CCNP TSHOOT 6.0 - Cisco Learning Home

CCNPv6 TSHOOT
hp-collector HP Performance data collector
hp-managed-node HP Performance data managed node
hsrp Hot Standby Router Protocol
http HTTP Protocol
https Secure Hypertext Transfer Protocol
ica ica (Citrix)
icabrowser icabrowser (Citrix)
icmp ICMP Protocol
ACL-related Commands
R1#show access-lists
Standard IP access list 1
10 permit 10.1.0.0, wildcard bits 0.0.255.255 (18 matches)
Extended IP access list FW-ACL
10 deny ip any any (29 matches)
In the above example, two ACLs are configured on R1: a standard numbered ACL that identities internal NAT
hosts, and an extended named ACL that blocks all traffic for a given direction (inbound or outbound). Statements
in both are accumulating matches.
R1#show access-lists FW-ACL
Extended IP access list FW-ACL
10 permit icmp any host 198.133.219.1 (13 matches)
20 permit tcp any host 198.133.219.1 eq www
30 permit udp host 192.168.2.1 host 192.168.1.1 eq ntp
40 deny ip any any log (299 matches)
In the above example, a specific named ACL is displayed. Note the log option on the deny ip any any
statement. The use of this option produces logged message output on the console and syslog server, similar to
that shown below. In this example, an NTP packet (port 123) from R2 to R1 is being denied.
Dec 19 20:23:29.691: %SEC-6-IPACCESSLOGP: list FW-ACL denied udp 192.168.2.1(123) -
> 192.168.1.1(123), 1 packet
VACL-related Commands
DLS2#show vlan access-map
Vlan access-map "BLOCK-GUEST" 10
Match clauses:
ip address: GUEST-ACCESS-CTRL
Action:
drop
Vlan access-map "BLOCK-GUEST" 20
Match clauses:
Action:
Forward
In the above example, access map BLOCK-GUEST has been configured with two match clauses. The first drops
all traffic that matches the IP addresses specified in named ACL GUEST-ACCESS-CTRL. The second forwards
all traffic that does not match the IP addresses specified in named ACL GUEST-ACCESS-CTRL. An implied
deny all match clause is in effect at the end of the access map.
All contents are Copyright © 1992–2010 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Page 12 of 16