Cisco 7100 Series Spezifikationen PDF herunterladen (Seite 66)

Step 4—Configuring Cisco IOS Firewall Features

Cisco 7100 Series VPN Configuration Guide

3-36

Applying Access Lists to Interfaces

After you create an access list, you can apply it to one or more interfaces. Access lists can

be applied on either outbound or inbound interfaces.

To apply anaccess list inbound and outbound on an interface, complete the following steps

starting in global conﬁguration mode:

For inbound access lists, after receiving a packet, the Cisco IOS software checks the source

address of the packet against the access list. If the access list permits the address, the

software continues to process the packet. If the access list rejects the address, the software

discards the packet and returns an “ICMP Host Unreachable” message.

For outbound access lists, after receiving and routing a packet to a controlled interface, the

software checks the destination address of the packet against the access list. If the access

list permits the address, the software transmits the packet. If the access list rejects the

address, the software discards the packet and returns an “ICMP Host Unreachable”

message.

When you apply an access list that has not yet been deﬁned to an interface, the software

acts as if the access list has not been applied to the interface and will accept all packets. Be

aware of this behavior if you use undeﬁned access lists as a means of security in your

network.

Step Command Purpose

hq-sanjose(config)# interface serial 1/0

Specify serial interface 1/0 on the

headquarters router and enter interface

conﬁguration mode.

hq-sanjose(config-if)# ip access-group 102 in

Conﬁgure access list 102 inbound on

serial interface 1/0 on the headquarters

router.

hq-sanjose(config-if)# ip access-group 102 out

Conﬁgure access list 102 outbound on

serial interface 1/0 on the headquarters

router.

hq-sanjose(config-if)# exit

hq-sanjose(config)#

Exit back to global conﬁguration mode.

1 2 ... 61 62 63 64 65 66 67 68 69 70 71 ... 111 112

Keine Kommentare

Cisco 7100 Series Spezifikationen Seite 66