Cisco Cisco Packet Data Interworking Function (PDIF) Guía De Administador
Access Control Lists
Applying IP ACLs ▀
Cisco ASR 5000 System Administration Guide ▄
253
To configure the system to provide access control list facility to subscribers:
Step 1
Step 2
Step 3
Save your configuration to flash memory, an external memory device, and/or a network location using the Exec mode
save configuration command. For additional information refer to the Verifying and Saving Your Configuration chapter.
save configuration command. For additional information refer to the Verifying and Saving Your Configuration chapter.
Applying an ACL to Multiple Subscriber via APNs
To apply the ACL to multiple subscribers via APN, use the following configuration:
configure
context dest_context_name [-noconfirm]
apn apn_name
{ ip | ipv6 } access-group acl_list_name [ in | out ]
end
Notes:
The ACL to be applied must be in the destination context of the APN (which can be different from the context
where the APN is configured).
If neither the
in
nor the
out
keyword is specified, the ACL will be applied to all inbound and outbound packets.
Up to eight ACLs can be applied to a group provided that the number of rules configured within the ACL(s) does
not exceed the 128-rule limit for the interface.
Verifying the ACL Configuration to APNs
To verify the ACL configuration:
Step 1
Verify that your ACL lists were applied properly by entering the following command in Exec Mode:
show configuration context context_name
context_name is the name of the context containing the APN apn1 having default subscriber to which the ACL(s)
was/were applied.
was/were applied.
The output of this command displays the configuration of the entire context. Examine the output for the commands
pertaining to interface configuration. The commands display the ACL(s) applied using this procedure.
pertaining to interface configuration. The commands display the ACL(s) applied using this procedure.
configure
context context_name
ip access-list acl_name
deny host ip_address
deny ip any host ip_address
exit
ip access-group access_group_name
interface interface
ip address ip_address/mask
context context_name
ip access-list acl_name
deny host ip_address
deny ip any host ip_address
exit
ip access-group access_group_name
interface interface
ip address ip_address/mask