Allied Telesis AT-9000/28, User Manual

Page: 1030 / 1278

Chapter 67: Advanced Access Control Lists (ACLs)
1030 Section X: Network Management
Note
In the example, the permit ACL is added to the port before the deny
ACL. This is important because packets are compared against the
ACLs in the order in which the ACLs are added to the port. If the
deny ACL is added first, the port blocks all traffic, even the traffic
specified by the permit ACL.
For another example of permit ACLs, see Table 111. In this example,
ports 21 and 22 forward traffic from three specified network devices and
discard all other ingress traffic. The allowed traffic is specified with three
permit ACLs.
Note
The permit ACLS are added to the ports before the deny ACL to
ensure that packets are compared against them first.
Table 110. Creating a Permit ACL Followed by a Deny ACL Example
Command
Description
awplus> enable
Enter the Privileged Executive mode
from the User Executive mode.
awplus# configure terminal
Enter the Global Configuration mode.
awplus(config)
#
access-list 3015 permit ip
149.55.65.0/24 any
Create the permit ACL with the
ACCESS-LIST command.
awplus(config)
#
access-list 3011 deny ip
any any
Create the deny ACL.
awplus(config)
#
interface port1.0.15
Move to the Port Interface mode for
port 15.
awplus(config_if)
#
access-group 3015
awplus(config_if)
#
access-group 3011
Add the two ACLs to the port with the
ACCESS-GROUP command, being
sure to add the permit ACL first so
that ingress packets are compared
against it first.
awplus(config_if)
#
end
Return to the Privileged Exec mode.
awplus# show access-list
Confirm the configuration of the
ACLs.
awplus# show interface port1.0.15 access-
group
Confirm that the ACLs has been
added to the port.