Brocade Multi-Service IronWare Security Configuration Guide (Supporting R05.6.00) User Manual
Page 124
106
Multi-Service IronWare Security Configuration Guide
53-1003035-02
Configuring numbered and named ACLs
3
Here is another example of commands for configuring an extended ACL and applying it to an
interface. These examples show many of the syntax choices.
The first entry permits ICMP traffic from hosts in the 10.157.22.x network to hosts in the
10.157.21.x network.
The second entry denies IGMP traffic from the host Brocade device named “rkwong” to the
10.157.21.x network.
The third entry denies IGRP traffic from the 10.157.21.x network to the host Brocade device named
“rkwong”.
The fourth entry denies all IP traffic from host 10.157.21.100 to host 10.157.22.1.
The fifth entry denies all OSPF traffic.
The sixth entry permits all packets that are not explicitly denied by the other entries. Without this
entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the
ACL.
The following commands apply ACL 102 to the incoming traffic on port 1/2 and to the outgoing
traffic on port 4/3.
Here is another example of an extended ACL.
The first entry in this ACL denies TCP traffic from the 10.157.21.x network to the 10.157.22.x
network.
The second entry denies all FTP traffic from the 10.157.21.x network to the 10.157.22.x network.
The third entry denies TCP traffic from the 10.157.21.x network to the 10.157.22.x network if the
TCP port number of the traffic is less than the well-known TCP port number for Telnet (23) and if the
TCP port is not equal to 5. Thus, TCP packets with a TCP port number equal to 5 or greater than 23
are allowed.
The fourth entry denies UDP packets from any source to the 10.157.22.x network, if the UDP port
number from the source network is 5 or 6 and the destination UDP port is 7 or 8.
Brocade(config)# access-list 102 perm icmp 10.157.22.0/24 10.157.21.0/24
Brocade(config)# access-list 102 deny igmp host rkwong 10.157.21.0/24
Brocade(config)# access-list 102 deny igrp 10.157.21.0/24 host rkwong
Brocade(config)# access-list 102 deny ip host 10.157.21.100 host 10.157.22.1
Brocade(config)# access-list 102 deny ospf any any
Brocade(config)# access-list 102 permit ip any any
Brocade(config)# int eth 1/2
Brocade(config-if-e10000-1/2)# ip access-group 102 in
Brocade(config-if-e10000-1/2)# exit
Brocade(config)# int eth 4/3
Brocade(config-if-e10000-4/3)# ip access-group 102 out
Brocade(config)# write memory
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 10.157.22.0/24
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 eq ftp 10.157.22.0/24
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 10.157.22.0/24 lt
telnet neq 5
Brocade(config)# access-list 103 deny udp any range 5 6 10.157.22.0/24 range 7 8
Brocade(config)# access-list 103 permit ip any any