Справочник Пользователя для Asante Technologies 35516

 

54 

5.6 Using Access Lists 

 
An access list is a collection of criteria statements that the switch uses to determine whether to allow or 
block traffic based on IP addresses. Access lists can be configured to provide basic security on your 
network, and to prevent unnecessary traffic between network segments. 
 
When configuring an access list, you can add multiple statements by adding criteria to the same numbered 
list. The order of the statements is important, as the switch tests addresses against the criteria in an access 
list one by one (in the order the statements are entered) until it finds a match. The first match determines 
whether the software accepts or rejects the address. Because the software stops testing conditions after the 
first match, the order of the conditions is critical. 
 
Important! You may not delete an individual statement from an access list; you must delete the entire 
access list and re-enter it with new statements. 
 
Important! By default, if no conditions match, the software rejects the address. 
 
The switch supports two types of access lists: 
 

•  Standard: access list numbers 1 – 99 and 1300–1999 (expanded range) 

•  Extended: access list numbers 100–199 and 200–2699 (expanded range) 

 

 
Standard access lists filter at layer 3, and can allow or block access to networks and host addresses. The 
parameters for a standard access list are described as follows: 
 

•  Access list number (1–99): Identifies the access list to which an entry belongs. There is no limit, 

to how many entries make up an access list, other than available memory 

•  Remark: Access list entry comment. This may be useful to keep track of numbered lists 

•  Permit/deny: Indicates whether this entry allows or blocks traffic from the specified source address 

•  Source address: Enter the source IP address to match 

•  Any: Specifies any source address to match 

•  Source wildcard mask: Identifies which bits in the address field are to be matched. A ‘0’ indicates 

that positions must match; a ‘1’ indicates that position is ignored 

 
In the following example, a standard access list will be created to allow all traffic from the 192.168.0.0 
networks, while blocking all non-192.168.0.0 traffic. The last entry is redundant, since the switch will deny 
access if there is no match found by the end of the list.  
 
Router# configure terminal 
Router(config)# access-list 1 ? 
  deny    Specify packets to reject 
  permit  Specify packets to forward 
  remark  Access list entry comment 
Router(config)# access-list 1 permit ? 
  A.B.C.D  Source address to match. e.g. 10.0.0.0 
  any      Any source address to match 
Router(config)# access-list 1 permit 192.168.0.0 ? 
  A.B.C.D  Source wildcard. e.g. 0.0.0.255 
  <cr> 
Router(config)# access-list 1 permit 192.168.0.0 0.0.255.255 
Router(config)# access-list 1 deny any {0.0.0.0 255.255.255.255} 
 
In the next example, a standard access list will be created to deny all traffic from 192.168.123.254 and allow 
all other traffic to be forwarded. Note that the last entry of this example is not redundant, as it is a permit 
statement. An implicit deny statement would follow the last entry, if no match was found before the end of 
the list. In this case, however, we are permitting any other IP address other than 192.168.123.254, and a 
deny statement isn’t necessary.