IBM 12.1(22)EA6 Manuel d'utilisateur Page 395
- Page / 550
- Table des matières
- DEPANNAGE
- MARQUE LIVRES
Noté. / 5. Basé sur avis des utilisateurs
22-11
Cisco Systems Intelligent Gigabit Ethernet Switch Modules for the IBM BladeCenter, Software Configuration Guide
24R9746
Chapter 22 Configuring Network Security with ACLs
Configuring ACLs
Beginning in privileged EXEC mode, follow these steps to create an extended ACL:
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
access-list access-list-number
{deny | permit | remark} protocol
{source source-wildcard | host
source | any} [operator port]
{destination destination-wildcard |
host destination | any} [operator
port] [dscp dscp-value]
[time-range time-range-name]
Define an extended IP access list and the access conditions.
The access-list-number is a decimal number from 100 to 199 or 2000 to 2699.
Enter deny or permit to specify whether to deny or permit the packet if
conditions are matched.
For protocol, enter the name or number of an IP protocol: IP, TCP, or UDP. To
match any Internet protocol (including TCP and UDP), use the keyword ip.
The source is the number of the network or host from which the packet is sent.
The source-wildcard applies wildcard bits to the source.
The destination is the network or host number to which the packet is sent.
Define a destination or source port.
• The operator can be only eq (equal).
• If operator is after source source-wildcard, conditions match when the
source port matches the defined port.
• If operator is after destination destination-wildcard, conditions match
when the destination port matches the defined port.
• The port is a decimal number or name of a TCP or UDP port. The number
can be from 0 to 65535.
• Use TCP port names only for TCP traffic.
• Use UDP port names only for UDP traffic.
The destination-wildcard applies wildcard bits to the destination.
access-list access-list-number
{deny | permit | remark} protocol
{source source-wildcard | host
source | any} [operator port]
{destination destination-wildcard |
host destination | any} [operator
port] [dscp dscp-value]
[time-range time-range-name]
(continued)
Source, source-wildcard, destination, and destination-wildcard can be
specified in three ways:
• The 32-bit quantity in dotted-decimal format.
• The keyword any as an abbreviation for source and source-wildcard
of 0.0.0.0 255.255.255.255 or any source host.
• The keyword host, followed by the 32-bit quantity in dotted-decimal
format, as an abbreviation for a single host with source and
source-wildcard of source 0.0.0.0.
dscp—Enter to match packets with any of the supported 13 DSCP values
(0, 8, 10, 16, 18, 24, 26, 32, 34, 40, 46, 48, and 56), or use the question mark
(?) to see a list of available values.
The time-range keyword is optional. For an explanation of this keyword, see
the “Applying Time Ranges to ACLs” section on page 22-14.
Step 3
show access-lists [number | name] Verify the access list configuration.
Step 4
copy running-config
startup-config
(Optional) Save your entries in the configuration file.
- Software Configuration Guide 1
- “Notices.” 2
- First Edition (October 2005) 2
- CONTENTS 3
- 9 Configuring STP 9-1 8
- 10 Configuring MSTP 10-1 9
- 12 Configuring VLANs 12-1 10
- Contents 11
- 13 Configuring VTP 13-1 12
- 16 Configuring UDLD 16-1 14
- 17 Configuring CDP 17-1 14
- 19 Configuring RMON 19-1 15
- 21 Configuring SNMP 21-1 16
- 23 Configuring QoS 23-1 17
- 25 Troubleshooting 25-1 19
- A Supported MIBs A-1 19
- D Notices D-1 21
- Audience 23
- Conventions 24
- Related Publications 25
- Performance 27
- Manageability 28
- Redundancy 29
- VLAN Support 30
- Security 30
- Monitoring 31
- Management Interface Options 32
- Chapter 1 Overview 33
- Where to Go Next 34
- Cisco IOS Command Modes 35
- • Change terminal 36
- • Perform basic tests 36
- • Display system 36
- Getting Help 37
- Abbreviating Commands 38
- Understanding CLI Messages 39
- Using Command History 39
- Recalling Commands 40
- Accessing the CLI 43
- Default Switch Information 46
- Assigning Switch Information 47
- Default Boot Configuration 51
- • reload in [hh:]mm [text] 55
- Administering the Switch 57
- • User show commands 58
- Configuring NTP 59
- Default NTP Configuration 60
- Configuring NTP Associations 61
- Setting the System Clock 66
- Configuring the Time Zone 67
- Configuring a System Name 70
- Understanding DNS 70
- Default DNS Configuration 71
- Setting Up DNS 71
- Default Banner Configuration 72
- Configuring a Login Banner 74
- Building the Address Table 75
- MAC Addresses and VLANs 75
- Managing the ARP Table 80
- Understanding TACACS+ 89
- TACACS+ Operation 91
- Configuring TACACS+ 91
- Default TACACS+ Configuration 92
- Starting TACACS+ Accounting 96
- Understanding RADIUS 97
- RADIUS Operation 98
- Configuring RADIUS 99
- Default RADIUS Configuration 99
- Defining AAA Server Groups 104
- Starting RADIUS Accounting 107
- Authorization 111
- Understanding SSH 112
- Configuration Guidelines 113
- Limitations 113
- Configuring SSH 113
- Configuring the SSH Server 115
- Authentication 117
- Device Roles 118
- Figure 6-2 Message Exchange 120
- IEEE 802.1x Accounting 121
- IEEE 802.1x Host Mode 122
- Wireless clients 123
- Access point 123
- (RADIUS) 123
- Unidirectional State 126
- Bidirectional State 126
- Changing the Quiet Period 133
- Configuring the Host Mode 136
- Configuring a Guest VLAN 136
- Understanding Interface Types 143
- Access Ports 144
- Trunk Ports 144
- Port-Based VLANs 145
- EtherChannel Port Groups 145
- Using the Interface Command 146
- Configuring Smartports Macros 159
- Creating Smartports Macros 162
- Applying Smartports Macros 163
- Displaying Smartports Macros 166
- Configuring STP 167
- STP Overview 168
- Blocking State 171
- Listening State 172
- Learning State 172
- Forwarding State 172
- Disabled State 173
- STP and IEEE 802.1Q Trunks 176
- Switch Modules 177
- Disabling Spanning Tree 180
- Configuring the Root Switch 181
- Configuring the Port Priority 183
- Configuring the Path Cost 185
- Configuring the Hello Time 187
- Configuring MSTP 191
- IST, CIST, and CST 192
- Understanding MSTP 193
- Hop Count 194
- Understanding RSTP 195
- Rapid Convergence 196
- Synchronization of Port Roles 197
- Table 10-2 RSTP BPDU Flags 198
- Topology Changes 199
- Configuring MSTP Features 200
- Default MSTP Configuration 201
- MSTP Configuration Guidelines 201
- Understanding Port Fast 214
- Understanding BPDU Guard 215
- Understanding BPDU Filtering 215
- Understanding UplinkFast 216
- Understanding BackboneFast 217
- Blocked port 219
- Understanding Root Guard 220
- Understanding Loop Guard 221
- Enabling Port Fast 222
- Enabling BPDU Guard 223
- Enabling BPDU Filtering 224
- Enabling BackboneFast 226
- Enabling EtherChannel Guard 227
- Enabling Root Guard 227
- Enabling Loop Guard 228
- Configuring VLANs 231
- Supported VLANs 232
- VLAN Port Membership Modes 233
- Token Ring VLANs 235
- Saving VLAN Configuration 237
- Deleting a VLAN 240
- Default VLAN Configuration 242
- Displaying VLANs 243
- Trunking Overview 244
- Configuring VLAN Trunks 245
- Configuring a Trunk Port 248
- Load Sharing Using STP 252
- Configuring VMPS 255
- Understanding VMPS 256
- Dynamic Port VLAN Membership 256
- VMPS Configuration Guidelines 257
- Configuring the VMPS Client 258
- Reconfirming VLAN Memberships 259
- Changing the Retry Count 260
- Monitoring the VMPS 260
- VMPS Configuration Example 261
- Switch 3 262
- Switch 2 262
- Switch 1 262
- Configuring VTP 263
- The VTP Domain 264
- VTP Modes 265
- VTP Advertisements 265
- VTP Version 2 266
- VTP Pruning 266
- Understanding VTP 267
- Default VTP Configuration 268
- VTP Configuration Options 269
- VTP Configuration Guidelines 270
- Domain Names 270
- Passwords 270
- VTP Version 270
- Configuration Requirements 271
- Configuring a VTP Server 271
- Configuring a VTP Client 272
- Enabling VTP Version 2 274
- Enabling VTP Pruning 275
- Monitoring VTP 277
- IGMP Versions 280
- Joining a Multicast Group 281
- Understanding IGMP Snooping 282
- Leaving a Multicast Group 283
- Immediate-Leave Processing 284
- IGMP Report Suppression 284
- Source-Only Networks 285
- Configuring IGMP Snooping 286
- Setting the Snooping Method 287
- Configuring the Aging Time 292
- Configuring MVR 295
- Default MVR Configuration 296
- Configuring MVR Interfaces 298
- Displaying MVR Information 299
- Configuring IGMP Profiles 301
- Applying IGMP Profiles 302
- Understanding Storm Control 307
- Configuring Storm Control 308
- Configuring Protected Ports 309
- Understanding Port Security 310
- Secure MAC Addresses 311
- Security Violations 311
- Configuring Port Security 314
- Modes of Operation 319
- Understanding UDLD 320
- Default UDLD Configuration 322
- Enabling UDLD Globally 323
- Enabling UDLD on an Interface 324
- Displaying UDLD Status 325
- Configuring CDP 327
- Default CDP Configuration 328
- Disabling and Enabling CDP 329
- Configuring SPAN and RSPAN 333
- Understanding SPAN and RSPAN 334
- SPAN Session 335
- Traffic Types 335
- Source Port 336
- Destination Port 336
- Reflector Port 337
- SPAN Traffic 337
- SPAN and RSPAN Session Limits 339
- SPAN Configuration Guidelines 339
- Configuring SPAN 340
- Configuring RSPAN 344
- EXEC command 349
- Configuring RMON 351
- Default RMON Configuration 353
- Displaying RMON Status 356
- System Log Message Format 358
- Synchronizing Log Messages 362
- Configuring SNMP 369
- SNMP Versions 370
- SNMP Manager Functions 371
- SNMP Agent Functions 371
- SNMP Community Strings 372
- SNMP Notifications 372
- Default SNMP Configuration 373
- SNMP Configuration Guidelines 374
- Disabling the SNMP Agent 374
- Configuring Community Strings 375
- SNMP Examples 382
- Displaying SNMP Status 383
- Understanding ACLs 386
- Server A (R&D) 387
- Server B (R&D) 387
- Server C (HR) 387
- Unsupported Features 390
- ACL Numbers 391
- Configuring ACLs 392
- Layer 4 Parameters 394
- Applying Time Ranges to ACLs 398
- Creating MAC Access Groups 402
- Displaying ACLs 404
- Displaying Access Groups 405
- Cisco router 406
- Workstation 406
- Internet 406
- Numbered ACL Examples 407
- Extended ACL Examples 407
- Named ACL Example 407
- Configuring QoS 409
- Understanding QoS 410
- Basic QoS Model 411
- Classification 412
- Policing and Marking 414
- Mapping Tables 415
- Queueing and Scheduling 415
- How Class of Service Works 415
- Port Priority 415
- Port Scheduling 416
- Egress CoS Queues 416
- Configuring Auto-QoS 417
- Enabling Auto-QoS for VoIP 420
- • show mls qos 421
- • show mls qos map cos-dscp 421
- • show wrr-queue bandwidth 421
- • show wrr-queue cos-map 421
- Configuring Standard QoS 425
- Configuring Trusted Boundary 428
- Enabling Pass-Through Mode 430
- Configuring a QoS Policy 431
- Configuring CoS Maps 439
- Configuring the Egress Queues 442
- Configuring WRR Priority 443
- Failover 449
- Understanding EtherChannels 450
- Channel-group 451
- Physical ports 451
- PAgP and LACP Modes 452
- Exchanging PAgP Packets 452
- Exchanging LACP Packets 453
- EtherChannel On Mode 454
- BladeCenter 455
- EtherChannel 455
- Configuring EtherChannels 456
- Configuring Hot Standby Ports 461
- Troubleshooting 467
- Using Ping 474
- Understanding Ping 474
- Executing Ping 474
- Using Layer 2 Traceroute 475
- Usage Guidelines 475
- Displaying the Physical Path 476
- Using Debug Commands 477
- Switch# debug all 478
- Using the crashinfo File 479
- Supported MIBs 481
- MIB List 482
- APPENDIX 485
- Copying Files 489
- Deleting Files 490
- Creating a tar File 490
- Extracting a tar File 491
- Working with Software Images 503
- Image Location on the Switch 504
- Before You Call 517
- Using the Documentation 518
- Software Service and Support 518
- Hardware Service and Support 518
- Edition Notice 520
- Trademarks 520
- Appendix D Notices 521
- Numerics 523
Longshine LCS-844MT Handbücher
Bedienungsanleitungen und Benutzerhandbücher für Ausrüstung Longshine LCS-844MT.
Wir stellen 1 PDF-Handbücher Longshine LCS-844MT zum kostenlosen herunterladen nach Dokumenttypen zur Verfügung Bedienungsanleitung
Commentaires sur ces manuels