<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:54" />
    <title> Configuration Examples for IP-ACL  </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1718;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1105326"> </a><h1 class="pTitle">
<span style="font-weight: normal"> </span>Configuration Examples for IP-ACL 

</h1>
<a name="wp1105328"> </a><p class="pBody">
To define an IP-ACL that restricts management access using Device Manager, follow these steps:

</p>
<div class="pSmartList1"><ol type="1" class="pSmartList1">
<a name="wp1105329"> </a><li class="pSmartList1">Choose <b style="font-weight: bold" class="cBold">Security </b><span style="font-weight: bold">&gt; </span><b style="font-weight: bold" class="cBold">IP ACL</b><span style="font-weight: bold">.
</span></li>
<a name="wp1105330"> </a><p class="pListBodyLevel1">
You see the IP-ACL dialog box.

</p>
<a name="wp1105331"> </a><li class="pSmartList1">Click <b style="font-weight: bold" class="cBold">Create</b><span style="font-weight: bold"> </span>to create an IP-ACL.
</li>
<a name="wp1105332"> </a><p class="pListBodyLevel1">
You see the Create IP ACL Profiles dialog box. 

</p>
<a name="wp1108225"> </a><li class="pSmartList1">Enter<b class="cBold"> RestrictMgmt </b>as the profile name and click <b class="cBold">Create</b>. 
</li>
<a name="wp1108229"> </a><p class="pListBodyLevel1">
This creates an empty IP-ACL named RestrictMgmt .

</p>
<a name="wp1105344"> </a><li class="pSmartList1">Select<b class="cBold"> RestrictMgmt </b>and click <b class="cBold">Rules</b>. 
</li>
<a name="wp1105345"> </a><p class="pListBodyLevel1">
You see an empty list of IP filters associated with this IP-ACL.

</p>
<a name="wp1105347"> </a><li class="pSmartList1">Click <b class="cBold">Create</b> to create the first IP filter. 
</li>
<a name="wp1105348"> </a><p class="pListBodyLevel1">
You see the Create IP Filter dialog box. 

</p>
<a name="wp1105349"> </a><li class="pSmartList1">Create an IP filter to allow management communications from a trusted subnet:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1105351"> </a><li class="pSmartList2">Choose the <b class="cBold">permit </b>Action and select <b class="cBold">0 IP </b>from the Protocol drop-down menu. </li>
<a name="wp1105352"> </a><li class="pSmartList2">Set the source IP address to 10.67.16.0 and the wildcard mask to<span style="font-weight: bold"> </span>0.0.0.255. </li>
<a name="wp1105353"> </a><p class="pBodyAutonumRel">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> The wildcard mask denotes a subset of the IP address you want to match against. This allows 
a range of addresses to match against this filter.

</p>
<a name="wp1105354"> </a><li class="pSmartList2">Check the <b class="cBold">any</b> check box for the destination address.</li>
<a name="wp1105356"> </a><li class="pSmartList2">Click<b class="cBold"> Create</b> to create this IP filter and add it to the RestrictMgmt IP-ACL. </li>
</ol></div>
<a name="wp1105363"> </a><p class="pListBodyLevel1">
Repeat Step <a href="ipacl18.html#wp1105351">a</a> through Step <a href="ipacl18.html#wp1105356">d</a> to create an IP filter that allows communications for all addresses in the 
10.67.16.0/24 subnet.

</p>
<a name="wp1105364"> </a><li class="pSmartList1">Create an IP filter to allow ICMP ping commands:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1105366"> </a><li class="pSmartList2">Choose the <b class="cBold">permit </b>Action and select <b class="cBold">1-ICMP </b>from the Protocol drop-down menu.</li>
<a name="wp1105367"> </a><li class="pSmartList2">Check the <b class="cBold">any </b>check box for the source address. </li>
<a name="wp1105368"> </a><li class="pSmartList2">Check the <b class="cBold">any</b> check box for the destination address. </li>
<a name="wp1105369"> </a><li class="pSmartList2">Select<b class="cBold"> 8 echo </b>from the ICMPType drop-down menu.</li>
<a name="wp1105371"> </a><li class="pSmartList2">Click <b class="cBold">Create </b>to create this IP filter and add it to the RestrictMgmt IP-ACL. </li>
</ol></div>
<a name="wp1105378"> </a><p class="pListBodyLevel1">
Repeat Step <a href="ipacl18.html#wp1105366">a</a> through Step <a href="ipacl18.html#wp1105371">e</a> to create an IP filter that allows ICMP ping.

</p>
<a name="wp1105379"> </a><li class="pSmartList1">Create a final IP Filter to block all other traffic:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1105381"> </a><li class="pSmartList2">Choose the <b class="cBold">deny </b>Action and select<b class="cBold"> 0 IP </b>from the Protocol drop-down menu. </li>
<a name="wp1105382"> </a><li class="pSmartList2">Check the <b class="cBold">any </b>check box for the source address. </li>
<a name="wp1105383"> </a><li class="pSmartList2">Check the <b class="cBold">any</b> check box for the destination address. </li>
<a name="wp1105385"> </a><li class="pSmartList2">Click <b class="cBold">Create </b>to create this IP filter and add it to the RestrictMgmt IP-ACL. </li>
<a name="wp1105386"> </a><li class="pSmartList2">Click <b class="cBold">Close </b>to close the Create IP Filter dialog box.</li>
</ol></div>
<a name="wp1105393"> </a><p class="pListBodyLevel1">
Repeat Step <a href="ipacl18.html#wp1105381">a</a> through Step <a href="ipacl18.html#wp1105356">d</a> to create an IP filter that blocks all other traffic.

</p>
<a name="wp1105394"> </a><li class="pSmartList1">Apply the RestrictMgmt IP ACL to the mgmt0 interface:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1105396"> </a><li class="pSmartList2">Click <b style="font-weight: bold" class="cBold">Security</b><span style="font-weight: bold">, </span>select <b style="font-weight: bold" class="cBold">IP ACL,</b><span style="font-weight: bold"> </span>and then click the<b style="font-weight: bold" class="cBold"> Interfaces</b><span style="font-weight: bold"> </span>tab in the IP ACL dialog box.</li>
<a name="wp1105397"> </a><li class="pSmartList2">Click <b class="cBold">Create</b>. </li>
<a name="wp1105398"> </a><p class="pListBodyLevel2">
You see the Create IP-ACL Interfaces dialog box.

</p>
<a name="wp1105399"> </a><li class="pSmartList2">Select<b class="cBold"> mgmt0 </b>from the Interfaces drop-down menu.</li>
<a name="wp1105400"> </a><li class="pSmartList2">Select the<b class="cBold"> inbound</b> Profile Director.</li>
<a name="wp1105401"> </a><li class="pSmartList2">Select <b class="cBold">RestrictMgmt</b> from the ProfileName drop-down menu.</li>
<a name="wp1105403"> </a><li class="pSmartList2">Click <b class="cBold">Create</b> to apply the RestrictMgmt IP-ACL to the mgmt0 interface. </li>
</ol></div>
<a name="wp1105410"> </a><p class="pListBodyLevel1">
Repeat Step <a href="ipacl18.html#wp1105396">a</a> through Step <a href="ipacl18.html#wp1105403">f</a> to apply the new IP-ACL to the mgmt0 interface.

</p>
</ol></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
