Filter
Top Products
CHAPTER
28-1
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
OL-10101-02
28
Configuring Network Security with ACLs
This chapter describes how to configure network security on a Catalyst 2950 or Catalyst 2955 switch by
using access control lists (ACLs), which are also referred to in commands and tables as access lists.
You can create ACLs for physical interfaces or management interfaces. A management interface is
defined as a management VLAN or any traffic that is going directly to the CPU, such as SNMP, Telnet,
or web traffic. You can create ACLs for management interfaces with the standard software image (SI) or
the enhanced software image (EI) installed on your switch. However, you must have the EI installed on
your switch to apply ACLs to physical interfaces.
Note An ACLs that applied is to a physical interface has a limitation of one mask, and certain keywords are
not supported. For more information, see the
“Guidelines for Applying ACLs to Physical Interfaces”
section on page 28-5.
Note For complete syntax and usage information for the commands used in this chapter, see the command
reference for this release and the “Configuring IP Services” section of the Cisco IOS IP and IP Routing
Configuration Guide, Cisco IOS Release 12.1 and the Cisco IOS IP and IP Routing Command Reference,
Cisco IOS Release 12.1.
This chapter consists of these sections:
• Understanding ACLs, page 28-2
• Configuring ACLs, page 28-6
• Displaying ACL Information, page 28-20
• Examples for Compiling ACLs, page 28-22
You can configure ACLs by using the command-line interface (CLI).
You can also use the security wizard to filter inbound traffic on the switches. Filtering can be based on
network addresses, TCP applications, or User Datagram Protocol (UDP) applications. You can choose
whether to drop or to forward packets that meet the filtering criteria. To use this wizard, you must know
how the network is designed and how interfaces are used on the filtering device. See the security wizard
online help for step-by-step configuration procedures about using this wizard.