User's Manual

422
Users Manual of CS-6306R
After the access list is originally created, any part that is added later can be put at the end of the list. That is to
say, you cannot add the command line to the designated access list. However, you can run no permit and no
deny to delete items from the access list.
When you create the access list, the end of the access list includes the implicit deny
sentence by default. If the mask is omitted in the relative IP host address access
list, 255.255.255.255 is supposed to be the mask.
After the access list is created, the access list must be applied on the route or
interface. For details, refer to section 4.2.3 “Applying the Access List to the
Interface”.
43.4.2.3 Applying the Access List to the Interface
After the access list is created, you can apply it to one or multiple interfaces including the in interfaces and
out interfaces.
Run the following command in interface configuration mode.
Run… To…
ip access-groupname {in | out}
Apply the access list to the interface.
The access list can be used on the in interfaces and the out interfaces. For the standard access list of the in
interface, the soured address of the packet is to be checked according to the access list after the packet is
received. For the extensible access list, the routing switch also checks the destination. If the access list
permits the address, the software goes on processing the packet. If the access list does not permit the
address, the software drops the packet and returns an ICMP unreachable message.
For the standard access list of the out interfaces, after a packet is received or routed to the control interface,
the software checks the source address of the packet according to the access list. For the extensible access
list, the routing switch also checks the access list of the receiving side. If the access list permits the address,
the software will send the packet. If the access list does not permit the address, the software drops the packet
and returns an ICMP unreachable message.
If the designated access list does not exist, all packets allows to pass.