Brocade Communications Systems 12.4.00a Manual De Usuario
58
ServerIron ADX Security Guide
53-1002440-03
Configuring numbered and named ACLs
2
Here is another example of an extended ACL.
The first entry in this ACL denies TCP traffic from the 209.157.21.x network to the 209.157.22.x
network.
network.
The second entry denies all FTP traffic from the 209.157.21.x network to the 209.157.22.x
network.
network.
The third entry denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network, if
the TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), and
if the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater
than 23 are allowed.
the TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), and
if the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater
than 23 are allowed.
The fourth entry denies UDP packets from any source to the 209.157.22.x network, if the UDP port
number from the source network is 5 or 6 and the destination UDP port is 7 or 8.
number from the source network is 5 or 6 and the destination UDP port is 7 or 8.
The fifth entry permits all packets that are not explicitly denied by the other entries. Without this
entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the
ACL.
entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the
ACL.
The following commands apply ACL 103 to the incoming traffic on ports 2/1 and 2/2.
Extended ACL syntax
Use the following syntax for configuring extended numbered ACLs.
Syntax: [no] access-list <num> deny | permit <ip-protocol> <source-ip> | <hostname>
<wildcard> [<operator> <source-tcp/udp-port>] <destination-ip> | <hostname>
[<icmp-type> | <icmp-num> | <icmp-type-number> <icmp-code-number>] <wildcard>
[<operator> <destination-tcp/udp-port>] [established] [precedence <name> | <num>]
[tos <name> | <num>] [ip-pkt-len <value>]
[<icmp-type> | <icmp-num> | <icmp-type-number> <icmp-code-number>] <wildcard>
[<operator> <destination-tcp/udp-port>] [established] [precedence <name> | <num>]
[tos <name> | <num>] [ip-pkt-len <value>]
Syntax: [no] access-list <num> deny | permit host <ip-protocol> any any
Syntax: [no] ip access-group <num> in | out
ServerIronADX(config)# int eth 1/2
ServerIronADX(config-if-1/2)# ip access-group 102 in
ServerIronADX(config-if-1/2)# exit
ServerIronADX(config)# int eth 4/3
ServerIronADX(config-if-4/3)# ip access-group 102 in
ServerIronADX(config)# write memory
ServerIronADX(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24
ServerIronADX(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp
209.157.22.0/24
ServerIronADX(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 lt
telnet neq 5
ServerIronADX(config)# access-list 103 deny udp any range 5 6 209.157.22.0/24
range 7 8
ServerIronADX(config)# access-list 103 permit ip any any
ServerIronADX(config)# int eth 2/1
ServerIronADX(config-if-2/1)# ip access-group 103 in
ServerIronADX(config-if-2/1)# exit
ServerIronADX(config)# int eth 2/2
ServerIronADX(config-if-2/2)# ip access-group 103 in
ServerIronADX(config)# write memory