Configuring use case 2: Bind the TCP RST ACL to an interface

A TCP RST matching ACL has been configured.

Enter global configuration mode.
```
device# configure terminal
```
Create a class map.
```
device(config)# class-map aclFilter
```
The class map is used to classify the traffic; different match conditions, including an ACL, can be used to match the traffic properties.
While in class map mode associate the class map with an ACL.
```
device(config)# match access-group acl1
```
The class map is used to classify the traffic; different match conditions, including an ACL, can be used to match the traffic properties.
Return to privileged EXEC mode.
```
device(config-classmap)# end
```

Verify the class map to ACL association.

device# show running-config class-map aclFilter
 class-map aclFilter
  match access-group acl1
!

Create a policy map with a policer.
```
device(config)# policy-map policyAclFilter
```
A policy map is used to apply policer and QoS attributes to a particular interface.
Associate a class map with the policy map.
```
device(config-policymap)# class aclFilter
```
Each policy map can have different class maps. Each class map in the policy map can be associated to separate policing and QoS parameters.
Populate the class map policer parameters.
```
device(config-policymap-class)# police cir 220000 cbs 50000 eir 36000 ebs 400000
```
CIR and EIR are in increments of 22000 bps.

Return to privileged EXEC mode.

device(config-policymap-class-police)# end

Verify the configuration.

device# show policy-map detail policyAclFilter

Policy-Map policyAclFilter
    Class aclFilter
      Police cir 220000 cbs 50000 eir 36000 ebs 400000

  Bound To:None

Enter interface configuration mode.
```
device(config)# interface ethernet 1/2
```

Bind the policy map to the port.

device(conf-if-eth-1/2)# service-policy in policyAclFilter
2015/04/02-14:13:31, [SSMD-1405], 2511, SW/device | Active | DCE, INFO, device, IPv4 access list
acl1 configured on interface Ethernet 1/2 at Ingress by FbQos_9_11.

Return to privileged exec mode.
```
device(conf-if-eth-1/2)# end 
```

Verify the configuration.

device# show policy-map detail policyAclFilter
Policy-Map policyAclFilter
 Class aclFilter
 Police cir 220000 cbs 50000 eir 36000 ebs 400000
 Bound To: Et 1/2(in)

Save the configuration.

device# copy running-config startup-config

ACL-based protection against TCP RST attacks applied to an interface configuration example

device# configure terminal
device(config)# class-map aclFilter
device(config)# match access-group acl1
device(config-classmap)# end
device# show running-config class-map aclFilter
device(config)# policy-map policyAclFilter
device(config-policymap)# class aclFilter
device(config-policymap-class)# police cir 220000 cbs 50000 eir 36000 ebs 400000
device(config-policymap-class-police)# end
device# show policy-map detail policyAclFilter
device(config)# interface ethernet 1/2
device(conf-if-eth-1/2)# service-policy in policyAclFilter
device(conf-if-eth-1/2)# end 
device# show policy-map detail policyAclFilter
device# copy running-config startup-config