Brocade Communications Systems Brocade ICX 6650 6650 User Manual
96
Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Extended named ACL configuration
The first entry in this ACL denies TCP traffic from the 10.157.21.x network to the 10.157.22.x
network.
network.
The second entry denies all FTP traffic from the 10.157.21.x network to the 10.157.22.x network.
The third entry denies TCP traffic from the 10.157.21.x network to the 10.157.22.x network, if the
TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), and if
the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater than
23 are allowed.
TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), and if
the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater than
23 are allowed.
The fourth entry denies UDP packets from any source to the 10.157.22.x network, if the UDP port
number from the source network is 5 or 6 and the destination UDP port is 7 or 8.
number from the source network is 5 or 6 and the destination UDP port is 7 or 8.
The fifth entry permits all packets that are not explicitly denied by the other entries. Without this
entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the
ACL.
entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the
ACL.
The following commands apply ACL 103 to the incoming traffic on ports 1/2/1 and 1/2/2.
Extended named ACL configuration
The commands for configuring named ACL entries are different from the commands for configuring
numbered ACL entries. The command to configure a numbered ACL is access-list. The command
for configuring a named ACL is ip access-list. In addition, when you configure a numbered ACL
entry, you specify all the command parameters on the same command. When you configure a
named ACL, you specify the ACL type (standard or extended) and the ACL number with one
command, which places you in the configuration level for that ACL. Once you enter the
configuration level for the ACL, the command syntax is the same as the syntax for numbered ACLs.
numbered ACL entries. The command to configure a numbered ACL is access-list. The command
for configuring a named ACL is ip access-list. In addition, when you configure a numbered ACL
entry, you specify all the command parameters on the same command. When you configure a
named ACL, you specify the ACL type (standard or extended) and the ACL number with one
command, which places you in the configuration level for that ACL. Once you enter the
configuration level for the ACL, the command syntax is the same as the syntax for numbered ACLs.
Extended ACLs let you permit or deny packets based on the following information:
•
IP protocol
•
Source IP address or host name
•
Destination IP address or host name
•
Source TCP or UDP port (if the IP protocol is TCP or UDP)
•
Destination TCP or UDP port (if the IP protocol is TCP or UDP)
The IP protocol can be one of the following well-known names or any IP protocol number from 0 –
255:
255:
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 10.157.22.0/24
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 eq ftp 10.157.22.0/24
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 10.157.22.0/24 lt
telnet neq 5
Brocade(config)# access-list 103 deny udp any range 5 6 10.157.22.0/24 range 7 8
Brocade(config)# access-list 103 permit ip any any
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 eq ftp 10.157.22.0/24
Brocade(config)# access-list 103 deny tcp 10.157.21.0/24 10.157.22.0/24 lt
telnet neq 5
Brocade(config)# access-list 103 deny udp any range 5 6 10.157.22.0/24 range 7 8
Brocade(config)# access-list 103 permit ip any any
Brocade(config)# interface ethernet 1/2/1
Brocade(config-if-e10000-1/2/1)# ip access-group 103 in
Brocade(config-if-e10000-1/2/1)# exit
Brocade(config)# interface ethernet 1/2/2
Brocade(config-if-e10000-1/2/2)# ip access-group 103 in
Brocade(config)# write memory
Brocade(config-if-e10000-1/2/1)# ip access-group 103 in
Brocade(config-if-e10000-1/2/1)# exit
Brocade(config)# interface ethernet 1/2/2
Brocade(config-if-e10000-1/2/2)# ip access-group 103 in
Brocade(config)# write memory