Cisco 4700M Configuration Manual page 63

Chapter 1 Configuring Security Access Control Lists
ACL Configuration Examples
For example, suppose that you want to apply an ACL to the inbound direction of
the interface. You configure the ACE to perform NAT on the inside source
addresses when they access outside addresses. Because the ACL is applied to the
inside interface, the source addresses are the original untranslated addresses.
Because the outside addresses are not translated, the destination address used in
the ACL is the real address (see Figure 1-3).
Figure 1-3 IP Addresses in ACLs: NAT Used for Source Addresses
209.165.200.225
Outside
ACE
Inside
Inbound ACL
Permit from 10.1.1.0/24 to 209.165.200.225
10.1.1.0/24
10.1.1.0/24 209.165.201.4:port
PAT
The following commands create an ACL that allows inside source network
10.1.1.0/24 to access the outside destination host 209.165.200.225 and apply the
ACL to VLAN interface 100:
host1/Admin(config)# access-list INSIDE extended permit ip 10.1.1.0
255.255.255.0 host 209.165.200.225
host1/Admin(config)# interface vlan 100
host1/Admin(config-if)# access-group input INSIDE
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
1-39
OL-16202-01