification Recipients	520
Trap Flags	522
OSPFv2 Trap Flags	523
OSPFv3 Trap Flags	524
Trap Log	525
Configuring SNMP (CLI)	527
Configuring the SNMPv3 Engine ID	527
Configuring SNMP Views, Groups, and Users	528
Configuring Communities	531
Configuring SNMP Notifications (Traps and Informs)	533
SNMP Configuration Examples	536
Configuring SNMPv1 and SNMPv2	536
Configuring SNMP Management Station Access	537
Configuring SNMPv3	538
Images and File Management	543
Image and File Management Overview	543
What Files Can Be Managed?	543
Why Is File Management Needed?	545
What Methods Are Supported for File Management?	548
What Factors Should Be Considered When Managing Files?	549
How Is the Running Configuration Saved?	552
Managing Images and Files (Web)	553
File System	553
Active Images	554
USB Flash Drive	555
File Download	556
File Upload	558
Copy Files	560
Managing Images and Files (CLI)	561
Downloading and Activating a New Image (TFTP)	562
Managing Files in Internal Flash	563
Managing Files on a USB Flash Device	564
Uploading a Configuration File (SCP)	565
Managing Configuration Scripts (SFTP)	566
SCP Server	567
File and Image Management Configuration Examples	568
Upgrading the Firmware	568
Managing Configuration Scripts	571
Managing Files by Using the USB Flash Drive	573
DHCP and USB Auto-Configuration	575
Auto Configuration Overview	575
What Is USB Auto Configuration?	576
What Files Does USB Auto Configuration Use?	576
How Does USB Auto Configuration Use the Files on the USB Device?	577
What Is the Setup File Format?	579
What Is the DHCP Auto Configuration Process?	580
Monitoring and Completing the DHCP Auto Configuration Process	585
What Are the Dependencies for DHCP Auto Configuration?	586
Default Auto Configuration Values	588
Managing Auto Configuration (Web)	589
Auto-Install Configuration	589
Managing Auto Configuration (CLI)	590
Managing Auto Configuration	590
Auto Configuration Example	591
Enabling USB Auto Configuration and Auto Image Download	591
Enabling DHCP Auto Configuration and Auto Image Download	592
Easy Firmware Upgrade/Downgrade via USB	594
Monitoring Switch Traffic	595
Traffic Monitoring Overview	595
What is sFlow Technology?	595
What is RMON?	598
What is Port Mirroring?	599
Port Mirroring Behaviors	601
RSPAN	603
Remote Capture	604
Why is Traffic Monitoring Needed?	605
Default Traffic Monitoring Values	605
Monitoring Switch Traffic (Web)	606
sFlow Agent Summary	606
sFlow Receiver Configuration	607
sFlow Sampler Configuration	608
sFlow Poll Configuration	609
Interface Statistics	610
Etherlike Statistics	611
GVRP Statistics	612
EAP Statistics	613
Utilization Summary	614
Counter Summary	615
Switchport Statistics	616
RMON Statistics	617
RMON History Control Statistics	617

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405
1,406
1,407
1,408
1,409
1,410
1,411
1,412
1,413
1,414
1,415
1,416
1,417
1,418
1,419
1,420
1,421
1,422
1,423
1,424
1,425
1,426
1,427
1,428
1,429
1,430
1,431
1,432
1,433
1,434
1,435
1,436
1,437
1,438
1,439
1,440
1,441
1,442
1,443
1,444
1,445
1,446
1,447
1,448
1,449
1,450
1,451
1,452
1,453
1,454
1,455
1,456
1,457
1,458
1,459
1,460
1,461
1,462
1,463
1,464
1,465
1,466
1,467
1,468
1,469
1,470
1,471
1,472
1,473
1,474
1,475
1,476
1,477
1,478
1,479
1,480
1,481
1,482
1,483
1,484
1,485
1,486
1,487
1,488
1,489
1,490
1,491
1,492
1,493
1,494
1,495
1,496
1,497
1,498
1,499
1,500
1,501
1,502
1,503
1,504
1,505
1,506
1,507
1,508
1,509
1,510
1,511
1,512
1,513
1,514
1,515
1,516
1,517
1,518
1,519
1,520
1,521
1,522
1,523
1,524
1,525
1,526
1,527
1,528
1,529
1,530
1,531
1,532
1,533
1,534
1,535
1,536
1,537
1,538
1,539
1,540
1,541
1,542
1,543
1,544
1,545
1,546
1,547
1,548
1,549
1,550
1,551
1,552
1,553
1,554
1,555
1,556
1,557
1,558
1,559
1,560
1,561
1,562
1,563
1,564
1,565
1,566
1,567
1,568
1,569
1,570
1,571
1,572
1,573
1,574
1,575
1,576
1,577
1,578
1,579
1,580
1,581
1,582
1,583
1,584
1,585
1,586
1,587
1,588
1,589
1,590
1,591
1,592
1,593
1,594
1,595
1,596
1,597
1,598
1,599
1,600
1,601
1,602
1,603
1,604
1,605
1,606
1,607
1,608
1,609
1,610
1,611
1,612
1,613
1,614
1,615
1,616
1,617
1,618
1,619
1,620
1,621
1,622
1,623
1,624
1,625
1,626
1,627
1,628
1,629
1,630
1,631
1,632
1,633
1,634
1,635
1,636
1,637
1,638
1,639
1,640
1,641
1,642
1,643
1,644
1,645
1,646
1,647
1,648
1,649
1,650
1,651
1,652
1,653
1,654
1,655
1,656
1,657
1,658
1,659
1,660
1,661
1,662
1,663
1,664
1,665
1,666
1,667
1,668
1,669
1,670
1,671
1,672
1,673
1,674
1,675
1,676
1,677
1,678
1,679
1,680
1,681
1,682
1,683
1,684
1,685
1,686
1,687
1,688
1,689
1,690
1,691
1,692
1,693
1,694
1,695
1,696
1,697
1,698
1,699
1,700
1,701
1,702
1,703
1,704
1,705
1,706
1,707
1,708
1,709
1,710
1,711
1,712
1,713
1,714
1,715
1,716
1,717
1,718
1,719
1,720
1,721
1,722
1,723
1,724
1,725
1,726
1,727
1,728
1,729
1,730
1,731
1,732
1,733
1,734
1,735
1,736
1,737
1,738
1,739
1,740
1,741
1,742
1,743
1,744
1,745
1,746
1,747
1,748
1,749
1,750
1,751
1,752
1,753
1,754
1,755
1,756
1,757
1,758
1,759
1,760
1,761
1,762
1,763
1,764
1,765
1,766
1,767
1,768
1,769
1,770
1,771
1,772
1,773
1,774
1,775
1,776
1,777
1,778
1,779
1,780

Match case Limit results 1 per page

756

Access Control Lists

Complete ACL Example

The following example is a complete inbound ACL that allows access for

hosts connected to gi1/0/1 with IP address in 10.1.1.x range to send IP packets

to 192.168.0.X hosts on gi1/0/2. IP packets not from 10.1.1.x addresses or not

addressed to 192.168.0.x hosts are dropped. Packets with protocols other than

IP, DNS, ARP, or ICMP are dropped. Allowing ICMP supports the 10.1.1.x

hosts in reliably receiving and initiating TCP connections and pinging

through the switch. This example also allows ARP and DNS packets to any

destination and is suitable for a Layer-2 switch. Both administrator-specified

and automatic sequence numbering of the ACLs is demonstrated.

console#

config

console(config)#

mac access-list extended Allow-ARP

console(config-mac-access-list)#

permit any any arp

console(config-mac-access-list)#

exit

console(config)#

ip access-list Allow-10-1-1-x

console(config-ip-acl)#

10 permit ip 10.1.1.0 0.0.0.255 any

console(config-ip-acl)#

20 permit ip any 192.168.0.0 0.0.0.255

console(config-ip-acl)#

30 permit icmp 10.1.1.0 0.0.0.255 any

console(config-ip-acl)#

40 permit ip 0.0.0.0 255.255.255.255 any

console(config-ip-acl)#

50 permit udp any any eq domain

console(config-ip-acl)#

exit

console(config)#

interface gi1/0/1

console(config-if-gi1/0/1)#

mac access-group Allow-ARP in 10

console(config-if-gi1/0/1)#

ip access-group Allow-10-1-1-x in 20

console(config-if-gi1/0/1)#

exit

Another list on the 192.168.0.x network attached port (gi1/0/2) is configured

for this example. Because the two access lists are complementary/end-to-end,

it is necessary to allow ICMP packets to travel between the attached hosts.

Specific sequence numbering of the ACLs rules is shown here.

console(config)#

ip access-list Allow-192-168-0-x

console(config-ip-acl)#

10 permit ip 192.168.0.0 0.0.0.255 10.1.1.0

0.0.0.255

console(config-ip-acl)#

20 permit icmp 192.168.0.0 0.0.0.255 any

console(config-ip-acl)#

30 permit udp any any eq domain

console(config-ip-acl)#

exit

console(config)#

interface gi1/0/2

console(config-if-gi1/0/2)#

mac access-group Allow-ARP in 10

console(config-if-gi1/0/2)#

ip access-group Allow-192-168-0-x in 20