Configuration Guide User guide

FastIron Configuration Guide 1719
53-1002494-02
Extended numbered ACL configuration
The first entry permits ICMP traffic from hosts in the 209.157.22.x network to hosts in the
209.157.21.x network.
The second entry denies IGMP traffic from the host device named “rkwong” to the 209.157.21.x
network.
The third entry denies IGMP traffic from the 209.157.21.x network to the host device named
“rkwong”.
The fourth entry denies all IP traffic from host 209.157.21.100to host 209.157.22.1 and generates
Syslog entries for packets that are denied by this entry.
The fifth entry denies all OSPF traffic and generates Syslog entries for denied traffic.
The sixth entry permits all packets that are not explicitly denied by the other entries. Without this
entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the
ACL.
The following commands apply ACL 102 to the incoming traffic on port 1/2 and to the incoming
traffic on port 4/3.
Here is another example of an extended ACL.
The first entry in this ACL denies TCP traffic from the 209.157.21.x network to the 209.157.22.x
network.
The second entry denies all FTP traffic from the 209.157.21.x network to the 209.157.22.x
network.
The third entry denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network, if
the TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), and
if the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater
than 23 are allowed.
Brocade(config)#access-list 102 perm icmp 209.157.22.0/24 209.157.21.0/24
Brocade(config)#access-list 102 deny igmp host rkwong 209.157.21.0/24 log
Brocade(config)#access-list 102 deny igrp 209.157.21.0/24 host rkwong log
Brocade(config)#access-list 102 deny ip host 209.157.21.100 host 209.157.22.1 log
Brocade(config)#access-list 102 deny ospf any any log
Brocade(config)#access-list 102 permit ip any any
Brocade(config)#int eth 1/2
Brocade(config-if-1/2)#ip access-group 102 in
Brocade(config-if-1/2)#exit
Brocade(config)#int eth 4/3
Brocade(config-if-4/3)#ip access-group 102 in
Brocade(config)#write memory
Brocade(config)#access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24
Brocade(config)#access-list 103 deny tcp 209.157.21.0/24 eq ftp 209.157.22.0/24
Brocade(config)#access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 lt
telnet neq 5
Brocade(config)#access-list 103 deny udp any range 5 6 209.157.22.0/24 range 7 8
Brocade(config)#access-list 103 permit ip any any