15-50
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 15 Configuring Access Control
Configuring VACLs
Console> (enable)
set security acl ip IPACL2 redirect 3/1 ip 1.2.3.4 0.0.0.255 host
255.255.255.255 precedence 1 tos min-delay
IPACL2 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
This example shows how to display the contents of the edit buffer:
Console> (enable)
show security acl info IPACL2 editbuffer
set security acl ip IPACL2
-----------------------------------------------------------------
1. deny 172.20.3.2
2. redirect 1.2.3.4
Console> (enable)
Note
For more information about the
show security acl info
command, see the
“Displaying the Contents of a
VACL” section on page 15-54
.
This example shows how to commit the ACEs to NVRAM:
Console> (enable)
commit security acl all
ACL commit in progress.
ACL IPACL2 is committed to hardware.
Console> (enable)
Note
For more information about the
commit security acl all
command, see the
“Committing ACLs” section
on page 15-53
.
Enter the
show security acl info IPACL2
command to verify that the changes were committed. If this
VACL has not been mapped to a VLAN, enter the
set security acl map
command to map it to a VLAN.
Creating an IPX VACL and Adding ACEs
Note
With Supervisor Engine 720 (PFC3A/PFC3B/PFC3BXL) and Supervisor Engine 32
(PFC3B/PFC3BXL), the IPX routing is done through the software and the IPX Cisco IOS ACLs and IPX
VACLs are not supported. You can match the IPX packets using the MAC VACLs. You can enter the
ipx-arpa
keyword to match the IPX ARPA frames. Use 0xffff EtherType to match on the IPX
non-ARPA frames and frames with an EtherType of 0xffff. For information on configuring the MAC
VACLs, see the
“Creating a Non-IP Version 4/Non-IPX VACL (MAC VACL) and Adding ACEs” section
on page 15-52
.
To create a new IPX VACL and add the ACEs, or to add the ACEs to an existing IPX VACL, perform
this task in privileged mode:
Task
Command
Create a new IPX VACL and add
the ACEs, or add the ACEs to an
existing IPX VACL.
set security acl ipx
{
acl_name
} {
permit
|
deny
|
redirect
mod_num/port_num
} {
protocol
} {
src_net
}
[
dest_net.
[
dest_node
] [[
dest_net_mask.
]
dest_node_mask
]]
[
capture
]
[
before
editbuffer_index
modify
editbuffer_index
]
