Cisco PIX 525 Specifikace stáhnout pdf (Strana 215)

100

101

13-13

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Adding a Standard Access List

Single context mode only

Standard access lists identify the destination IP addresses of OSPF routes, and can be used in a route

map for OSPF redistribution. Standard access lists cannot be applied to interfaces to control traffic.

The following command adds a standard ACE. To add another ACE at the end of the access list, enter

another access-list command specifying the same access list name. Apply the access list using the

“Adding a Route Map” section on page 8-6.

To add an ACE, enter the following command:

hostname(config)# access-list

access_list_name

standard {deny | permit} {any |

ip_address

mask

}

The following sample access list identifies routes to 192.168.1.0/24:

hostname(config)# access-list OSPF standard permit 192.168.1.0 255.255.255.0

Simplifying Access Lists with Object Grouping

This section describes how to use object grouping to simplify access list creation and maintenance.

This section includes the following topics:

• How Object Grouping Works, page 13-13

• Adding Object Groups, page 13-14

• Nesting Object Groups, page 13-17

• Displaying Object Groups, page 13-19

• Removing Object Groups, page 13-19

• Using Object Groups with an Access List, page 13-18

How Object Grouping Works

By grouping like-objects together, you can use the object group in an ACE instead of having to enter an

ACE for each object separately. You can create the following types of object groups:

• Protocol

• Network

• Service

• ICMP type

For example, consider the following three object groups:

• MyServices—Includes the TCP and UDP port numbers of the service requests that are allowed

access to the internal network

• TrustedHosts—Includes the host and network addresses allowed access to the greatest range of

services and servers

• PublicServers—Includes the host addresses of servers to which the greatest access is provided

After creating these groups, you could use a single ACE to allow trusted hosts to make specific service

requests to a group of public servers.

1 2 ... 210 211 212 213 214 215 216 217 218 219 220 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 215

Komentáře k této Příručce