554
Configuring Network Security with ACLs
How to Configure Network Security with ACLs
MAC ACL to a Layer 2 Interface
After you create a MAC ACL, you can apply it to a Layer 2 interface to filter non-IP traffic coming in that interface. When
you apply the MAC ACL, consider these guidelines:
If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes precedence over
an input Layer 3 ACL applied to the VLAN interface. Incoming packets received on the Layer 2 port are always filtered
by the port ACL.
You can apply no more than one IP access list and one MAC access list to the same Layer 2 interface. The IP access
list filters only IP packets, and the MAC access list filters non-IP packets.
A Layer 2 interface can have only one MAC access list. If you apply a MAC access list to a Layer 2 interface that has
a MAC ACL configured, the new ACL replaces the previously configured one.
How to Configure Network Security with ACLs
Creating a Numbered Standard ACL
Note: When creating an ACL, remember that, by default, the end of the ACL contains an implicit deny statement for all
packets that it did not find a match for before reaching the end. With standard access lists, if you omit the mask from an
associated IP host address ACL specification, 0.0.0.0 is assumed to be the mask.
Command Purpose
1. configure terminal Enters global configuration mode.
2. access-list access-list-number {deny |
permit} source [source-wildcard] [log]
Defines a standard IPv4 access list by using a source address and
wildcard.
access-list-number—Specifies a decimal number from 1 to 99 or
1300 to 1999.
deny or permit—Specifies whether to deny or permit access if
conditions are matched.
source—Specifies the source address of the network or host from
which the packet is being sent specified as:
The 32-bit quantity in dotted-decimal format.
The keyword any as an abbreviation for source and
source-wildcard of 0.0.0.0 255.255.255.255. You do not
need to enter a source-wildcard.
The keyword host as an abbreviation for source and
source-wildcard of source 0.0.0.0.
(Optional) source-wildcard—Applies wildcard bits to the source.
(Optional) log—Causes an informational logging message about
the packet that matches the entry to be sent to the console.
3. end Returns to privileged EXEC mode.
To Next Page
Loading...
Need help?
General