Configuration Guide User guide

FastIron Configuration Guide 1711
53-1002494-02
Standard named ACL configuration
Configuration example for standard numbered ACLs
To configure a standard ACL and apply it to incoming traffic on port 1/1, enter the following
commands.
Brocade(config)#access-list 1 deny host 209.157.22.26 log
Brocade(config)#access-list 1 deny 209.157.29.12 log
Brocade(config)#access-list 1 deny host IPHost1 log
Brocade(config)#access-list 1 permit any
Brocade(config)#int eth 1/1
Brocade(config-if-1/1)#ip access-group 1 in
Brocade(config)#write memory
The commands in this example configure an ACL to deny packets from three source IP addresses
from being received on port 1/1. The last ACL entry in this ACL permits all packets that are not
explicitly denied by the first three ACL entries.
Standard named ACL configuration
This section describes how to configure standard named ACLs with alphanumeric IDs. This section
also provides configuration examples.
Standard ACLs permit or deny packets based on source IP address. You can configure up to 99
standard named ACLs. There is no limit to the number of ACL entries an ACL can contain except
for the system-wide limitation. For the number of ACL entries supported on a device, refer to “ACL
IDs and entries” on page 1706.
The commands for configuring named ACL entries are different from the commands for configuring
numbered ACL entries. The command to configure a numbered ACL is access-list. The command
for configuring a named ACL is ip access-list. In addition, when you configure a numbered ACL
entry, you specify all the command parameters on the same command. When you configure a
named ACL, you specify the ACL type (standard or extended) and the ACL name with one command,
which places you in the configuration level for that ACL. Once you enter the configuration level for
the ACL, the command syntax is the same as the syntax for numbered ACLs.
Standard named ACL syntax
Syntax: [no] ip access-list standard <ACL-name> | <ACL-num>
Syntax: deny | permit <source-ip> | <hostname> <wildcard> [log]
or
Syntax: deny | permit <source-ip>/<mask-bits> | <hostname> [log]
Syntax: deny | permit host <source-ip> | <hostname> [log]
Syntax: deny | permit any [log]
Syntax: [no] ip access-group <ACL-name> in | out
The <ACL-name> parameter is the access list name. You can specify a string of up to 256
alphanumeric characters. You can use blanks in the ACL name if you enclose the name in
quotation marks (for example, “ACL for Net1”).