ACL应用

 

Standard ACLs

Standard ACLs are the oldest and one of the most basic types of ACLs. Standard ACLs inspect traffic by

comparing the source address of the IP packets to the addresses configured in the ACL. A standard ACL can be

defined to permit or deny specific source IP addresses only.

The command syntax format to define a numbered standard ACL is the following:

Code View:

access-list access-list-number {deny | permit} source [source-wildcard] [log]

The keyword log causes an informational logging message when the packet matches the access-list statement.

For all matched packets, a message is sent to the console, the buffer, or to a syslog server. The message

includes the ACL number, a notification of whether the packet was permitted or denied, the source address, and

the number of packets.

Note

Fields represented by {} brackets are mandatory in the command syntax. Fields represented by []

brackets are optional.

In all Cisco IOS Software releases, the standard access-list-number can be anything from 1 to 99 or the

expanded range 1300 to 1999, as shown in Table 2-6 . Example 2-2 shows a standard numbered ACL allowing

access to hosts on the two specified networks. The wildcard bits apply to the host portions of the network

addresses. Traffic from any host with a source address that does not match the ACL criteria will be dropped

because of the implicit deny.

Example 2-2. Standard Numbered ACL Example

Router(config)# access-list 1 permit 192.16.1.0 0.0.0.255

Router(config)# access-list 1 permit 139.65.0.0 0.0.255.255

(Note: implicit deny)

Tip

A source/source-wildcard setting of 0.0.0.0/255.255.255.255 can be specified as any. The wildcard can

be omitted if it is all zeros. Therefore, 10.1.1.1 0.0.0.0 is the same as host 10.1.1.1.

After the ACL is defined, it must be applied to the interface (inbound or outbound direction).

Router(config)# interface <interface-name>

Router(config-if)# ip access-group {access-list-number|name} {in|out}

The following is another example showing the use of a standard ACL to block all traffic except that from source

10.1.1.0/24. Note that the example has one permit statement followed by an implicit deny, which will block all

other traffic.

Step 1. Define a standard ACL.

Router(config)# access-list 1 permit 10.1.1.0 0.0.0.255

Step 2. Apply the ACL to an interface.

Router(config)# interface Serial0

Router(config-if)# ip access-group 1 in

 

Extended ACLs

Extended ACLs are used to filter more-specific traffic based on the source address, the destination address, and

specific protocols, ports, and flags. A sample command syntax format for various types of extended ACLs for

each protocol is shown in the list that follows:

To define an extended IP ACL:

Code View:

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |

permit} protocol source source-wildcard destination destination-wildcard

[precedence precedence] [tos tos] [log | log-input] [time-range time-range-name]

[fragments]

To define an extended TCP ACL:

Code View:

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |

permit} tcp source source-wildcard [operator [port]] destination destinationwildcard

[operator [port]] [established] [precedence precedence] [tos tos] [log

| log-input] [time-range time-range-name] [fragments]

To define an extended User Datagram Protocol (UDP) ACL:

Code View:

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |

permit} udp source source-wildcard [operator [port]] destination destinationwildcard

[operator [port]] [precedence precedence] [tos tos] [log | log-input]

[time-range time-range-name] [fragments]

To define an extended Internet Control Message Protocol (ICMP) ACL:

Code View:

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |

permit} icmp source source-wildcard destination destination-wildcard [icmp-type

[icmp-code] | icmp-message] [precedence precedence] [tos tos] [log | log-input]

[time-range time-range-name] [fragments]

To define an extended Internet Group Management Protocol (IGMP) ACL:

Code View:

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |

permit} igmp source source-wildcard destination destination-wildcard [igmptype]

[precedence precedence] [tos tos] [log | log-input] [time-range timerange-

name] [fragments]

In all Cisco IOS Software releases, the access-list-number for extended access lists can be 101 to 199 or the

expanded numbers 2000 to 2699, as shown in Table 2-6 .

The following example permits Simple Mail Transfer Protocol (SMTP) (e-mail) traffic to host 172.16.1.1, Domain

Name System (DNS) traffic, and ICMP echo and echo reply packets sourced from all hosts:

Step 1. Define an extended ACL.

Router(config)# access-list 101 permit tcp any host 172.16.1.1 eq smtp

Router(config)# access-list 101 permit tcp any any eq domain

Router(config)# access-list 101 permit udp any any eq domain

Router(config)# access-list 101 permit icmp any any echo

Router(config)# access-list 101 permit icmp any any echo-reply

Step 2. Apply the ACL to an interface.

Router(config)# interface Serial0

Router(config-if)# ip access-group 101 in

 

 

 

 

IP Named ACLs

Cisco IOS Software also added the capability to use a name in the ACL. This allows standard and extended ACLs

to be given names instead of numbers. All other parameters remain the same. This is an additional feature

added to the normal ACL convention. The command syntax format you use to define a named ACL is the

following:

Router(config)# ip access-list {standard | extended} access-list-name

(Followed by permit/deny criteria statements)

Example 2-3 shows the configuration of a standard named ACL called myacl that allows all traffic sourced from

network 192.16.1.0/24 and host 172.65.1.1.

Example 2-3. Standard Named ACL Example

ip access-list standard myacl

permit 192.16.1.0 0.0.0.255

permit host 172.65.1.1

(Note: implicit deny)

Example 2-4 shows configuration of an extended named ACL called myacl that allows SMTP connections to host

172.16.1.1 and DNS packets and all ICMP packets.

Example 2-4. Extended Named ACL Example

ip access-list extended myacl

permit tcp any host 172.16.1.1 eq smtp

permit tcp any any eq domain

permit udp any any eq domain

permit icmp any any

(Note: implicit deny)