Configuring extended numbered acls, Configuring extended numbered, Acls – Brocade Multi-Service IronWare Security Configuration Guide (Supporting R05.6.00) User Manual
Page 123
Multi-Service IronWare Security Configuration Guide
105
53-1003035-02
Configuring numbered and named ACLs
3
Parameters to bind standard ACLs to an interface
Use the ip access-group command to bind the ACL to an inbound interface and enter the ACL
number for num.
Configuring extended numbered ACLs
This section describes how to configure extended numbered IPv4 ACLs:
•
For configuration information on standard ACLs, refer to
“Configuring standard numbered
•
For configuration information on named ACLs, refer to
“Configuring standard or extended
.
Extended ACLs let you permit or deny packets based on the following information:
•
IP protocol
•
Source IP address or host name
•
Destination IP address or host name
•
Source TCP or UDP port (if the IP protocol is TCP or UDP)
•
Destination TCP or UDP port (if the IP protocol is TCP or UDP)
The IP protocol can be one of the following well-known names or any IP protocol number from 0 –
255:
•
Internet Control Message Protocol (ICMP)
•
Internet Group Management Protocol (IGMP)
•
Internet Gateway Routing Protocol (IGRP)
•
Internet Protocol (IP)
•
Open Shortest Path First (OSPF)
•
Transmission Control Protocol (TCP)
•
User Datagram Protocol (UDP)
For TCP and UDP, you also can specify a comparison operator and port name or number. For
example, you can configure a policy to block web access to a specific web site by denying all TCP
port 80 (HTTP) packets from a specified source IP address to the web site’s IP address.
To configure an extended access list that blocks all Telnet traffic received on port 1/1 from IP host
10.157.22.26, create the ACL with permit and deny rules, then bind the ACL to port 1/1 using the ip
access-group command. Enter the following commands.
Brocade(config)# access-list 101 deny tcp host 10.157.22.26 any eq telnet
Brocade(config)# access-list 101 permit ip any any
Brocade(config)# int eth 1/1
Brocade(config-if-e10000-1/1)# ip access-group 101 in
Brocade(config)# write memory