show ip access-lists name
•
•
show ipv6 access-lists name
7.
(Optional)
copy running-config startup-config
DETAILED STEPS
Purpose
Command or Action
Enters global configuration mode.
configure terminal
Example:
Step 1
switch# configure terminal
switch(config)#
Creates the IP ACL and enters IP ACL configuration mode.
The
name
argument can be up to 64 characters.
Enter one of the following commands:
Step 2
•
ip access-list name
•
ipv6 access-list name
Example:
switch(config)# ip access-list acl-01
switch(config-acl)#
Optimizes fragment handling for noninitial fragments. When
a device applies to traffic an ACL that contains the
(Optional)
fragments
{
permit-all
|
deny-all
}
Example:
Step 3
fragments
command, the
fragments
command only
switch(config-acl)# fragments permit-all
matches noninitial fragments that do not match any explicit
permit
or
deny
commands in the ACL.
Creates a rule in the IP ACL. You can create many rules.
The
sequence-number
argument can be a whole number
between 1 and 4294967295.
[
sequence-number
] {
permit
|
deny
}
protocol
{
source-ip-prefix
|
source-ip-mask
} {
destination-ip-prefix
|
destination-ip-mask
}
Step 4
Example:
The
permit
and
deny
commands support many ways of
identifying traffic.
switch(config-acl)# permit ip 192.168.2.0/24 any
For IPv4 and IPv6 access lists, you can specify a source
and destination IPv4 or IPv6 prefix, which matches only
Example:
switch(config-acl)# 10 permit ipv6 1::1 2::2 3::3
4::4
on the first contiguous bits, or you can specify a source and
destination IPv4 or IPv6 wildcard mask, which matches on
any bit in the address. IPv6 wildcard masks are supported
for Cisco Nexus 9200, 9300-EX, and 9300-FX/FX2/FXP
switches and the Cisco Nexus 9364C switch.
Specifies that the device maintains global statistics for
packets that match the rules in the ACL.
(Optional)
statistics per-entry
Example:
Step 5
switch(config-acl)# statistics per-entry
Displays the IP ACL configuration.
(Optional) Enter one of the following commands:
Step 6
•
show ip access-lists name
•
show ipv6 access-lists name
Example:
switch(config-acl)# show ip access-lists acl-01
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
234
Configuring IP ACLs
Creating an IP ACL
