BROCADE IP PRIMER

Security: Access Control Lists (ACL)Next, we need to specify the destination address and port number. This isdone in the same way as the source address and port number. The addresscan be an IP address followed by a wildcard mask, the keyword “host” followedby a specific IP address, or the keyword “any.” The port number is specifiedusing “eq,” “gt,” “lt,” “neq,” or “range.” It may also be left blank, meaning thatany destination port will match. This is used in the second line. We want tomatch a source port of 53, but the destination port may be anything.Now, source port and destination port really only play a role in TCP or UDP protocols.Layer 4 port numbers have no place in Layer 3 protocols like ICMP andOSPF. There are additional options granted, depending on the protocol youspecified. For example, there are many different ICMP packets. Let's say wewanted to allow everything except Ping (ICMP Echo and ICMP Echo-Reply). Wecould have written the first line this way:BR-Switch(config)#access-list 101 deny icmp any any echoBR-Switch(config)#access-list 101 deny icmp any any echo-replyBR-Switch(config)#access-list 101 permit icmp any anyThis would allow any ICMP packets, except specifically ICMP Echo and ICMPEcho-Reply packets. In the end, the “?” is your friend. This will always guideyou as to what options are available.To delete a specific line within the ACL, just put a “no” in front of it (e.g., “noaccess-list 101 deny icmp any any echo-reply”). To delete an entire ACL, typeno access-list 101.In summary, the Numbered Extended IP access list syntax looks like this:access-list Named Standard IP Access ListsThe form factor for Named access lists is very similar to Numbered. In thiscase, we start by initially defining the list in the global config. This sends usinto a sub-config for Named ACLs:BR-Switch#conf tBR-Switch(config)#ip access-list standard HostDenyBR-Switch(config-std-nacl)#deny host 10.1.2.3BR-Switch(config-std-nacl)#permit anyThis is a different way to write the same Standard IP access list we used in theNumbered Standard IP access list section. The difference is that instead of anumber, we've given the list a name (“HostDeny”). Also, notice that the linesdefining the rules do not have “access-list” in front of them. The keyword“access-list” denotes a Numbered ACL.The function of the ACL is the same. We're denying all traffic coming from aspecific IP address: 10.1.2.3, and we're permitting traffic from any otheraddress. To remove a specific line within a Named ACL, make sure you're inBrocade IP Primer 297