Specifications

26-5
Catalyst 2970 Switch Software Configuration Guide
78-15462-03
Chapter 26 Configuring Network Security with ACLs
Configuring IP ACLs
first ACE, even though they do not contain the SMTP port information, because the first ACE only
checks Layer 3 information when applied to fragments. The information in this example is that the
packet is TCP and that the destination is 10.1.1.1.
• Packet B is from host 10.2.2.2, port 65001, going to host 10.1.1.2 on the Telnet port. If this packet
is fragmented, the first fragment matches the second ACE (a deny) because all Layer 3 and Layer 4
information is present. The remaining fragments in the packet do not match the second ACE because
they are missing Layer 4 information. Instead, they match the third ACE (a permit).
Because the first fragment was denied, host 10.1.1.2 cannot reassemble a complete packet, so packet
B is effectively denied. However, the later fragments that are permitted will consume bandwidth on
the network and resources of host 10.1.1.2 as it tries to reassemble the packet.
• Fragmented packet C is from host 10.2.2.2, port 65001, going to host 10.1.1.3, port ftp. If this packet
is fragmented, the first fragment matches the fourth ACE (a deny). All other fragments also match
the fourth ACE because that ACE does not check any Layer 4 information and because Layer 3
information in all fragments shows that they are being sent to host 10.1.1.3, and the earlier permit
ACEs were checking different hosts.
Configuring IP ACLs
Configuring IP ACLs on the switch is the same as configuring IP ACLs on other Cisco switches and
routers. The process is briefly described here. For more detailed information on configuring ACLs, refer
to the “Configuring IP Services” chapter in the Cisco IP and IP Routing Configuration Guide for IOS
Release 12.1. For detailed information about the commands, refer to Cisco IOS IP and IP Routing
Command Reference for IOS Release 12.1.
The switch does not support these Cisco IOS router ACL-related features:
• Non-IP protocol ACLs (see Table 26-1 on page 26-6) or bridge-group ACLs
• IP accounting
• Inbound and outbound rate limiting (except with QoS ACLs)
• Reflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch
clustering feature)
• ACL logging
These are the steps to use IP ACLs on the switch:
Step 1 Create an ACL by specifying an access list number or name and access conditions.
Step 2 Apply the ACL to interfaces or terminal lines. You can also apply standard and extended IP ACLs to
VLAN maps.
This section includes the following information:
• Creating Standard and Extended IP ACLs, page 26-6
• Applying an IP ACL to a Terminal Line, page 26-16
• Applying an IP ACL to an Interface, page 26-16
• Hardware and Software Treatment of IP ACLs, page 26-17
• IP ACL Configuration Examples, page 26-17