CCNA Cisco Certified Network Associate Study Guide - FTP Server

456 Chapter 9 � Managing Traffic with Access Lists
IPX SAP Filters
Let’s take a look at a template for building lines in an IPX extended
access list.
access-list {number} {permit/deny} {protocol} {source}
{socket} {destination} {socket}
Again, when you move from standard to extended access lists, you’re simply
adding the ability to filter based on protocol and socket (port for IP).
IPX SAP filters are implemented using the same tools we’ve been discussing
all along in this chapter. They have an important place in controlling IPX
SAP traffic. Why is this important? Because if you can control the SAPs, you
can control the access to IPX devices. IPX SAP filters use access lists in the
1000–1099 range. IPX SAP filters should be placed as close as possible to the
source of the SAP broadcasts; this is to stop unwanted SAP traffic from
crossing a network because it will only be discarded.
Two types of access list filters control SAP traffic:
IPX input SAP filter This is used to stop certain SAP entries from entering
a router and updating the SAP table.
IPX output SAP filter This stops certain SAP updates from being sent in
the regular 60-second SAP updates.
Here’s the template for each line of an IPX SAP filter:
access-list {number} {permit/deny} {source} {service type}
Here is an example of an IPX SAP filter that allows service type 4 (file services)
from a NetWare service named Sales.
Router(config)#access-list 1010 permit ?
-1 Any IPX net
Source net
N.H.H.H Source net.host address
Router(config)#access-list 1010 permit -1 ?
Service type-code (0 matches all services)
N.H.H.H Source net.host mask