BROCADE IP PRIMER

Security: Access Control Lists (ACL)or “10” or “99.” There are many times in which you will need to create multipledifferent ACLs on a given switch. This is how Numbered ACLs are distinguished.Above, we've created “access-list 1.” If we need a different NumberedStandard IP access list, we can create “access-list 2,” or whatever numberbetween 1 and 99.Let's go to the next part. You've seen the keywords “permit” and “deny.”They're pretty intuitive. The keyword “permit” allows the traffic through, if it ismatched. The keyword “deny” drops the packet, if it is matched. There areother commands that may be used here, but this goes beyond the scope ofthis book. For most all of the ACLs that you will work with, you need onlyremember “permit” or “deny.”Finally, we need to specify the source IP addresses. We can do this by choosinga specific IP address with a wildcard mask (e.g., “10.1.1.0 0.0.0.255”). Wecan also specify a specific single IP address by using the keyword “host” (e.g.,“host 10.1.2.3”). Remember, “host” is the same as a wildcard mask of“0.0.0.0” (e.g., “10.1.2.3 0.0.0.0”). Or we can specify “any” IP address.Remember that the keyword “any” means the same thing as “0.0.0.0255.255.255.255.”To delete a specific line within the ACL, just put a “no” in front of it (e.g., “noaccess-list 1 permit any”). To delete an entire ACL, type no access-list 1.That's it. In summary, a Numbered Standard IP access list uses this syntax:access-list Numbered Extended IP Access ListsExtended IP access lists are a little trickier, because there's so much more toplay with. It's a Numbered ACL, so it is configured in the global config. Here'san example:BR-Switch#conf tBR-Switch(config)#access-list 101 deny icmp any anyBR-Switch(config)#access-list 101 deny udp host 10.2.2.3 eq 53anyBR-Switch(config)#access-list 101 permit tcp 10.1.1.00.0.0.255 host 10.2.2.10 eq 80BR-Switch(config)#access-list 101 deny ip 10.1.1.0 0.0.0.255anyBR-Switch(config)#access-list 101 permit ip any anyThis access lists prevents any ICMP traffic. It denies 10.2.2.3 from sending asegment with a source port of UDP 53 to any address (this is a DNS responsepacket). It allows the 10.1.1.0/24 network to connect to 10.2.2.10 on TCP 80(HTTP). It denies any other traffic from 10.1.1.0/24 from going anywhere else.Finally, it allows any address to reach any other address on any protocol.Here again, this is read from top to bottom, and it has an implicit “deny ip anyany” at the bottom. We start by using the keyword “access-list.” This tells theswitch that we are about to define a Numbered ACL. Next, we specify the number.In this case, it's “101.” This instantly tells the switch that we are definingBrocade IP Primer 295