BigIron RX Series Configuration Guide 53353-1002253-01Configuring numbered and named ACLs 21The following commands apply ACL 102 to the incoming and outgoing traffic on port 1/2 and to theincoming traffic on port 4/3.Here is another example of an extended ACL.The first entry in this ACL denies TCP traffic from the 209.157.21.x network to the 209.157.22.xnetwork.The second entry denies all FTP traffic from the 209.157.21.x network to the 209.157.22.xnetwork.The third entry denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network, ifthe TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), andif the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greaterthan 23 are allowed.The fourth entry denies UDP packets from any source to the 209.157.22.x network, if the UDP portnumber from the source network is 5 or 6 and the destination UDP port is 7 or 8.The fifth entry permits all packets that are not explicitly denied by the other entries. Without thisentry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign theACL.The following commands apply ACL 103 to the incoming and outgoing traffic on ports 2/1 and 2/2.Extended ACL syntaxThis section presents the syntax for creating an extended ACL and for binding the ACL to aninterface. Use the ip access-group command in the interface level to bind the ACL to an interface.Syntax: [no] access-list deny | permit | [ ] | BigIron RX(config)# int eth 1/2BigIron RX(config-if-e10000-1/2)# ip access-group 102 inBigIron RX(config-if-e10000-1/2)# exitBigIron RX(config)# int eth 4/3BigIron RX(config-if-e10000-4/3)# ip access-group 102 inBigIron RX(config)# write memoryBigIron RX(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24BigIron RX(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp209.157.22.0/24BigIron RX(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 lttelnet neq 5BigIron RX(config)# access-list 103 deny udp any range 5 6 209.157.22.0/24 range7 8BigIron RX(config)# access-list 103 permit ip any anyBigIron RX(config)# int eth 2/1BigIron RX(config-if-e10000-2/1)# ip access-group 103 inBigIron RX(config-if-e10000-2/1)# exitBigIron RX(config)# int eth 2/2BigIron RX(config-if-e10000-2/2)# ip access-group 103 inBigIron RX(config)# write memory
