Cisco Explorer 4700 Installationsanleitung PDF herunterladen (Seite 108)

4-58

Device Manager Guide, Cisco ACE 4700 Series Application Control Engine Appliance

OL-26645-02

Chapter 4 Configuring Virtual Contexts

Configuring Security with ACLs

automatically updates the status information displayed. The polling continues until the ACE Device

Manager receives a status of either Success or Failed. If the restored status is Failed, then the Show

Restored Errors popup window appears, displaying the reason for the failed restore attempt.

Related Topics

• Performing Device Backup and Restore Functions, page 4-49

Configuring Security with ACLs

An ACL (access control list) consists of a series of statements called ACL entries that collectively define

the network traffic profile. Each entry permits or denies network traffic (inbound and outbound) to the

parts of your network specified in the entry. Besides an action element (“permit” or “deny”), each entry

also contains a filter element based on criteria such as source address, destination address, protocol, or

protocol-specific parameters. An implicit “deny all” entry exists at the end of every ACL, so you must

configure an ACL on every interface where you want to permit connections. Otherwise, the ACE denies

all traffic on the interface.

ACLs provide basic security for your network by allowing you to control network connection setups

rather than processing each packet. Such ACLs are commonly referred to as security ACLs.

You can configure ACLs as parts of other features; for example, security, network address translation

(NAT), or server load balancing (SLB). The ACE merges these individual ACLs into one large ACL

called a merged ACL. The ACL compiler then parses the merged ACL and generates the ACL lookup

mechanisms. A match on this merged ACL can result in multiple actions. You can add, modify, or delete

entries to an ACL already in the summary table, or add a new ACL to the list.

When you use ACLs, you may want to permit all e-mail traffic on a circuit, but block FTP traffic. You

can also use ACLs to allow one client to access a part of the network and prevent another client from

accessing that same area.

When configuring ACLs, you must apply an ACL to an interface to control traffic on that interface.

Applying an ACL on an interface assigns the ACL and its entries to that interface.

You can apply only one extended ACL to each direction (inbound or outbound) of an interface. You can

also apply the same ACL on multiple interfaces.You can apply EtherType ACLs in only the inbound

direction and on only Layer 2 interfaces.

Note By default, all traffic is denied by the ACE unless explicitly allowed. Only traffic that is explicitly

allowed in an ACL can pass. All other traffic is denied.

This section contains the following topics:

• Creating ACLs, page 4-59

• Setting EtherType ACL Attributes, page 4-67

• Setting Extended ACL Attributes, page 4-61

• Resequencing Extended ACLs, page 4-66

• Viewing All ACLs by Context, page 4-68

• Editing or Deleting ACLs, page 4-69

1 2 ... 103 104 105 106 107 108 109 110 111 112 113 ... 647 648

Keine Kommentare

Cisco Explorer 4700 Installationsanleitung Seite 108