How to configure the ACL of a Cisco switch-filter classic configurations

When creating an ACL on a vswitch, you can use a string or a number to name the ACL. Generally, you can use a string + a number to name the ACL for easy identification; the standard ACL or extended ACL is identified by fields. For example, standard ACL and extended ACL are identified by extended ACL.
The configuration in the following example shows how to create an extended ACL named anti-virus on the vswitch and apply the acl to the in direction of fastEthernet port 0/1: switch # configure terminal www.2cto.com Switch (config) # ip access-list extended anti-virus Switch (config-ext-nacl) # deny tcp any eq 135 Switch (config-ext-nacl) # deny tcp any eq 136 Switch (config-ext-nacl) # deny tcp any eq 137 Switch (config-ext-nacl) # deny tcp any eq 138 Switch (config-ext-nacl) # deny tcp any Y eq 139 Switch (config-ext-nacl) # deny tcp any eq 445 Switch (config-ext-nacl) # deny tcp any eq 593 Switch (config-ext-nacl) # deny tcp any eq 4444 Switch (config-ext-nacl) # deny tcp any eq 5554 Switch (config-ext-nacl) # deny tcp any eq 9995 Switch (config-ext-nacl) # deny tcp any eq 9996 Switch (config-ext-nacl) # deny udp any eq 135 Switch (config-ext-nacl) # deny udp any eq 136 Swi Tch (config-ext-nacl) # deny udp any eq 137 Switch (config-ext-nacl) # deny udp any eq 138 Switch (config-ext-nacl) # deny udp any eq 139 Switch (config-ext-nacl) # deny udp any eq 445 Switch (config-ext-nacl) # deny udp any eq 593 Switch (config-ext-nacl) # deny udp any eq 1434 Switch (config-ext-nacl) # deny udp any eq 4444 Switch (config-ext-nacl) # deny udp any eq 5554 Switch (config-ext -Nacl) # deny udp any eq 9995 Switch (config-ext-nacl) # deny udp any eq 9996 Switch (config-ext-nacl) # permit ip any Switch (config-ext-nacl) # exit www.2cto.com Switch (config) # interface fastEthernet 0/1 Switch (config-if) # ip access-group anti-virus in Switch (config-if) # ^ Z Switch # Note: the end of any extended ACL contains a deny ip any ACE table by default. If you do not want this implicit ACE to take effect, you must manually set an ACE table entry for the permit ip any to pass packets that do not meet all other ACE matching conditions; some of the above ports will be used in some applications, such as TCP/UDP 137 and 138. In this case, we need to remove these ports from the extended ACL.