How to configure ACLs | IPv4 ACLs | Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.x

Configure ACLs.

Configure IPv4 ACLs (GUI)

Define and apply IPv4 ACL rules for traffic management and security.

Procedure

Choose Configuration > Security > ACL.
Click Add.
In the Add ACL Setup dialog box, enter the details for these parameters.
- ACL Name: Enter the name for the ACL.
- ACL Type: IPv4 Standard.
- Sequence: Enter the sequence number.
- Action: Select Permit or Deny the packet flow from the drop-down list.
- Source Type: Choose any, Host or Network from which the packet is sent.
- Log: Enable or disable logging.
Click Add.
Add the rest of the rules and click Apply to Device.

Configure IPv4 ACLs

Follow the procedure given below to use IP ACLs on the switch:

Procedure

Create an ACL by specifying an access list number or name and the access conditions.
Apply the ACL to interfaces or terminal lines. .

Create a numbered standard ACL (GUI)

Define and apply a numbered standard ACL using the device’s web interface using GUI.

Procedure

Choose Configuration > Security > ACL.
On the ACL page, click Add.
In the Add ACL Setup window, enter the details for these parameters.
- ACL Name: Enter the name for the ACL.
- ACL Type: IPv4 Standard.
- Sequence: Enter the sequence number.
- Action: Select Permit or Deny access from the drop-down list.
- Source Type: Choose any , Host or Network.
- Log: Enable or disable logging, this is limited to ACLs associated to Layer 3 interface only.
Click Add.
Click Save & Apply to Device.

Create a numbered standard ACL (CLI)

Follow the procedure given below to create a numbered standard ACL using commands:

Procedure

Enable the privileged EXEC mode and enter your password if prompted.
Example:
```
Device# enable
```
Enter the global configuration mode.
Example:
```
Device# configure terminal
```
Define a standard IPv4 access list by using a source address and wildcard.
Example:
```
Device(config)# access-list 2 {deny | permit} source source-wildcard your_host 
```
The access-list-number is a decimal number from 1 to 99 or 1300 to 1999.

Enter deny or permit to specify whether to deny or permit access if conditions are matched.

The source is the source address of the network or host from which the packet is being sent. Specify the source as:
- The 32-bit quantity in dotted-decimal format.
- The keyword any abbreviates for source and source-wildcard as 0.0.0.0 255.255.255.255. You do not need to enter a source-wildcard.
- The keyword host abbreviates source and source-wildcard as source 0.0.0.0.
The source-wildcard applies wildcard bits to the source address.

Note

Logging is supported only on ACLs attached to Layer 3 interfaces.
Return to privileged EXEC mode.
Example:
```
Device(config)# end
```
Verify your entries.
Example:
```
Device# show running-config
```
Save your entries in the configuration file.
Example:
```
Device# copy running-config startup-config
```

Create a numbered extended ACL (GUI)

Set up a numbered extended ACL to control network traffic based on source, destination, and protocol using the GUI.

Procedure

Choose Configuration > Security > ACL.
On the ACL page, click Add.
In the Add ACL Setup window, enter the details for these parameters.
- ACL Name: Enter the name for the ACL.
- ACL Type: IPv4 Extended.
- Sequence: Enter the sequence number.
- Action: Select Permit or Deny the packet flow from the drop-down list.
- Source Type: Choose any , Host or Network from which the packet is sent.
- Destination Type: Choose any , Host or Network to which the packet is sent.
- Protocol: Select a protocol from the drop-down list.
- Log: Enable or disable logging.
- DSCP: Enter to match packets with the DSCP value.
Click Add.
Click Save & Apply to Device.

Create a numbered extended ACL (CLI)

Follow the procedure given below to create a numbered extended ACL using commands:

Procedure

Enters global configuration mode.
Example:
```
Device# configure terminal
```
Defines an extended IPv4 access list and the access conditions.
Example:
```
Device# access-list 101 {deny | permit} ip host 10.1.1.2 any [precedence 0] [tos 0] [fragments] log [log-input | smartlog] [time-range time-range-name] [dscp dscp]
```
The access-list-number is a decimal number from 100 to 199 or 2000 to 2699.

Enter deny or permit to specify whether to deny or permit the packet if conditions are matched.

For protocol , enter the name or number of an P protocol: ahp , eigrp , esp , gre , icmp , igmp , igrp , ip , ipinip , nos , ospf , pcp , pim , tcp , or udp , or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP), use the keyword ip .

Note
This step includes options for most IP protocols. For additional specific parameters for TCP, UDP, ICMP, and IGMP, see the following steps.

The source is the number of the network or host from which the packet is sent.

The source-wildcard applies wildcard bits to the source.

The destination is the network or host number to which the packet is sent.

The destination-wildcard applies wildcard bits to the destination.

Source, source-wildcard, destination, and destination-wildcard can be specified as:
- The 32-bit quantity in dotted-decimal format.
- The keyword any for 0.0.0.0 255.255.255.255 (any host).
- The keyword host for a single host 0.0.0.0.
The other keywords are optional and have these meanings:
- precedence : Enter to match packets with a precedence level specified as a number from 0 to 7 or by name: routine (0), priority (1), immediate (2), flash (3), flash-override (4), critical (5), internet (6), network (7).
- fragments : Enter to check non-initial fragments.
- tos : Enter to match by type of service level, specified by a number from 0 to 15 or a name: normal (0), max-reliability (2), max-throughput (4), min-delay (8).
- time-range : Specify the time-range name.
- dscp : Enter to match packets with the DSCP value specified by a number from 0 to 63, or use the question mark (?) to see a list of available values.
  Note
  Your controller must support the ability to:
  
  Mark DCSP
  
  Mark UP
  
  Map DSCP and UP
  
  For more information on DSCP-to-UP Mapping , see:
  
  https://tools.ietf.org/html/draft-ietf-tsvwg-ieee-802-11-01
Note

If you enter a dscp value, you cannot enter tos or precedence . You can enter both a tos and a precedence value with no dscp .
Define an extended TCP access list and the access conditions.
Example:
```
Device(config)# access-list 101 {deny | permit} tcp source source-wildcard [operator-port] destination destination-wildcard 500 [established] [precedence 0] [tos 0] [fragments] log [log-input | smartlog] [time-range time-range-name] [dscp dscp] [flag]
```
The parameters are the same as those described for an extended IPv4 ACL, with these exceptions:

Enter an operator and port to compare source (if positioned after source source-wildcard ) or destination (if positioned after destination destination-wildcard ) port. Possible operators include eq (equal), gt (greater than), lt (less than), neq (not equal), and range (inclusive range). Operators require a port number (range requires two port numbers separated by a space).

Enter the port number as a decimal number (from 0 to 65535) or the name of a TCP port. Use only TCP port numbers or names when filtering TCP.

The other optional keywords have these meanings:
- flag : Enter one of these flags to match by the specified TCP header bits: ack (acknowledge), fin (finish), psh (push), rst (reset), syn (synchronize), or urg (urgent).
Define an extended UDP access list and the access conditions.
Example:
```
Device(config)# access-list 101 {deny | permit} udp source source-wildcard [operator port] destination destination-wildcard 100 precedence 0] [tos 0] [fragments] log [log-input | smartlog] [time-range time-range-name] [dscp dscp
```
The UDP parameters are the same as those described for TCP except that the [operator [port]] port number or name must be a UDP port number or name, and the flag not valid for UDP.
Define an extended ICMP access list and the access conditions.
Example:
```
Device(config)# access-list 101 {deny | permit} icmp source source-wildcard destination destination-wildcard [ icmp-type | [[ icmp-type icmp-code ] | [ icmp-message ]] precedence 0] [tos 0] [fragments] log [log-input | smartlog] [time-range time-range-name] [dscp dscp]
```
The ICMP parameters are the same as those described for most IP protocols in an extended IPv4 ACL, with the addition of the ICMP message type and code parameters. These optional keywords have these meanings:
- icmp-type: Enter to filter by ICMP message type, a number from 0 to 255.
- icmp-code: Enter to filter ICMP packets that are filtered by the ICMP message code type, a number from 0 to 255.
- icmp-message: Enter to filter ICMP packets by the ICMP message type name or the ICMP message type and code name.
Define an extended IGMP access list and the access conditions.
Example:
```
Device(config)# access-list 101 {deny | permit} igmp source source-wildcard destination destination-wildcard [ igmp-type ] precedence 0] [tos 0] [fragments] log [log-input | smartlog] [time-range time-range-name] [dscp dscp]
```
The IGMP parameters are the same as those described for most IP protocols in an extended IPv4 ACL, with this optional parameter.

igmp-type: To match IGMP message type, enter a number from 0 to 15, or enter the message name: dvmrp , host-query , host-report , pim , or trace .
Return to privileged EXEC mode.
Example:
```
Device(config)# end
```
Save your entries in the configuration file.
Example:
```
Device# copy running-config startup-config
```

Create named standard ACLs (GUI)

Use this procedure to set up and apply ACLs for network security management within the device’s GUI.

Procedure

Click Configuration > Security > ACL.
Click Add to create a new ACL setup.
In the Add ACL Setup window, enter these parameters:
- ACL Name: Enter the name for the ACL.
- ACL Type: IPv4 Standard.
- Sequence: The valid range is between 1 and 99 or 1300 and 1999.
- Action: Select Permit or Deny access from the drop-down list.
- Source Type: Choose any, Host or Network.
- Log: Enable or disable logging, this is limited to ACLs associated to Layer 3 interface only.
Click Add to add the rule.
Click Save & Apply to Device.

Create named standard ACLs (CLI)

Define and apply named standard ACLs to permit or deny traffic from specified IPv4 source addresses using commands.

Procedure

Enter the privileged EXEC mode.
Example:
```
Device# enable
```
Enter the global configuration mode.
Example:
```
Device# configure terminal
```
Define a standard IPv4 access list using a name, and enter the access-list configuration mode.
Example:
```
Device(config)# ip access-list standard 20
```
The name can be a number from 1 to 99.
Specify one or more conditions denied or permitted to decide if the packet is forwarded or dropped in access-list configuration mode. Use one of the these:
- deny { source [ source-wildcard ] | host source | any } [ log ]
- permit { source [ source-wildcard ] | host source | any } [ log ]
Example:
```
Device(config-std-nacl)# deny 192.168.0.0 0.0.255.255 255.255.0.0 0.0.255.255
```
or
```
Device(config-std-nacl)# permit 10.108.0.0 0.0.0.0 255.255.255.0 0.0.0.0
```
- host source : A source and source wildcard of source 0.0.0.0.
- any : A source and source wildcard of 0.0.0.0 255.255.255.255.
Returns to privileged EXEC mode.
Example:
```
Device(config-std-nacl)# end
```
Verify your entries.
Example:
```
Device# show running-config
```
Save your entries in the configuration file.
Example:
```
Device# copy running-config startup-config
```

Create extended named ACLs (GUI)

Follow these steps to filter traffic based on granular criteria, such as source/destination, protocol, or DSCP using the GUI.

Procedure

Choose Configuration > Security > ACL.
Click Add.
In the Add ACL Setup window, enter these parameters.
- ACL Name: Enter the name for the ACL.
- ACL Type: IPv4 Extended.
- Sequence: Enter the sequence number.
- Action: Select Permit or Deny the packet flow from the drop-down list.
- Source Type: Choose any, Host or Network from which the packet is sent.
- Destination Type: Choose any, Host or Network to which the packet is sent.
- Protocol: Select a protocol from the drop-down list.
- Log: Enable or disable logging.
- DSCP: Enter to match packets with the DSCP value.
Click Add.
Add the rest of the rules and click Apply to Device.

Create extended named ACLs (CLI)

Use this procedure to create extended named access control lists (ACLs) using CLI commands.

Procedure

Enable the privileged EXEC mode and enter your password if prompted.
Example:
```
Device# enable
```
Enter the global configuration mode.
Example:
```
Device# configure terminal
```
Define an extended IPv4 access list using a name, and enter the access-list configuration mode.
Example:
```
Device(config)# ip access-list extended 150
```
The name can be a number from 100 to 199.
Specify the conditions allowed or denied in access-list configuration mode { deny | permit } protocol { source [ source-wildcard ] | host source | any } { destination [ destination-wildcard ] | host destination | any } [ precedence precedence ] [ tostos ] [ log ] [ time-range time-range-name ]
Example:
```
Device(config-ext-nacl)# permit 0 any any
```
Use the log keyword to get access list logging messages, including violations.
- host source : A source and source wildcard of source 0.0.0.0.
- host destintation : A destination and destination wildcard of destination 0.0.0.0.
- any : A source and source wildcard or destination and destination wildcard of 0.0.0.0 255.255.255.255.
Return to the privileged EXEC mode.
Example:
```
Device(config-ext-nacl)# end
```
Verifiy your entries.
Example:
```
Device# show running-config
```
Save your entries in the configuration file.
Example:
```
Device# copy running-config startup-config
```

When you create extended ACLs, an implicit deny statement is added by default at the end of the ACL. If no match occurs before reaching the end, all traffic is denied. For standard ACLs, omitting the mask from an IP host address access list specification causes the system to use 0.0.0.0 as the mask.

New entries are always placed at the end of the ACL after you create it. You cannot add ACL entries at specific positions within an ACL. However, you can remove entries from a named ACL using the no permit and no deny access-list configuration mode commands.

Being able to selectively remove lines from a named ACL is one reason you might use named ACLs instead of numbered ACLs.

What to do next

After you create a named ACL, apply it to interfaces or to VLANs .

Apply an IPv4 ACL to an interface (GUI)

Use this procedure when you need to restrict or permit traffic through a device interface based on IPv4 ACL rules using the GUI.

Procedure

Choose Configuration > Security > ACL.
Click Associating Interfaces.
Choose the interface from the Available Interfaces list to view its ACL details on the right-hand side. You can change the ACL details, if required.
Click Save & Apply to Device.

Apply an IPv4 ACL to an interface (CLI)

Restrict or permit packets on an interface by associating an ACL using commands.

This section describes how to apply IPv4 ACLs to network interfaces.

Beginning in privileged EXEC mode, follow the procedure given below to control access to an interface:

Procedure

Enter the global configuration mode.
Example:
```
Device# configure terminal
```
Identify a specific interface for configuration, and enter the interface configuration mode.
Example:
```
Device(config)# 
```
The interface is a layer 2 interface (port ACL) , or a layer 3 interface (router ACL).

Control access to the specified interface.

Example:

Device(config-if)# ip access-group {access-list-number 2 | name} {in | out}

Return to the privileged EXEC mode.
Example:
```
Device(config-if)# end
```
Display the access list configuration.
Example:
```
Device# show running-config
```
Save your entries in the configuration file.
Example:
```
Device# copy running-config startup-config
```

Apply ACL to policy profile (GUI)

Use this procedure to apply an ACL to a policy profile using the GUI.

Procedure

Choose Configuration > Tags & Profiles > Policy.
On the Policy Profile page, click Add.
In the Add Policy Profile window, click Access Policies tab.
In the WLAN ACL area, select the IPv4 ACL from the IPv4 ACL drop-down list.
Click Apply to Device.

Apply ACL to policy profile (CLI)

Use these steps to attach a preconfigured IPv4 ACL to a specific WLAN policy profile using commands.

Procedure

Enter the global configuration mode.
Example:
```
Device# configure terminal
```
Configure a WLAN policy profile and enter the wireless policy configuration mode.
Example:
```
Device(config)# wireless profile policy profile-policy
```

Configure an IPv4 ACL.

Example:

Device(config-wireless-policy)# ipv4 acl test-acl

Return to the privileged EXEC mode.
Example:
```
Device(config-wireless-policy)# end
```
Alternatively, you can also press Ctrl-Z to exit global configuration mode.