Cisco 7100 Series Especificaciones descargar pdf (Pagina 96)

Step 4—Configuring Cisco IOS Firewall Features

Cisco 7100 Series VPN Configuration Guide

4-24

Note Refer to the “Trafﬁc Filtering and Firewalls” part of the Security Conﬁguration

Guide and the Security Command Reference for advanced ﬁrewall conﬁguration

information.

This section explains how to conﬁgure an extended access list, which is a sequential

collection of permit and deny conditions that apply to an IP address, and includes the

following tasks:

1 Creating Extended Access Lists Using Access List Numbers

2 Verifying Extended Access Lists

3 Applying Access Lists to Interfaces

4 Verifying Extended Access Lists Are Applied Correctly

The above tasks give the PC client in the business partner ofﬁce access only to the public

Web server in the headquarters ofﬁce. First, an extended access list is created with the

appropriate deny and permit statements, then the access list is applied to the serial interface

that connects the headquarters and business partner routers.

Creating Extended Access Lists Using Access List Numbers

To create an extended access list that denies and permits certain types of trafﬁc, complete

the following steps starting in global conﬁguration mode:

Step Command Purpose

hq-sanjose(config)# access-list 112 deny tcp any any

Deﬁne access list 112 and

conﬁgure the access list to deny all

TCP trafﬁc.

hq-sanjose(config)# access-list 112 deny udp any any

Conﬁgure access list 112 to deny

all UDP trafﬁc.

hq-sanjose(config)# access-list 112 permit ip host

10.2.2.2 host 10.1.5.3

Conﬁgure access list 112 to permit

IP trafﬁc between the headquarters

Web server (translated inside

global IP address 10.2.2.2) and

PC B (IP address 10.1.5.3) in the

business partner ofﬁce.

1 2 ... 91 92 93 94 95 96 97 98 99 100 101 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 96