Cisco PIX 525 Especificaciones descargar pdf (Pagina 212)

13-10

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Adding an Extended Access List

• Add an ACE for a specific protocol by entering the following command:

hostname(config)# access-list

access_list_name

[line

line_number

][extended]

{deny |

permit}

protocol

source_address mask

dest_address mask

This type of ACE lets you specify any protocol for the source and destination addresses, but not

ports. Typically, you identify ip keyword for the protocol, but other protocols are accepted.

Enter host keyword before the IP address to specify a single address. In this case, do not enter a

mask. Enter any keyword instead of the address and mask to specify any address.

For a list of protocol names, see the “Protocols and Applications” section on page D-11.

For information about logging options that you can add to the end of the ACE, see the “Logging

Access List Activity” section on page 13-20.

For information about time range options, see the “Time Range Options” section on page 13-20.

See the following examples:

The following access list allows all hosts (on the interface to which you apply the access list) to go

through the security appliance:

hostname(config)# access-list ACL_IN extended permit ip any any

The following sample access list prevents hosts on 192.168.1.0/24 from accessing the

209.165.201.0/27 network. All other addresses are permitted.

hostname(config)# access-list ACL_IN extended deny tcp 192.168.1.0 255.255.255.0

209.165.201.0 255.255.255.224

hostname(config)# access-list ACL_IN extended permit ip any any

If you want to restrict access to only some hosts, then enter a limited permit ACE. By default, all

other traffic is denied unless explicitly permitted.

hostname(config)# access-list ACL_IN extended permit ip 192.168.1.0 255.255.255.0

209.165.201.0 255.255.255.224

• Add an ACE for TCP or UDP ports by entering the following command:

hostname(config)# access-list

access_list_name

[extended]

{deny | permit}

{tcp | udp}

source_address mask

[

operator port

]

dest_address mask

[

operator port

]

Enter host keyword before the IP address to specify a single address. In this case, do not enter a

mask. Enter any keyword instead of the address and mask to specify any address.

Use an operator to match port numbers used by the source or destination. The permitted operators

are as follows:

–

lt—less than

–

gt—greater than

–

eq—equal to

–

neq—not equal to

–

range—an inclusive range of values. When you use this operator, specify two port numbers, for

example:

range 100 200

For a list of permitted keywords and well-known port assignments, see the “TCP and UDP Ports”

section on page D-12. DNS, Discard, Echo, Ident, NTP, RPC, SUNRPC, and Talk each require one

definition for TCP and one for UDP. TACACS+ requires one definition for port 49 on TCP.

1 2 ... 207 208 209 210 211 212 213 214 215 216 217 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 212

Comentarios a estos manuales