Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 222)

100

101

13-20

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Adding Remarks to Access Lists

You can include remarks about entries in any access list, including extended, EtherType, and standard

access lists. The remarks make the access list easier to understand.

To add a remark after the last access-list command you entered, enter the following command:

hostname(config)# access-list

access_list_name

remark

text

If you enter the remark before any access-list command, then the remark is the first line in the access list.

If you delete an access list using the no access-list access_list_name command, then all the remarks are

also removed.

The text can be up to 100 characters in length. You can enter leading spaces at the beginning of the text.

Trailing spaces are ignored.

For example, you can add remarks before each ACE, and the remark appears in the access list in this

location. Entering a dash (-) at the beginning of the remark helps set it apart from ACEs.

hostname(config)# access-list OUT remark - this is the inside admin address

hostname(config)# access-list OUT extended permit ip host 209.168.200.3 any

hostname(config)# access-list OUT remark - this is the hr admin address

hostname(config)# access-list OUT extended permit ip host 209.168.200.4 any

Time Range Options

To implement a time-based access list, use the time-range command to define specific times of the day

and week. Then use the with the access-list extended command to bind the time range to an access list.

The following example binds an access list named “Sales” to a time range named “New_York_Minute.”

hostname(config)# access-list Sales line 1 extended deny tcp host 209.165.200.225 host

209.165.201.1 time-range New_York_Minute

hostname(config)#

Refer to the time-range command in the Cisco Security Appliance Command Reference for more

information about how to define a time range.

In place of the time range option, you can also choose to inactivate an ACE. Use the inactive keyword

to disable an Access Control Element.

Logging Access List Activity

This section describes how to configure access list logging for extended access lists and Webtype access

lists.

This section includes the following topics:

• Access List Logging Overview, page 13-21

• Configuring Logging for an Access Control Entry, page 13-22

• Managing Deny Flows, page 13-23

1 2 ... 217 218 219 220 221 222 223 224 225 226 227 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 222

Kommentare zu diesen Handbüchern