Filter
Top Products
4-13
Cisco Service Control Engine 1000 2xGBE Quick Start Guide
OL-7822-06
Chapter 4 Connect the Management Interfaces and Perform Initial System Configuration
Perform the Initial System Configuration
Configuring ACLs
The SCE 1000 can be configured with Access Control Lists (ACLs), which are used to permit or deny
incoming connections on any of the management interfaces.
Note ACL #0 is a pre-defined list that permits access to all IP addresses.
Configuration of access control lists is done in two stages:
1. Create the access control lists.
You may create 99 ACLs with a maximum of 20 entries per list. Each entry consists of an IP address,
and an indication of whether access is permitted or denied to this IP address.
2. Assign the ACLs to the appropriate management interface. (See )
The dialog permits you to skip the creation/editing of the ACLs and go directly to assigning ACLs
to the management interfaces.
Entry Formats
Each ACL may permit/deny access to any IP address, one or more ranges of IP addresses, or one or more
individual IP address. Three entry formats are available to support these options:
• Any IP address — Type the word “any”. Any IP address will be permitted or denied access.
• Range of IP addresses — Type the beginning IP address in the desired range, then enter the wildcard
bits that define the range.
This wildcard functions like a reverse mask, in that all “1” bits in the wildcard indicate the
corresponding bit in the IP address should be ignored. All other bits must match the corresponding
bit in the specified IP address. Refer to the table below for examples.
Each range of IP addresses can be configured to be permitted or denied access.
• Individual IP address— Type the desired IP address, then enter the wildcard bits 0.0.0.0.
Each individual IP address can be configured to be permitted or denied access.
Order of Entries
The order of the entries in the list is important. The entries in the list are tested sequentially, and the
action is determined by the first entry that matches the connecting IP address. Therefore, when the entry
“any” appears in an Access Control List, all succeeding entries are irrelevant.
Consider two hypothetical ACLs containing the same entries in a different order.
The following list would permit access to all IP addresses, including 10.1.1.0:
permit any
deny 10.1.1.0
Note that the above list could not actually be created using the setup utility, since after the “any” entry,
no other entries could be added to the list.
Table 4-2 IP address/Wildcard bit examples
Initial IP address Wildcard bits Range
10.1.1.0 0.0.0.255 10.1.1.0–10.1.1.255
10.1.1.0 0.0.0.63 10.1.1.0–10.1.1.63
10.1.1.0 0.0.0.0 10.1.1.0 (individual entry)