Content

| 2.2 |  | VLAN Security |
| 2.2.4 |  | Configuring router ACLs |

Router ACLs are configured on Layer 3 SVIs with the same commands used to configure ACLs on Cisco routers. The process is briefly described here. For more detailed information on configuring router ACLs, refer to the “Configuring IP Services” chapter in the Cisco IP and IP Routing Configuration Guide for IOS Release 12.1. For detailed information about the commands, refer to Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1.

Not all IOS router ACL-related features are supported on the switch. The switch does not support:

- Non-IP protocol ACLs
- Bridge-group ACLs
- IP Accounting
- Rate limiting (except with QoS ACLs)
- IP packets with a header length of less than five
- Reflexive ACLs
- Dynamic ACLs (except for certain specialized dynamic ACLs used by the clustering feature on the switch)

Standard and extended IP router ACLs are created on the switch just as they are on a router. Standard IP ACLs use source address for matching operations and extended IP ACLs use source and destination addresses for matching operations and optional protocol type information for finer control.

In addition to numbered standard and extended ACLs, standard and extended named and time-range ACLs are available.

The basic two steps involved in using ACLs are:

- Create an ACL by specifying an access list number or name and access conditions.
- Apply the ACL to an interface, terminal line, or VLAN map.
- Existing ACLs can be displayed by using show commands.

The show access-lists command will display information about all IP and MAC address access lists or about a specific access list.

> Switch#show access-lists number|name

The show ip access-lists will display information about all IP access lists or about a specific IP access list.

> Switch#show ip access-lists number|name

The show ip interface command can be used to view the input and output access groups on the interface, as well as other interface characteristics. If IP is not enabled on the interface, the access groups are not shown.

A Catalyst 3550 switch has a routed port, interface GigabitEthernet 0/2, connected to Server A. Server A has benefits information and other documentation on it that all employees can access. The Catalyst also has routed port 0/3 connected to Server B, which contains confidential payroll data. All users can access Server A, but Server B has restricted access.

Use router access lists to do this in one of two ways:

- Create a standard access list, and filter traffic coming to the server from port 0/3.
- Create an extended access list, and filter traffic coming from the server into port 0/3.

This example uses a standard access list to filter traffic coming into Server B from port 0/3, permitting traffic only from hosts in the Accounting department, which have source addresses 172.20.128.64 to 172.20.128.95.

> Switch(config)#access-list 6 permit 172.20.128.64 0.0.0.31
> Switch(config)#end
> Switch#show access-list
> Standard IP access list 6 permit 172.20.128.64, wildcard bits 0.0.0.31
> Switch#configure terminal
> Switch(config)#interface gigabitethernet0/3
> Switch(config-if)#ip access-group 6 out

The access list is applied to traffic coming out of routed port 0/3. Only traffic from the specified source address will be permitted.

The following example uses an extended access list to filter traffic coming from Server B into port 0/3, permitting traffic from any source address (in this case Server B) to only the Accounting destination addresses 172.20.128.64 to 172.20.128.95.

> Switch(config)#access-list 106 permit ip any 172.20.128.64 0.0.0.31
> Switch(config)#end
> Switch#show access-list
> Extended IP access list 106 permit ip any 172.20.128.64 0.0.0.31
> Switch#configure terminal
> Switch(config)#interface gigabitethernet0/3
> Switch(config-if)#ip access-group 106 in

The access list is then applied to traffic going into routed port 0/3, permitting it to go only to the specified destination addresses. Remember that with extended access lists, a protocol must be entered before the source and destination information.

Refer to the Catalyst 3550 Multilayer Switch Software Configuration Guide and the Catalyst 2950 Desktop Switch Software Configuration Guide for additional information about configuring ACLs and examples.