Users Guide

Access Control Lists 767
console(config-ip-acl)#permit tcp any any eq 22 flag established
rate-limit 1024 128
console(config-ip-acl)#permit tcp any any eq telnet rate-limit 12 2
console(config-ip-acl)#permit tcp any any eq 22 rate-limit 12 2
console(config-ip-acl)#2147483647 permit every
console(config-ip-acl)#exit
console(config)#ip access-group rate-limit-inband-mgmt control-
plane
The following commands block fragmented traffic from being sent to the
CPU:
console#config
console(config)#ip access-list no-frag-inband-mgmt
console(config-ip-acl)#deny tcp any any fragments
console(config-ip-acl)#deny udp any any fragments
console(config-ip-acl)#deny ip any any fragments
console(config-ip-acl)#2147483647 permit every
console(config-ip-acl)#exit
console(config)#ip access-group no-frag-inband-mgmt control-plane
Stop Bonjour (mDNS) Traffic
This example drops all traffic destined to 224.0.0.251 on ingress. Packets
destined to the reserved multicast address 224.0.0.x are normally forwarded in
hardware. This ACL is prioritized over the system rules as it is applied on
ingress. This has the effect of stopping all Bonjour (mDNS) traffic from
crossing the switch. If it is desired to allow Bonjour traffic in the network, a
rate limiter might be more appropriate.
console#config
console(config)#ip access-list deny-mdns
console(config-ip-acl)#deny ip any host 224.0.0.251
console(config-ip-acl)#exit
console(config)#ip access-group deny-mdns control-plane