Allied Telesis AT-9000/28, User Manual

Page: 1033 / 1278

AT-9000 Switch Command Line User’s Guide
Section X: Network Management 1033
necessary when you want a port to forward a subset of packets that
are otherwise discarded.

deny— Discards all ingress packets that match the ACL.

copy-to-mirror— Copies all ingress packets that match the ACL to the
destination port of the mirror port. This action must be used together
with the port mirror feature, explained in Chapter 17, “Port Mirror” on
page 313.
The SRC_IPADDRESS and DST_IPADDRESS parameters specify the
source and destination IP addresses. Choose from the following options:

any — Matches any IP address.

ipaddress/mask — Matches packets that have an IP address of a
subnet or an end node. The mask is a decimal number that represents
the number of bits in the address, from left to right, that constitute the
network portion of the address. For example, the subnet address
149.11.11.0/24 has a mask of “24” for the first twenty-four bits of the
network portion of the address. The IP address and the mask are
separated by a slash (/); for example, “149.11.11.0/24.”

host ipaddress — Matches packets with a specified IP address and is
an alternative to the IPADRESS/MASK variable for addresses of end
nodes. The HOST keyword indicates that the address is of a specific
end node and that no mask is required.
The VLAN parameter determines if an ACLs filters VLANs. You use the
parameter to specify the VID. You can specify one VID per command. If
you omit this parameter, the ACL applies to
all traffic. In other words, no
filtering is done by the ACL based on the VLAN.
In the following example, a Numbered IPv4 ACL is created with an ID
number of 3000, that blocks all untagged ingress ICMP packets with a
destination address in the 192.168.1.10/24 subnet:
Table 113. Numbered IPv4 ACL with ICMP Packets Example
Command Description
awplus> enable
Enter the Privileged Executive mode
from the User Executive mode.
awplus# configure terminal
Enter the Global Configuration mode.
awplus(config)# access-list 3000 deny icmp
host 192.168.1.10 any
Creates a Numbered IPv4 ACL with an
ID of 3000 that denies ICMP packets
from the host source address of
192.168.1.10.