![]() |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Configuring the IP Permit List
![]() |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Table of ContentsConfiguring the IP Permit ListUnderstanding the IP Permit List
IP Permit List Default Configuration Configuring the IP Permit List Configuring the IP Permit ListThis chapter describes how to configure the IP permit list on the Catalyst enterprise LAN switches.
This chapter consists of these sections:
Understanding the IP Permit ListIP permit prevents inbound Telnet and SNMP access to the switch from unauthorized source IP addresses. Telnet attempts from unauthorized source IP addresses are denied a connection. SNMP requests from unauthorized IP addresses receive no response; the request times out. All other TCP/IP services (such as IP traceroute and IP ping) continue to work normally when you enable the IP permit list. Outbound Telnet, Trivial File Transfer Protocol (TFTP), and other IP-based services are unaffected by the IP permit list. If you want to log unauthorized access attempts to the console or a syslog server, you must change the logging severity level for IP, as described in the "Enabling IP Permit List" section. If you want to generate SNMP traps when unauthorized access attempts are made, you must enable IP permit list (ippermit) SNMP traps, as described in the "Enabling IP Permit List" section. Multiple access attempts from the same unauthorized host only trigger notifications every ten minutes. You can configure up to 100 entries in the permit list. Each entry consists of an IP address and subnet mask pair in dotted decimal format and information on whether the IP address is part of the SNMP permit list, Telnet permit list, or both lists. The bits set to one in the mask are checked for a match with the source IP address of incoming packets, while the bits set to zero are not checked. This process allows wildcard addresses to be specified. If you do not specify the mask for an IP permit list entry, or if you enter a host name instead of an IP address, the mask has an implicit value of all bits set to one (255.255.255.255 or 0xffffffff), which matches only the IP address of that host. If you do not specify SNMP or Telnet for the type of permit list for the IP address, the IP address is added to both the SNMP and Telnet permit lists. You can specify the same IP address in more than one entry in the permit list if the masks are different. The mask is applied to the address before it is stored in NVRAM, so that entries that have the same effect (but different addresses) are not stored. When you add this address to the IP permit list, the system displays the address after the mask is applied. IP Permit List Default ConfigurationTable 19-1 shows the default IP permit list configuration. Table 19-1: IP Permit List Default Configuration
Configuring the IP Permit ListThese sections describe how to configure IP permit list:
Adding IP Addresses to the IP Permit ListAn IP address can be added to the SNMP permit list, the Telnet permit list, or both lists. To add IP addresses to an IP permit list, perform this task in privileged mode:
This example shows how to add IP addresses to IP permit list and verify the configuration: Console> (enable) set ip permit 172.16.0.0 255.255.0.0 telnet 172.16.0.0 with mask 255.255.0.0 added to telnet permit list. Console> (enable) set ip permit 172.20.52.32 255.255.255.224 snmp 172.20.52.32 with mask 255.255.255.224 added to snmp permit list. Console> (enable) set ip permit 172.20.52.3 all 172.20.52.3 added to IP permit list. Console> (enable) show ip permit Telnet permit list feature enabled. Snmp permit list feature enabled. Permit List Mask Access Type ---------------- ---------------- ------------- 172.16.0.0 255.255.0.0 telnet 172.20.52.3 snmp telnet 172.20.52.32 255.255.255.224 snmp Denied IP Address Last Accessed Time Type Telnet Count SNMP Count ----------------- ------------------ ------ ------------ ---------- 172.100.101.104 01/20/97,07:45:20 SNMP 14 1430 172.187.206.222 01/21/97,14:23:05 Telnet 7 236 Console> (enable) Enabling IP Permit ListYou can enable either the SNMP permit list, the Telnet permit list, or both lists. If you do not specify a permit list, both the SNMP and Telnet permit lists are enabled.
To enable IP permit list on the switch, perform this task in privileged mode:
This example shows how to enable the IP permit list and verify the configuration: Console> (enable) set ip permit enable IP permit list enabled. Console> (enable) set snmp trap enable ippermit SNMP IP Permit traps enabled. Console> (enable) set logging level ip 4 default System logging facility <ip> set to severity 4(warnings) Console> (enable) show ip permit Telnet permit list feature enabled. Snmp permit list feature disabled. Permit List Mask Access-Type ---------------- --------------- --------------- 172.16.0.0 255.255.0.0 telnet 172.20.52.3 snmp telnet 172.20.52.32 255.255.255.224 snmp Denied IP Address Last Accessed Time Type Telnet Count SNMP Count ----------------- ------------------ ------ ------------ ---------- 172.100.101.104 01/20/97,07:45:20 SNMP 14 1430 172.187.206.222 01/21/97,14:23:05 Telnet 7 236 Console> (enable) show snmp RMON: Disabled Extended Rmon: Extended RMON module is not present Traps Enabled: ippermit Port Traps Enabled: None Community-Access Community-String ---------------- -------------------- read-only public read-write private read-write-all secret Trap-Rec-Address Trap-Rec-Community ---------------------------------------- -------------------- Console> (enable) Disabling the IP Permit ListTo disable the IP permit list on the switch, perform this task in privileged mode:
This example shows how to disable the IP permit list: Console> (enable) set ip permit disable IP permit list disabled. Console> (enable) Clearing an IP Permit List EntryAn IP address can be cleared from the SNMP permit list, the Telnet permit list, or both lists. If you do not specify which permit list to clear the IP address from, the IP address is deleted from both permit lists.
To clear an IP permit list entry, perform this task in privileged mode:
This example shows how to clear an IP permit list entry: Console> (enable) clear ip permit 172.100.101.102 172.100.101.102 cleared from IP permit list. Console> (enable) clear ip permit 172.160.161.0 255.255.192.0 snmp 172.160.128.0 with mask 255.255.192.0 cleared from snmp permit list. Console> (enable) clear ip permit 172.100.101.102 telnet 172.100.101.102 cleared from telnet permit list. Console> (enable) clear ip permit all IP permit list cleared. Console> (enable)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||