So now we're going to take a look at our localized policy,
specifically access control lists.
As we mentioned, these don't happen on the controller.
I'm going to switch over now to our Edge 11,
and guess what? We haven't actually timed out yet. That's awesome.
So we're going to perform configuration here on Edge 11,
and see how exactly we do access control lists.
Now, keep in mind something pretty interesting here.
Access control lists, unlike SD-WAN policy,
are something that existed in iOS XE.
So I can do a config-t still,
but then I can get on here
and I can start to create an IP access list.
I can give it a name,
and start to go into sequence numbers,
permit and deny statements,
and this is all on the iOS XE side of things.
So that's well and good,
but we usually want to keep everything
within the realm of SD-WAN.
And so we're still going to get onto
the SD-WAN side of the house here
in order to do access control lists.
we're not actually creating control lists
or access control lists from the perspective
of individual access control lists
being assigned to interfaces.
Instead, I have to create it as if it's part of a policy.
Now, policies, as we saw earlier,
even though it's part of the SD-WAN world,
actually happens out here globally.
So I'm still going to enter the policy framework here,
and now I can do access list,
and I can give it a name.
Let's just call it SD-WAN ACL.
Notice the IP is not there
because we're running the telecommand,
so it's not IP access list, it's access list,
kind of like what iOS used to have a long time ago.
And now this is going to feel, as we might expect,
exactly like how we configured it
within the SD-WAN manager UI.
So now I'm going to say sequence 10,
give it a sequence number,
and we do our match action statements.
So I'm going to say match,
and I can say protocol six, that would be TCP, right?
I mean, I can look at other things I can do,
and it does show TCP here, but that's for TCP SYN flags.
We're not looking at that.
We've got to actually specify protocol numbers
if we want to block TCP and UDP and such.
So I'm going to match that,
and then I can set my action statement
within the sequence number, so action.
And again, as we've pointed out before,
it's accept and drop.
It's not accept and reject anymore.
We're dropping actual traffic,
and so we could say action drop here,
or we could say action allow.
Let's just do that.
Oops, action allow, action accept.
I tend to do that a lot.
It's not allow, it's accept in the SD-WAN world.
Okay, so action accept.
So from here, I'm going to get into sequence 20
and do another match,
and then maybe this time we'll do protocol one.
That would be ICMP, so we can match on that,
and then keep in mind that we've got other options.
For example, we could actually list out ICMP message types
if we wanted to, and so on and so forth.
So from here, I'll exit, and I'll do an action.
This time I'll say action drop,
and then just like before,
we get out of our sequence numbers,
and this default action, sort of its own sequence number.
It just happens at the very end,
which is why we don't give it a number.
So it's a default action,
and again, I can accept or drop this,
so maybe I'll just say drop.
So from here, now we need to apply this to our interface,
but what interface am I applying it to?
Well, once again, this actually is an access control
which we created on the SD-WAN side of the house.
So now I need to get onto my SD-WAN side,
get into interface, gigabit ethernet,
let's say gigaethernet4,
and now it's access list with the name,
and then in or out.
So a few things to keep in mind here.
First of all, the syntax is very different from Cisco.
For example, we use access class or access group,
especially on interfaces, it's access group,
commands to apply an access control list.
If it's on something like a VTY line,
telnet line, something like that,
then it would be access class.
So a little bit different on the Cisco side
versus our Viptela side,
we just simply say access list, how about that?
And then we give the name and notice it's in and out
rather than inbound and outbound.
So just a few syntax things to be aware of there,
but importantly, again, I can just say in,
something like that, there we go.
So from here, we would commit the configuration changes
and we would have deployed an access control list
using our SD-WAN side configuration
rather than doing it on iOS XE.