Table of Contents

Configuring Access Control

This chapter describes how to configure and maintain access control lists, which are used to permit or deny incoming or outgoing packets on an interface of the switch router.

Note   For more detailed information on the commands used in this chapter, refer to the Cisco IOS AppleTalk and Novell IPX Command Reference and the Cisco IOS IP and IP Routing Command Reference.

This chapter includes the following sections:

About Access Control

Access control lists (ACLs), sometimes called filters, provide a tool for network control and security. They allow you to filter packet flow into or out of switch router interfaces. You can use ACLs to limit network traffic, and to restrict network use by certain users or devices. Access lists must be created on a per protocol, per interface basis.

To create access lists, first define the criteria for each packet processed by the switch router. The switch router then decides whether to forward or block a packet based on whether the packet matches the criteria defined in the access list. Packets that do not match any criteria on the list are automatically blocked by the implicit "deny all traffic" criteria statement at the end of every access list.

The specific instructions for creating access lists and applying them to interfaces vary from protocol to protocol. The methods used to configure Layer 3 switch access lists is identical to the configuration methods currently used on Cisco routers.

With the exception of the 8-port Gigabit Ethernet interface module, all interface modules and port adapters support access control. Fast EtherChannels (FECs), Gigabit EtherChannels (GECs), and bridge-group virtual interfaces (BVIs) also support access control. The Gigabit Ethernet interfaces on the enhanced Gigabit Ethernet interface module, the Packet-over-SONET uplink interface module, and the ATM uplink interface module have built-in ACL functionality.

The following ACL features are supported on the Catalyst 8500:

Configuring IP Access Lists

An IP access list is a sequential collection of permit and deny conditions that apply to IP addresses. The software supports the following styles of access lists for IP:

The procedure for configuring access lists is as follows:

Step 2   Apply the access list to the appropriate interfaces.

Note   Catalyst 8500 software tests the incoming and outgoing packets against ACL criteria. The first criteria match determines whether the software accepts or rejects the address. Because the software stops testing access list criteria after the first match, the order of the criteria is critical. If none of the criteria match, the software rejects the address.

Creating Standard and Extended IP Access Lists Using Numbers

To create standard IP access lists using numbers, enter the following commands in global configuration mode. To remove the access lists, use the no form of these commands.

Configuring standard IP Access Lists

The following example shows how to create a standard ip access list:

To create an extended IP access list using numbers, enter the following commands:

Configuring Extended Access Lists

The following example an extended access list configuration:

For more detailed information on the commands used to configure numbered IP access lists, refer to the Cisco IOS IP and IP Routing Command Reference .

After an access list is created, any subsequent additions (entered from the terminal, for example) are placed at the end of the list. In other words, you cannot selectively add or remove access list command lines from an access list.

Note   By default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. Further, with standard access lists, if you omit the mask from an associated IP host-address access-list specification, 0.0.0.0 is assumed to be the mask.

After creating an access list, you must apply it to an interface or channel, as shown in the "Applying IP Access Lists to Interfaces" section.

Creating Standard and Extended IP Access Lists Using Names

You can identify IP access lists with an alphanumeric string (a "name") rather than a number. Using named access lists permits you to configure a larger number of IP access lists on a router than can be configured when using numbered access lists.

Note   If you identify your access list(s) with a name rather than a number, the mode and command syntax are slightly different. The tables in this section provide the necessary mode and syntax information.

ACL names can be up to 31 characters in length; are case sensitive; and can in addition to alphanumeric characters, can include the dash (-), the underscore (_), and the period (.). ACL names must start with an alphabetic character, and must be unique from all other ACLs of all types on the switch router. You cannot use keywords from any command as an ACL name.

Consider the following before configuring named access lists:

To create a standard IP access list using names, enter the following commands from global configuration mode:

Configuring Named Access Lists

The following example shows a named IP access list configuration:

To create an extended IP access list using names, enter the following commands from global configuration mode:

Configuring Extended Named Access Lists

The following example shows an extended named IP access list configuration:

For more information on the commands used to configure named IP access lists, refer to the Cisco IOS IP and IP Routing Command Reference.

After creating an access list, place any subsequent additions (entered from the terminal, for example) at the end of the list. You cannot selectively add access list command lines to a specific access list. Use the no permit and the no deny commands to remove entries from a named access list.

Note   When creating standard and extended access lists, remember that as the default the end of the access list contains an implicit deny statement, which is applicable for all unmatched data. In addition, when creating standard access lists, if you omit the mask from an associated IP host-address access-list specification, the default, 0.0.0.0, is assigned as the mask.

Applying IP Access Lists to Interfaces

After you create an access list, you can apply it to one or more interfaces. Access lists can be applied on either outbound or inbound interfaces. When controlling access to an interface, you can use a named access list or numbered access list.

Use the following commands in interface configuration mode to apply an IP access list to an interface:

Applying Access Lists to Interfaces

The following example shows how to apply an access list to an interface:

For more information on configuring IP access lists, refer to the "Configuring IP Services" section of the Cisco IOS IP and IP Routing Configuration Guide .

Configuring IPX Packets

The software supports standard access lists for IPX. Standard access lists restrict traffic based on the source network number. You can further restrict traffic by specifying a destination address and a source and destination address mask.

Standard IPX access lists use numbers from 800-899 for both inbound and outbound traffic.

The software supports the following types of access lists for IPX:

The procedure involved in configuring access lists is as follows:

Step 2   Apply the access list to the appropriate interfaces.

Note   Catalyst 8500 software tests incoming and outgoing packets against access list criteria. The first criteria match determines whether the software accepts or rejects the address. Because the software stops testing access list criteria after the first match, the order of the criteria is critical. If none of the criteria match, the software rejects the address.

Creating IPX Access Lists Using Numbers

To create standard IPX access lists using numbers, use one of the following commands in global configuration mode:

Configuring IPX Access Lists

The following example shows how to configure an IPX numbered access list:

For more information on the commands used to configure numbered IPX access lists, refer to the Cisco IOS AppleTalk and Novell IPX Command Reference.

Creating Named IPX Access Lists

To create standard IPX access lists using names, use the following commands in global configuration mode:

Configuring Named IPX Access Lists

The following example shows how to configure a named IPX access list:

For more information on the commands used to configure named IPX access lists, refer to the Cisco IOS AppleTalk and Novell IPX Command Reference.

Applying IPX Access Lists to an Interface

IPX access lists can be applied on either outbound or inbound interfaces. The following table shows how to accomplish this task for network interfaces. When controlling access to an interface, you can use a name or number.

Use the following command in interface configuration mode.

Applying an IPX Access List to an Interface

The following example shows how to apply an IPX access list to an interface:

For more information on configuring IPX access lists, refer to the "Configuring Novell IPX" section of the Cisco IOS AppleTalk and Novell IPX Configuration Guide .

Verifying Access Lists

To verify the IP access list configuration, use the following commands:

Displaying Interface Configurations

The following example shows output from the show running-configuration command:

Displaying Access List Configurations

The following example shows output from the show ip-access-lists command:

Monitoring IP and IPX Access Lists

Once access control is configured, you can monitor and troubleshoot its operation. You can monitor individual interfaces, or incoming or outgoing packets. Use the following commands to monitor access control:

Displaying ACL Entries for an Interface

The following shows output from the show epc acl tcam2acl interface command:

Displaying ACL Configurations

The following shows output from the show epc acl lookup command:

For more information on the commands, refer to the Cisco IOS AppleTalk and Novell IPX Command Reference and the Cisco IOS IP and IP Routing Command Reference .