Filter
Top Products
CHAPTER
24-1
Catalyst 2950 Desktop Switch Software Configuration Guide
78-11380-05
24
Configuring Network Security with ACLs
This chapter describes how to configure network security on your switch by using access control lists
(ACLs), which are also referred to in commands and tables as access lists.
You can create ACLs for physical interfaces or management interfaces. A management interface is
defined as a management VLAN or any traffic that is going directly to the CPU, such as SNMP, Telnet,
or web traffic. You can create ACLs for management interfaces with the standard software image (SI) or
the enhanced software image (EI) installed on your switch. However, you must have the EI installed on
your switch to apply ACLs to physical interfaces.
Note An ACLs that applied is to a physical interface has a limitation of one mask, and certain keywords are
not supported. For more information, see the “Guidelines for Applying ACLs to Physical Interfaces”
section on page 24-6.
Note For complete syntax and usage information for the commands used in this chapter, refer to the command
reference for this release and the “Configuring IP Services” section of the Cisco IOS IP and IP Routing
Configuration Guide and the Command Reference for IOS Release 12.1.
This chapter consists of these sections:
• Understanding ACLs, page 24-2
• Configuring ACLs, page 24-6
• Displaying ACL Information, page 24-21
• Examples for Compiling ACLs, page 24-23
You can configure ACLs by using the Cluster Management Suite (CMS) or through the command-line
interface (CLI). Refer to the CMS online help for step-by-step configuration procedures through CMS.
For information about accessing and using CMS, see Chapter 3, “Getting Started with CMS.”
You can also use the security wizard to filter inbound traffic on the switches. Filtering can be based on
network addresses, Transmission Control Protocol (TCP) applications, or User Datagram Protocol
(UDP) applications. You can choose whether to drop or to forward packets that meet the filtering criteria.
To use this wizard, you must know how the network is designed and how interfaces are used on the
filtering device. Refer to the security wizard online help for step-by-step configuration procedures about
using this wizard.