
Chapter 56 ACL Commands
IES-612-51 User’s Guide
370
The following is a list of the ACL commands.
Table 150 ACL Commands
COMMAND DESCRIPTION P
switch acl profile set <name>
<rule> <action>
Configures an ACL rule to classify the upstream traffic and perform
action(s) on the classified traffic.
Here are the criteria you can configure for rules in ACL profiles.
The rules are listed in sequence from highest priority to lowest
priority. The criteria within a rule are position-independent.
etype <etype> vlan <vlan-id>
etype <etype> smac <mac-address>
etype <etype> dmac <mac-address>
vlan <vlan-id> smac <mac-address>
vlan <vlan-id> dmac <mac-address>
smac <mac-address> dmac <mac-address>
vlan <vlan-id> priority <priority>
etype <etype>
vlan <vlan-id>
smac <mac-address>
dmac <mac-address>
priority <priority>
protocol <protocol>
srcip <ip-address>/<mask-bits> [dstip <ip-
address>/<mask-bits> [tos <tos> [srcport <sport>
<eport> [dstport <sport> <eport>]]]]
where
etype <etype> = Ethernet type (0~65535
).
vlan <vlan-id> = VLAN ID (1~4094).
smac <mac-address> = Source MAC address.
dmac <mac-address> = Destination MAC address.
priority <priority> = Priority (0 ~ 7)
protocol <protocol> = Protocol type: tcp, udp, ospf, igmp,
ip, gre, icmp or user specified IP protocol number <0 ~ 255>.
srcip <ip-address>/<mask-bits> = Source IP address and
subnet mask (0~32).
dstip <ip-address>/<mask-bits> = Destination IP address
and subnet mask (0~32).
tos <stos> <etos> = Sets the ToS (Type of Service) range
between 0 and 255.
srcport <sport> <eport> = Source port range (0~65535).
dstport <sport> <eport> = Destination port range
(0~65535).
The following guidelines apply to classifiers.
You can apply one classifier for a protocol on a port’s PVC.
You cannot create a classifier that contains matching criteria for
layer 2 and layer 3 fields. For example switch acl profile
set test protocol tcp vlan 15 deny is not allowed as
protocol type and VLAN do not belong to the same network layer.
Each type of criteria can only be used once in a classifier. For
example, profile acl set test protocol tcp protocol
udp deny is not allowed. For this example, you need to create a
separate classifier for each protocol and apply them to the same
PVC(s).
M/H
switch acl profile delete
<name>
This command removes the specified ACL profile. You cannot
remove an ACL profile that is currently in use.
M/H
Comentários a estes Manuais