BROCADE IP PRIMER

Chapter 14: Security, Redundancy and Morethe Named ACL sub-config, and put a “no” in front of the line (e.g., “no permitany”). To delete an entire ACL, from the global config, type no ip access-liststandard HostDeny, as an example.The syntax can be summed up this way:ip access-list standard Named Extended IP Access ListsThe form factor of Named Extended IP ACLs is very similar to the NumberedACLs. Begin by initially defining the named ACL in the global config. Then, wedefine the lines of the ACL in the Named ACL sub-config:BR-Switch#conf tBR-Switch(config)#ip access-list extended AllowWebBR-Switch(config-ext-nacl)#deny icmp any anyBR-Switch(config-ext-nacl)#deny udp host 10.2.2.3 eq 53 anyBR-Switch(config-ext-nacl)#permit tcp 10.1.1.0 0.0.0.255 host10.2.2.10 eq 80BR-Switch(config-ext-nacl)#permit tcp host 10.1.1.20 eq 25 anyestablishedBR-Switch(config-ext-nacl)#deny ip 10.1.1.0 0.0.0.255 anyBR-Switch(config-ext-nacl)#permit ip any anyNotice that we used the same ACL rules in our Numbered Extended IP ACLexample. We just wrote them as a Named Extended IP ACL. Here, instead ofusing “101,” we named the ACL “AllowWeb.” The individual lines still specifyprotocol, source IP address, source port, destination IP address, and destinationport. The end result is the same. We deny all ICMP traffic. We deny10.2.2.3 from sending a UDP segment with a source port of 53 (a DNSresponse). We allow 10.1.1.0/24 to talk to 10.2.2.10 on TCP 80 (HTTP), but wedeny all other traffic from that network. We've added a new line to allow trafficfrom 10.1.1.20 to send to any address with a source TCP port of 25 (SMTP)and a curious keyword “established.” This means that 10.1.1.20 can send trafficwith a source TCP port of 25, but only if it is responding to a previouslyinitiated session. When an incoming TCP SYN is received, the responding TCPSYN/ACK will show as part of an established session (and this ACL line will permitit). Finally, we allow all traffic not pertaining to the permit and deny linesabove.To remove a specific line within a Named ACL, make sure you're in the NamedACL sub-config, and put a “no” in front of the line (e.g., “no deny icmp anyany”). To delete an entire ACL, from the global config, type no ip access-listextended AllowWeb, as an example.The syntax looks like this:ip access-list extended 298 Brocade IP Primer