[c-nsp] vs addrgroup and access-lists on vss software

[Mackinnon, Ian]

Not tried it on a vss, but have used it on plain 6500.

Works a treat, don't forget the "expand" option to a show ip access-list
to see whats going on

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/con
figuration/guide/acl.html

Router(config)# object-group ip address myAG
Router(config-ipaddr-pgroup)# host 10.20.20.1 
Router(config-ipaddr-pgroup)# host 10.20.20.5 
Router(config-ipaddr-pgroup)# 10.30.0.0 255.255.0.0 
Router(config)# object-group ip port myPG
Router(config-port-pgroup)# eq 100 
Router(config-port-pgroup)# gt 200 
Router(config-port-pgroup)# neq 300 
Router(config)# ip access-list extended my-pbacl-policy
Router(config-ext-nacl)# permit tcp addrgroup myAG portgroup myPG any
Router(config-ext-nacl)# deny tcp any any
Router(config-ext-nacl)# exit
Router(config)# exit
Router# show ip access-list my-pbacl-policy
Extended IP access list my-pbacl-policy
10	permit tcp addrgroup AG portgroup PG any
20	permit tcp any any

Router# show ip access-list my-pbacl-policy expand
Extended IP access list my-pbacl-policy expanded
20 permit tcp host 10.20.20.1 eq 100 any
20 permit tcp host 10.20.20.1 gt 200 any
20 permit tcp host 10.20.20.1 neq 300 any
20 permit tcp host 10.20.20.5 eq 100 any
20 permit tcp host 10.20.20.5 gt 200 any
20 permit tcp host 10.20.20.5 neq 300 any
20 permit tcp 10.30.0.0 255.255.0.0 eq 100 any
20 permit tcp 10.30.0.0 255.255.0.0 gt 200 any
20 permit tcp 10.30.0.0 255.255.0.0 neq 300 any


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Arne Larsen / Region Nordjylland
> Sent: 01 June 2010 09:43
> To: 'cisco-nsp at puck.nether.net'
> Subject: [c-nsp] vs addrgroup and access-lists on vss software
> 
> Hi All.
> 
> I'm trying to use addrgroup in access-list on a vss setup, but I can't
> seem to get it working.
> If I setup an statement in a access-list it just ignores it.
> Has someone any doc. about this.
> 
> /Arne
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


_______________________________________________________

Atos Origin and Atos Consulting are trading names used by the Atos Origin group.  The following trading entities are registered in England and Wales:  Atos Origin IT Services UK Limited (registered number 01245534) and Atos Consulting Limited (registered number 04312380).  The registered office for each is at 4 Triton Square, Regents Place, London, NW1 3HG.The VAT No. for each is: GB232327983

This e-mail and the documents attached are confidential and intended solely for the addressee, and may contain confidential or privileged information.  If you receive this e-mail in error, you are not authorised to copy, disclose, use or retain it.  Please notify the sender immediately and delete this email from your systems.   As emails may be intercepted, amended or lost, they are not secure.  Atos Origin therefore can accept no liability for any errors or their content.  Although Atos Origin endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted.   The risks are deemed to be accepted by everyone who communicates with Atos Origin by email. 
_______________________________________________________