Cisco Systems 3130 User Manual

In this example of a numbered ACL, the Winter and Smith servers are not allowed to browse the web:

Switch(config)# access-list 100 remark Do not allow Winter to browse the web

Switch(config)# access-list 100 deny host 171.69.3.85 any eq www

Switch(config)# access-list 100 remark Do not allow Smith to browse the web

Switch(config)# access-list 100 deny host 171.69.3.13 any eq www

In this example of a named ACL, the Jones subnet is not allowed access:

Switch(config)# ip access-list standard prevention

Switch(config-std-nacl)# remark Do not allow Jones subnet through

Switch(config-std-nacl)# deny 171.69.0.0 0.0.255.255

In this example of a named ACL, the Jones subnet is not allowed to use outbound Telnet:

Switch(config)# ip access-list extended telnetting

Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out

Switch(config-ext-nacl)# deny tcp 171.69.0.0 0.0.255.255 any eq telnet

Two variations of logging are supported on router ACLs. The log keyword sends an informational 
logging message to the console about the packet that matches the entry; the log-input keyword includes 
the input interface in the log entry.

In this example, standard named access list stan1 denies traffic from 10.1.1.0 0.0.0.255, allows traffic 
from all other sources, and includes the log keyword.

Switch(config)# ip access-list standard stan1

Switch(config-std-nacl)# deny 10.1.1.0 0.0.0.255 log

Switch(config-std-nacl)# permit any log

Switch(config-std-nacl)# exit

Switch(config)# interface gigabitethernet1/0/1

Switch(config-if)# ip access-group stan1 in

Switch(config-if)# end

Switch# show logging

Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns)

    Console logging: level debugging, 37 messages logged

    Monitor logging: level debugging, 0 messages logged

    Buffer logging: level debugging, 37 messages logged

    File logging: disabled

    Trap logging: level debugging, 39 message lines logged

Log Buffer (4096 bytes):

00:00:48: NTP: authentication delay calculation problems

<output truncated>

00:09:34:%SEC-6-IPACCESSLOGS:list stan1 permitted 0.0.0.0 1 packet

00:09:59:%SEC-6-IPACCESSLOGS:list stan1 denied 10.1.1.15 1 packet

00:10:11:%SEC-6-IPACCESSLOGS:list stan1 permitted 0.0.0.0 1 packet

This example is a named extended access list ext1 that permits ICMP packets from any source to 10.1.1.0 
0.0.0.255 and denies all UDP packets.

Switch(config)# ip access-list extended ext1

Switch(config-ext-nacl)# permit icmp any 10.1.1.0 0.0.0.255 log

Switch(config-ext-nacl)# deny udp any any log

Switch(config-std-nacl)# exit

Switch(config)# interface gigabitethernet1/0/2

Switch(config-if)# ip access-group ext1 in