BROCADE IP PRIMER

Chapter 14: Security, Redundancy and MoreCreating Access ListsOkay, so let's get to work. Now that we know all these things, how do we actuallycreate the lists?Numbered Standard IP Access ListsLet's start with the Numbered Standard IP access lists. These are defined inthe global config. The syntax looks like this:BR-Switch#conf tBR-Switch(config)#access-list 1 deny host 10.1.2.3BR-Switch(config)#access-list 1 permit anyThis is a simple two-line access list that prevents any traffic coming from10.1.2.3, but allows all other traffic. Remember that access lists are read fromtop to bottom. The first line that matches a packet will be applied. Consider, forinstance, if we configured this:BR-Switch#conf tBR-Switch(config)#access-list 1 permit anyBR-Switch(config)#access-list 1 deny host 10.1.2.3Does this access list deny any traffic? No, actually. Every packet will hit thefirst line (“permit any”) and be allowed through. In fact, that deny line doesneed to be there at all. Now, what if we go back to our first example, but leaveoff the permit line:BR-Switch#conf tBR-Switch(config)#access-list 1 deny host 10.1.2.3Now, the access list actually denies all traffic. Remember that there's animplicit “deny any” at the bottom of the list (“deny ip any any” for Extended IP).If we have an access list that includes only deny lines with no permit lines, notraffic will be allowed through at all. In fact, the above example could just aseasily have been written:BR-Switch#conf tBR-Switch(config)#access-list 1 deny anyRemember that there is an implicit “deny any” at the end of the list. Rememberthat the access list is read from top to bottom. This means it's typicallybest to put your deny statements close to the top of the list, and your permitslater on.Let's talk about syntax for a minute now. Let's go back to our original example:BR-Switch#conf tBR-Switch(config)#access-list 1 deny host 10.1.2.3BR-Switch(config)#access-list 1 permit anyYou start out in the global config. The first key word you type is access-list. Thisspecifies that you are going to define a Numbered ACL. Now, is it a Standard IPor an Extended IP? We don't know yet, we haven't specified the number. That'sthe next part. Here, we've specified “1.” This tells the switch that you are defininga Numbered Standard IP access list. We could have just as easily used “2”294 Brocade IP Primer