Cisco NETCONF and RESTCONF Service-Level ACLs User Guide PDF (EN)

Configuring an ACL for a NETCONF-YANG Session

NETCONF and RESTCONF Service-Level ACLs This module describes the service-levels ACLs supported on NETCONF and RESTCONF, and how to configure it.

Information About NETCONF and RESTCONF Service-Level ACLs, on page 1 How to Configure NETCONF and RESTCONF Service-Level ACLs, on page 1 Configuration Examples for NETCONF and RESTCONF Service-Level ACLs, on page 4 Additional References for NETCONF and RESTCONF Service-Level ACLs, on page 5 Feature Information for NETCONF and RESTCONF Service-Level ACLs, on page 6 InformationAboutNETCONFandRESTCONFService-LevelACLs Overview of NETCONF and RESTCONF Service-Level ACLs You can configure an IPv4 or IPv6 access control list (ACL) for NETCONF and RESTCONF sessions. Clients that do not conform to the configured ACLs are not allowed to access the NETCONF or RESTCONF subsystems.

When service-level ACLs are configured, NETCONF-YANG and RESTCONF connection requests are filtered based on the source IP address. If no service-level ACLs are configured, all NETCONF-YANG and RESTCONF connection requests are permitted into the subsystems. ACL logs are not supported on service-level ACLs. Only named ACLs are supported; numbered ACLs are not supported. Note How to Configure NETCONF and RESTCONF Service-Level ACLs Configuring an ACL for a NETCONF-YANG Session You can either configure an IP access-list or an IPv6 access list for your NETCONF-YANG session. NETCONF and RESTCONF Service-Level ACLs 1

Стр. 1

Configuring an ACL for a NETCONF-YANG Session

SUMMARY STEPS 1. enable 2. configure terminal 3. ip access-list { standard | extended } access-list-name ipv6 access-list access-list-name 4. permit { host-address | host-name | any } [ wildcard ] 5. deny { host-address | host-name | any } [ wildcard ] 6. exit 7. netconf-yang ssh {{ ipv4 | ipv6 } access-list name access-list-name } | port port-number } 8. end DETAILED STEPS Procedure NETCONF and RESTCONF Service-Level ACLs Configuring an ACL for a NETCONF-YANG Session Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. • Enter your password if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode.

Step 3 • ip access-list {standard | extended} access-list-name • ipv6 access-list access-list-name Example: Device(config)# ip access-list standard acl1 permit _ Device(config)# ipv6 access-list ipv6-acl1 permit _ • Specifies a standard IP access list and enters standard access-list configuration mode. • Specifies an IPv6 access list and enters IPv6 access-list configuration mode. Step 4 permit {host-address | host-name | any} [wildcard] Example: Device(config-std-nacl)# permit 192.168.255.0 0.0.0.255 Sets conditions in an IP/IPv6 access list that will permit packets. Step 5 deny {host-address | host-name | any} [wildcard] Example:

Device(config-std-nacl)# deny any Sets conditions in an IP or IPv6 access list that will deny packets. Step 6 exit Example: Device(config-std-nacl)# exit Exits standard access-list configuration mode and returns to global configuration mode. NETCONF and RESTCONF Service-Level ACLs 2

Стр. 2

Configuring an ACL for a RESTCONF Session

Configuring an ACL for a RESTCONF Session You can either configure an IP access list or an IPv6 access list for your RESTCONF session. SUMMARY STEPS 1. enable 2. configure terminal 3. ip access-list { standard | extended } access-list-name ipv6 access-list access-list-name 4. permit { protocol-number | ipv6-source-address | ipv6-source-prefix | protocol } any 5. deny { protocol-number | ipv6-source-address | ipv6-source-prefix | protocol } any any 6. exit 7. restconf { ipv4 | ipv6 } access-list name access-list-name 8.

end DETAILED STEPS Procedure NETCONF and RESTCONF Service-Level ACLs Configuring an ACL for a RESTCONF Session Command or Action Purpose Step 7 netconf-yang ssh {{ipv4 | ipv6 }access-list name access-list-name} | port port-number} Example: Device(config)# netconf-yang ssh ipv4 access-list name acl1 permit _ Configures an ACL for the NETCONF-YANG session. Step 8 end Example: Device(config)# end Exits global configuration mode and returns to privileged EXEC mode. Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. • Enter your password if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode.

Step 3 • ip access-list {standard | extended} access-list-name • ipv6 access-list access-list-name Example: • Specifies a standard IP access list and enters standard access-list configuration mode. • Specifes an IPv6 access list and enters IPv6 access list configuration mode. NETCONF and RESTCONF Service-Level ACLs 3

Стр. 3

Example: Configuring an ACL for a NETCONF Session

Configuration Examples for NETCONF and RESTCONF Service-Level ACLs Example:

Configuring an ACL for a NETCONF Session Device# enable Device# configure terminal Device(config)# ip access-list standard acl1_permit Device(config-std-nacl)# permit 192.168.255.0 0.0.0.255 Device(config-std-nacl)# deny any Device(config-std-nacl)# exit Device(config)# netconf-yang ssh ipv4 access-list name acl1_permit Device(config)# end NETCONF and RESTCONF Service-Level ACLs Configuration Examples for NETCONF and RESTCONF Service-Level ACLs Command or Action Purpose Device(config)# ip access-list standard acl1 permit _ Device(config)# ipv6 access-list ipv6-acl1 permit _ Step 4 permit {protocol-number | ipv6-source-address | ipv6-source-prefix | protocol}any Example:

Device(config-ipv6-acl)# permit ipv6 2001:db8::1/32 any Sets conditions in an IPv6 access list that will permit packets. Step 5 deny {protocol-number | ipv6-source-address | ipv6-source-prefix | protocol}any any Example: Device(config-ipv6-acl)# deny ipv6 any any Sets conditions in an IPv6 access list that will deny packets. Step 6 exit Example: Device(config-ipv6-acl)# exit Exits IPv6 access list configuration mode and returns to global configuration mode. Step 7 restconf {ipv4 | ipv6 }access-list name access-list-name Example: Device(config)# restconf ipv6 access-list name ipv6-acl1 permit _ Configures an ACL for the RESTCONF session. Step 8 end Example:

Device(config)# end Exits global configuration mode and returns to privileged EXEC mode. NETCONF and RESTCONF Service-Level ACLs 4

Стр. 4