ACL Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-14
What Is the Difference Between Network (or Subnet)
Rules for Defining a Match Between a Packet and an
A Configured ACL Has No Effect Until You Apply It
You Can Assign an ACL Name or Number to an Interface
Static Port ACL and Dynamic Port ACL Applications . . . . . . . . . 9-15
Dynamic (RADIUS-assigned) Port ACL Applications . . . . . . . . . 9-15
Multiple ACLs on an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-16
Features Common to All ACL Applications . . . . . . . . . . . . . . . . . . . . . 9-16
General Steps for Planning and Configuring ACLs . . . . . . . . . . . . . . . 9-18
IPv4 Static ACL Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20
The Packet-filtering Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20
Planning an ACL Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-24
IPv4 Traffic Management and Improved Network Performance . . . 9-24
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-25
Guidelines for Planning the Structure of a Static ACL . . . . . . . . . . . . 9-26
IPv4 ACL Configuration and Operating Rules . . . . . . . . . . . . . . . . . . . 9-27
How an ACE Uses a Mask To Screen Packets for Matches . . . . . . . . 9-28
Masks and the Masks Used with ACLs? . . . . . . . . . . . . . . . . . . . . 9-28
Access Control Entry (ACE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-29
Configuring and Assigning an IPv4 ACL . . . . . . . . . . . . . . . . . . . . . . . 9-34
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-34
General Steps for Implementing ACLs . . . . . . . . . . . . . . . . . . . . . 9-34
Options for Permit/Deny Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-35
ACL Configuration Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-35
Standard ACL Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-36
Extended ACL Configuration Structure . . . . . . . . . . . . . . . . . . . . 9-37
ACL Configuration Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39
The Sequence of Entries in an ACL Is Significant . . . . . . . . . . . . 9-39
Allowing for the Implied Deny Function . . . . . . . . . . . . . . . . . . . . 9-41
to an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-41
Even if the ACL Does Not Exist in the Switch’s Configuration . 9-41
Using the CLI To Create an ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-42
General ACE Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-42
Using CIDR Notation To Enter the IPv4 ACL Mask . . . . . . . . . . 9-43
xi
