Users Guide

OS10(config)# ip access-list acl1
OS10(conf-ipv4-acl)# permit ip host 10.1.1.1 host 100.1.1.1 count
Egress ACL lters
Egress ACL lters aect the trac leaving the network. Conguring egress ACL lters onto physical interfaces protects the system
infrastructure from a malicious and intentional attack by explicitly allowing only authorized trac. These system-wide ACL lters eliminate
the need to apply ACL lters onto each interface.
You can use an egress ACL lter to restrict egress trac. For example, when you isolate denial of service (DoS) attack trac to a specic
interface, and apply an egress ACL lter to block the DoS ow from exiting the network, you protect downstream devices.
1 Apply an egress access-list on the interface in INTERFACE mode.
ip access-group access-group-name out
2 Return to CONFIGURATION mode.
exit
3 Create the access-list in CONFIGURATION mode.
ip access-list access-list-name
4 Create the rules for the access-list in ACCESS-LIST mode.
seq 10 deny ip any any count fragment
Apply rules to ACL lter
OS10(config)# interface ethernet 1/1/29
OS10(conf-if-eth1/1/29)# ip access-group egress out
OS10(conf-if-eth1/1/29)# exit
OS10(config)# ip access-list egress
OS10(conf-ipv4-acl)# seq 10 deny ip any any count fragment
View IP ACL lter conguration
OS10# show ip access-lists out
Egress IP access-list abcd
Active on interfaces :
ethernet1/1/29
seq 10 deny ip any any fragment count (100 packets)
VTY ACLs
To limit Telnet and SSH connections to the switch, apply access lists on a virtual terminal line (VTY). See Virtual terminal line ACLs for more
information.
SNMP ACLs
To ler SNMP requests on the switch, assign access lists to an SNMP community. Both IPv4 and IPv6 access lists are supported to restrict
IP source addresses. See Restrict SNMP access for more information.
Clear access-list counters
Clear IPv4, IPv6, or MAC access-list counters for a specic access-list or all lists. The counter counts the number of packets that match
each permit or deny statement in an access-list. To get a more recent count of packets matching an access-list, clear the counters to start
at zero. If you do not congure an access-list name, all IP access-list counters clear.
To view access-list information, use the show access-lists command.
• Clear IPv4 access-list counters in EXEC mode.
clear ip access-list counters access-list-name
1042
Access Control Lists