Specifications

3-617
Cisco Wide Area Application Services Command Reference
OL-16451-01
Chapter 3 CLI Commands
Note ACLs that are defined on a router take precedence over the ACLs that are defined on the WAE. ACLs
that are defined on a WAE take precedence over the WAAS application definition policies that are
defined on the WAE.
After creating an access list, you can include the access list in an access group using the access-group
command, which determines how the access list is applied. You can also apply the access list to a specific
application using the appropriate command. A reference to an access list that does not exist is the
equivalent of a permit any condition statement.
To create an extended access list, enter the ip access-list extended global configuration command.
Identify the new or existing access list with a name up to 30 characters long beginning with a letter, or
with a number. If you use a number to identify an extended access list, it must be from 100 to 199
Note You must use a standard access list for providing access to the SNMP server or to the TFTP
gateway/server. However, you can use either a standard access list or an extended access list for
providing access to the WCCP application.
To allow connections from a specific host, use the permit host source-ip option and replace source-ip
with the IP address of the specific host.
To allow connections from a specific network, use the permit host source-ip wildcard option. Replace
source-ip with a network ID or the IP address of any host on the network that you want to specify.
Replace wildcard with the dotted decimal notation for a mask that is the reverse of a subnet mask, where
a 0 indicates a position that must be matched and a 1 indicates a position that does not matter. For
instance, the wildcard 0.0.0.255 causes the last eight bits in the source IP address to be ignored.
Therefore, the permit 192.168.1.0 0.0.0.255 entry allows access from any host on the 192.168.1.0
network.
After you identify the extended access list, the CLI enters the extended ACL configuration mode and all
subsequent commands apply to the specified access list.
WAE(config)# ip access-list extended testextacl
WAE(config-ext-nacl)#
Examples The following example shows how to create an access list on the WAAS device. You create this access
list to allow the WAAS device to accept all web traffic that is redirected to it but limit host administrative
access using SSH:
WAE(config)# ip access-list extended testextacl
WAE(config-ext-nacl)# permit tcp any any eq www
WAE(config-ext-nacl)# permit tcp host 10.1.1.5 any eq ssh
WAE(config-ext-nacl)# exit
The following example shows how to activate the access list for an interface:
WAE(config)# interface gigabitethernet 1/0
WAE(config-if)# ip access-group testextacl in
WAE(config-if)# exit
The following example shows how this configuration appears when you enter the show
running-configuration command:
...
!