Cisco Catalyst 250 Series User Manual

In this example, the workstation that belongs to Jones is allowed access, and the workstation that belongs to
Smith is not allowed access:
Switch(config)# access-list 1 remark Permit only Jones workstation through
Switch(config)# access-list 1 permit 171.69.2.88
Switch(config)# access-list 1 remark Do not allow Smith through
Switch(config)# access-list 1 deny 171.69.3.13
For an entry in a named IP ACL, use the remark access-list configuration command. To remove the remark,
use the no form of this command.
In this example, the Jones subnet is not allowed to use outbound Telnet:
Switch(config)# ip access-list extended telnetting
Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out
Switch(config-ext-nacl)# deny tcp host 171.69.2.88 any eq telnet
Examples: Troubleshooting ACLs
If this ACL manager message appears and [chars] is the access-list name,
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The switch has insufficient resources to create a hardware representation of the ACL. The resources include
hardware memory and label space but not CPU memory. A lack of available logical operation units or
specialized hardware resources causes this problem. Logical operation units are needed for a TCP flag match
or a test other than eq (ne, gt, lt, or range) on TCP, UDP, or SCTP port numbers.
Use one of these workarounds:
•
Modify the ACL configuration to use fewer resources.
•
Rename the ACL with a name or number that alphanumerically precedes the ACL names or numbers.
To determine the specialized hardware resources, enter the show platform layer4 acl map privileged EXEC
command. If the switch does not have available resources, the output shows that index 0 to index 15 are not
available.
For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug Toolkit.
For example, if you apply this ACL to an interface:
permit tcp source source-wildcard destination destination-wildcard range 5 60
permit tcp source source-wildcard destination destination-wildcard range 15 160
permit tcp source source-wildcard destination destination-wildcard range 115 1660
permit tcp source source-wildcard destination destination-wildcard
And if this message appears:
ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
The flag-related operators are not available. To avoid this issue,
•
Move the fourth ACE before the first ACE by using ip access-list resequence global configuration
command:
permit tcp source source-wildcard destination destination-wildcard
permit tcp source source-wildcard destination destination-wildcard range 5 60
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 181
Configuring IPv4 ACLs
Examples: Troubleshooting ACLs

Cisco Catalyst 250 Series Specifications

General

Brand	Cisco
Model	Catalyst 250 Series
Category	Switch
Language	English