この製品のマニュアルセットは、偏向のない言語を使用するように配慮されています。このマニュアルセットでの偏向のない言語とは、年齢、障害、性別、人種的アイデンティティ、民族的アイデンティティ、性的指向、社会経済的地位、およびインターセクショナリティに基づく差別を意味しない言語として定義されています。製品ソフトウェアのユーザーインターフェイスにハードコードされている言語、RFP のドキュメントに基づいて使用されている言語、または参照されているサードパーティ製品で使用されている言語によりドキュメントに例外が存在する場合があります。シスコのインクルーシブランゲージに対する取り組みの詳細は、こちらをご覧ください。
このドキュメントは、米国シスコ発行ドキュメントの参考和訳です。リンク情報につきましては、日本語版掲載時点で、英語版にアップデートがあり、リンク先のページが移動/変更されている場合がありますことをご了承ください。あくまでも参考和訳となりますので、正式な内容については米国サイトのドキュメントを参照ください。
This chapter describes how to configure IP access control lists (ACLs) on NX-OS devices. Unless otherwise specified, the term IP ACL refers to IPv4 and IPv6 ACLs.
![]() (注) | Although we fully support IPv6 ACLs, we recommend that you perform thorough validation testing of your IPv6 ACL implementation prior to deploying it in a production environment |
QA test First Level TopicHead Check that this appears in TOC and in Chapter 1 miniTOC
Related Topic | Document Title |
---|---|
Concepts about VACLs | Example Configuration for IP ACLs |
IP ACL commands: complete command syntax, command modes, command history, defaults, usage guidelines, and examples | Cisco NX-OS Security Command Reference |
Object group commands: complete command sytax, command modes, command history, defaults, usage guidelines, and examples | Cisco NX-OS Security Command Reference |
Time range commands: complete command syntax, command modes, command history, defaults, usage guidelines, and examples | Cisco NX-OS Security Command Reference |
Standard/RFC | Title |
---|---|
No New or modified standards are supported by this feature, and support for existing standards has not been modifed by thei feature. | — |
MIB | MIBs Link |
---|---|
This is a test for MIB |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Description | Link |
---|---|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
This is a test for figures.
1.
コマンドまたはアクション | 目的 |
---|
This is an Example
QA Test First Level Topic head II Check that this appears in TOC and in Chapter 1 miniTOC
QA Test: Check that all the links below work in both PDF and html renditions and take you to the correct place
internal xref to table 表 2
internal xref to fig 図 1
Xref to another topic Additional Filtering Options
xref to table in another topic表 1
cross chapter xref to table 表 1
cross chapter xref to topicLicensing Requirements for AAA
Rules are what you create, modify, and remove when you configure how an ACL filters network traffic. Rules appear in the running configuration. When you apply an ACL to an interface or change a rule within an ACL that is already applied to an interface, the supervisor module creates ACL entries from the rules in the running configuration and sends those ACL entries to the applicable I/O module. Depending upon how you configure the ACL, there may be more ACL entries than rules, especially if you use object groups when you configure rules. For more information, see the
You can create rules in ACLs and tYou can create rules in access-list configuration mode by using the permit or deny command. The device allows traffic that matches the criteria in a permit rule and blocks trafic that matches the criteria in a deny rule. You have many options for configuring the criteria that traffic must meet in order to match the rule
Product | License Requirement |
---|---|
NX-OS | AAA requires no license.Cisco Unified MeetingPlace Any feature not included in a license package is bundled with the Cisco NX-OS system images and is Cisco Unified MeetingPlaceprovided at no extra charge to you. For a complete explanation of the NX-OS licensing scheme, see the Cisco NX-OS Licensing Guide, Release 4.0.Cisco Unified IP Phone |
QA Test: The index link should be generated on the fifth level and the second level because the second level is the last indexterm on the policy based ACLs topic. Go to the index and look at the first index - fifth index.
This section describes some of the options that you can use when you configure a rule. For information about every option, see the applicable permit and deny commands in the Cisco NX-OS Security Command Reference
QA Test: CSCsx53724 In the next paragraph, there should be no space after the text "Cisco Unified MeetingPlace" and the period that follows it.
This is Cisco Unified MeetingPlace.
QA Test : CSCsz10127 This is a xref to a step, it should render in both HTML and PDF2
table head | Desc |
---|---|
this is a table | for xref |
QA Test: CSCtd75733. Check that the following double bytesmart quotes appear while rendering: “smart quotes”. Edit ths topic ( c_About_Rules.xml) and see the the double byte smart quotes appear correctly. Export this topic and see if the double byte smart quotes are still in tact.
This is a simple table | blah blah blach | ||||
QA Test CSCte43613: Test that the note below appears correctly
|
|
You can identify traffic by using additional options. These options differ by ACL type. The following list includes most but not all additional filtering options:
IPv4 ACLs support the following additional filtering options:
IPv6 ACLs support the following additional filtering options:
Layer 4 protocol
Authentication Header Protocol
Encapsulating Security Payload
Payload Compression Protocol
Stream Control Transmission Protocol (SCTP)
SCTP, TCP, and UDP ports
ICMP types and codes
IGMP types
Flow label
DSCP value
TCP packets with the ACK, FIN, PSH, RST, SYN, or URG bit set
Established TCP connections
MAC ACLs support the following additional filtering options:
For information about all filtering options available in rules, see the applicablepermitanddenycommands in the Cisco NX-OS Security Command References
The device supports policy-based ACLs (PBACLs), which allow you to apply access control policies across object groups. An object group is a group of IP addresses or a group of TCP or UDP ports. When you create a rule, you specify the object groups rather than specifying IP addresses or ports.
uicontrolUsing object groups when you configure IPv4 or IPv6 ACLs can help of updating to add or remove addresses or ports from the source or destination of rules. For example, if three rules reference the same IP address group object,rules
QA: Testing font for <ph> elementPBACLs do not reduce the resources required by an ACL when you apply it to an interface. When you apply a PBACL or update a PBACL that is already applied, italicsthe device expands each rule that refers to object groups into one ACL entry per object within the group. If a rule specifies the source and destination both with object groups, the number of ACL entries created on the I/O module when you apply the PBACL is equal to the number of objects in the source group multiplied by the number of objects in the destination groupQA Test: This <b> should render in bold
QA Test: Check that the following emdash renders— permit or deny command to configure a rule, the addrgroupkeyword allows you to specify an object group for the source or destination
italicsThis Figure shows the IPv4 ACL content
QA Test: CSCsx68329:Check that the Second level bullets looks different from first level bullets
This section includes the following topics:
Using object groups when you configure IPv4 or IPv6 ACLs can help reduce the complexity of updating ACLs when you need to add or remove addresses or ports from the source or destination of rules. For example, if three rules reference the same IP address group object, you can add an IP address to the object instead of changing all three rules
PBACLs do not reduce the resources required by an ACL when you apply it to an interface. When you apply a PBACL or update a PBACL that is already applied, the device expands each rule that refers to object groups into one ACL entry per object within the group. If a rule specifies the source and destination both with object groups, the number of ACL entries created on the I/O module when you apply the PBACL is equal to the number of objects in the source group multiplied by the number of objects in the destination group
https://ciscoshare.cisco.com/alfext/ui/#/library/b6b987cb-05ec-4b2e-87fe-87b1108ed944
To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.
Product | License Requirement |
---|---|
NX-OS | AAA requires no license. Any feature not included in a license package is bundled with the Cisco NX-OS system images and is provided at no extra charge to you. For a complete explanation of the NX-OS licensing scheme, see the Cisco NX-OS Licensing Guide, Release 4.0. |
Description | Link |
---|---|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
You can apply an IPv4 or IPv6 ACL to a Layer 2 interface, which can be a physical port or a port channel. ACLs applied to these interface types are considered port ACLs.
You can apply an IPv4 or IPv6 ACL to a Layer 2 interface, which can be a physical port or a port channel. ACLs applied to these interface types are considered port ACLs.
CSCsw89155 The following procedure should render without any summary steps when rendering a topic. When rendering the whole book, it may show. There is a different cdets case open to track that
Ensure that the ACL you want to apply exists and that it is configured to filter traffic in the manner that you need for this application. For more information, see the or the
To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.
You can create an IPv4 ACL or IPv6 ACL on the device and add rules to it.
Ensure that you are in the correct VDC (or use the switchto vdc command). Because ACL names can be repeated in different VDCs, we recommend that you confirm which VDC you are working in.
1.
(任意) config t
2.
ipipv6access-listname
3.
sequence-numberpermitdenyprotocolsourcedestination
4.
statistics per-entry
5.
show ip access-listsname
6.
copy running-config startup-config
7. <b> inside <codeblock> should render in yellow highlights
ステップ 1 | (任意)config t
例: switch# config t switch(config)#. Enters global configuration mode. |
ステップ 2 | ipipv6access-listname
例: switch(config)# ip access-list acl-01 switch(config-acl)# Creates the IP ACL and enters IP ACL configuration mode. The name argument can be up to 64 characters. |
ステップ 3 | sequence-numberpermitdenyprotocolsourcedestination
例: switch(config-acl)# permit ip 192.168.2.0/24 any Creates a rule in the IP ACL. You can create many rules. The sequence-number argument can be a whole number between 1 and 4294967295. Thepermitanddenycommands support many ways of identifying traffic. For more information, see the Cisco NX-OS Security Command Reference |
ステップ 4 | statistics per-entry
例: switch(config-acl)# statistics per-entry Specifies that the device maintains global statistics for packets that match the rules in the ACL. |
ステップ 5 | show ip access-listsname
例: switch(config-acl)# show ip access-lists acl-01 Displays the IP ACL configuration. |
ステップ 6 | copy running-config startup-config
例: switch(config-acl)# copy running-config startup-config Copies the running configuration to the startup configuration. |
ステップ 7 | <b> inside <codeblock> should render in yellow highlights
例: QA Test: This bold should render in yellow highlights |
You can change, reorder, add, and remove rules in an existing IPv4 or IPv6 ACL. You cannot change existing rules. Instead, to change a rule, you can remove it and recreate it with the desired changes.QA Test: This text should render in italics
QA Test: check that this cmdName is rendered in bold command to reassign sequence numbers. For more information, see the .QA Test: Check that this <uicontrol is rendered in bold
Ensure that you are in the correct VDC (or use the switchto vdc command). Because ACL names can be repeated in different VDCs, we recommend that you confirm which VDC you are working in.
1. uicontrolQA Test: This cmd should render in regular fontsQA Test: Check that this wd is rendered in bold
2.
ip|ipv6 access-list name
3.
sequence-number permit|deny protocol source destination
4.
no {sequence-number} {permit|deny} protocol source destination
5.
[no] statistics per-entry
6.
show ip access-lists name
7.
copy running-config startup-config
ステップ 1 | uicontrolQA Test: This cmd should render in regular fontsQA Test: Check that this wd is rendered in bold 例: switch# config t switch(config)#Enters global configuration mode. uicontrol font |
ステップ 2 | ip|ipv6 access-list name 例: switch(config)# ip access-list acl-01 switch(config-acl)#Enters IP ACL configuration mode for the ACL that you specify by name. |
ステップ 3 | sequence-number permit|deny protocol source destination 例: switch(config-acl)# 100 permit ip 192.168.2.0/24 anyCreates a rule in the IP ACL. Using a sequence number allows you to specify a position for the rule in the ACL. Without a sequence number, the rule is added to the end of the rules. The sequence-number argument can be a whole number between 1 and 4294967295. The permit and deny commands support many ways of identifying traffic. italicsFor more information, see the QA: Check this is font for <cite>QA Test: Check this cite is rendered in italics |
ステップ 4 | no {sequence-number} {permit|deny} protocol source destination 例:switch (config-acl) # no 80 Removes the rule that you specified from the IP ACL. |
ステップ 5 | [no] statistics per-entry 例: switch (config-acl) # statistics per-entrySpecifies that the device maintains global statistics for packets that match the rules in the ACL. The nouicontrol option stops the device from maintaining global statistics for the ACL. |
ステップ 6 | show ip access-lists name 例: switch (config-acl)# show ip access-lists acl-01Displays the IP ACL configuration. |
ステップ 7 | copy running-config startup-config 例: switch (config-acl) # copy running-config startup-configCopies the running configuration to the startup configuration. |
You can apply an IP ACL as a VACL. For information about how to create a VACL using an IPv4 or IPv6 ACL, see the “Creating or Changing a VACL” section on page 12-3.
When the device processes a packet, it determines the forwarding path of the packet. The path determines which ACLs that the device applies to the traffic. The device applies the ACLs in the following order:
If the packet is bridged within the ingress VLAN, the device does not apply router ACLs.
The Following fgure shows the order in which the device applies ACLS.
The following figure shows where the device applies ACLs, depending upon the type of ACL. The red path indicates a packet sent to a destination on a different interface than its source. The blue path indicates a packet that is bridged within its VLAN.
Second level topichead
An ACL is an ordered set of rules that you can use to filter traffic. Each rule specifies a set of conditions that a packet must satisfy to match the rule. When the device determines that an ACL applies to a packet, it tests the packet against the conditions of all rules. The first matching rule determines whether the packet is permitted or denied. If there is no match, the device applies the applicable default rule. The device continues processing packets that are permitted and drops packets that are denied. For more information, see the Order of ACL Application with Figures
Error Message QA test: CSCsx38952 This should render in courier fonts with heading "Error Message"
Explanation QA Test: This should render in regular fonts with heading "Explanation"
Recommended Action QA Test: This should render in regular fonts with Heading"Recommended Action"
The following example shows how to create an IPv4 ACL named acl-01 and apply it as a port ACL to Ethernet interface 2/1, which is a Layer 2 interface:
ipv6 access-list acl-120 permit tcp 2001:0db8:85a3::/48 2001:0db8:be03:2112::/64 permit udp 2001:0db8:85a3::/48 2001:0db8:be03:2112::/64 permit tcp 2001:0db8:69f2::/48 2001:0db8:be03:2112::/64 permit udp 2001:0db8:69f2::/48 2001:0db8:be03:2112::/64 interface ethernet 2/3 ipv6 traffic-filter acl-120 in
The following example shows how to create an IPv4 ACL named acl-01 and apply it as a port ACL to Ethernet interface 2/1, which is a Layer 2 interface:
ipv6 access-list acl-120 permit tcp 2001:0db8:85a3::/48 2001:0db8:be03:2112::/64 permit udp 2001:0db8:85a3::/48 2001:0db8:be03:2112::/64 permit tcp 2001:0db8:69f2::/48 2001:0db8:be03:2112::/64 permit udp 2001:0db8:69f2::/48 2001:0db8:be03:2112::/64 interface ethernet 2/3 ipv6 traffic-filter acl-120 in
ipv6 access-list acl-120 permit tcp 2001:0db8:85a3::/48 2001:0db8:be03:2112::/64 permit udp 2001:0db8:85a3::/48 2001:0db8:be03:2112::/64 permit tcp 2001:0db8:69f2::/48 2001:0db8:be03:2112::/64 permit udp 2001:0db8:69f2::/48 2001:0db8:be03:2112::/64 interface ethernet 2/3 ipv6 traffic-filter acl-120 in
heading | heading | heading |
---|---|---|
content | content | content |
content | content | content |
Feature Name | Releases | Feature Information |
---|---|---|
statistics | 4.0(3) | The Name of the statistics command was changed to statistics bug entry |
QA Test: This Feature History table should render as a wide table in PDF |
Feature Name | Releases | Feature Information |
---|---|---|
statistics | 4.0(3) | The Name of the statistics command was changed to statistics bug entry |
QA Test: This Feature Information table should render as a wide table in PDF |