Content

| 9.6 |  | Securing User Access |
| 9.6.9 |  | Configuring and verifying access lists |

This section describes how to create switch IP ACLs. Recall that the switch tests packets against the conditions in an access list one by one. The first match determines whether the switch accepts or rejects the packet. Because the switch stops testing conditions after the first match, the order of the conditions is critical. If no conditions match, the switch denies the packet.

Follow these steps to use ACLs:

Step 1 | Create an ACL by specifying an access list number or name and access conditions.
Step 2 | Apply the ACL to interfaces or terminal lines.

The IOS supports these types of IP access lists:

- Standard IP access lists use source addresses for matching operations.
- Extended IP access lists use source and destination addresses for matching operations and optional protocol-type information for finer granularity of control.

MAC extended access list use source and destination MAC addresses and optional protocol type information for matching operations.

In addition to numbered standard and extended ACLs, named standard and extended IP ACLs can be created. The advantage of using named ACLs instead of numbered lists is that individual entries can be deleted from a named list.

ACLs can be applied to any management interface.

The limitations that apply to ACLs on physical interfaces do not apply to ACLs on management interfaces.

After creating an ACL, it can be applied to one or more interfaces or terminal lines. ACLs can be applied on inbound interfaces. This section describes how to accomplish this task for both terminal lines and network interfaces. Note these guidelines:

- When controlling access to a line, numbered IP ACLs or MAC extended ACLs must be used.
- When controlling access to an interface, named or numbered ACLs can be used.
- Set identical restrictions on all the virtual terminal lines because a user can attempt to connect to any of them.
- If applying ACLs to a management interface, the ACL only filters packets that are intended for the CPU, such as SNMP, Telnet, or web traffic.

Beginning in privileged EXEC mode, follow the steps in Figure to restrict incoming connections between a virtual terminal line and the addresses in an ACL

Beginning in privileged EXEC mode, follow the steps in Figure to control access to a Layer 2 interface.

Use the commands in Figure to display the ACLs that are configured on the switch, and to display the ACLs that have been applied to physical and management interfaces.