Cisco Catalyst 6500 Series Configuration Manual page 189

Chapter 10 Controlling Network Access with Access Control Lists
Access Control List Overview
If you want to allow an outside host to access an inside host, you can apply an inbound ACL on the
outside interface. You need to specify the translated address of the inside host in the ACL because that
address is the address that can be used on the outside network. (See Figure 10-2.)
Figure 10-2 IP Addresses in ACLs: NAT used for Destination Addresses
209.165.200.225
ACL
Permit from 209.165.200.225 to 209.165.201.5
Outside
Inside
10.1.1.34 209.165.201.5
Static NAT
See the following commands for this example:
FWSM/contexta(config)# access-list OUTSIDE extended permit ip host 209.165.200.225 host
209.165.201.5
FWSM/contexta(config)# access-group OUTSIDE in interface outside
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
10-9
OL-6392-01