D-Link DAS-3636, Cli Reference Manual

Page: 402 / 480

DAS-3600 Series Ethernet over VDSL Switch CLI Reference Manual
Command Parameters
config access_profile config access_profile [profile_id <value 1-1024> | profile_name <name 1-32>]
[ add access_id [ auto_assign | <value 1-1024> ][ethernet {[vlan <vlan_name 32>|vlan_id
<value 1-4094>]
{mask <hex 0x0-0x0fff>}|source_mac <macaddr> {mask <macmask>}|destination_mac
<macaddr> {mask <macmask>}
|802.1p <value 0-7>|ethernet_type <hex 0x0-0xffff>}(1)|ipv4{[vlan <vlan_name 32>|vlan_id
<value 1-4094>]
{mask <hex 0x0-0x0fff>}|source_ip <ipaddr> {mask <netmask>}|destination_ip <ipaddr>
{mask <netmask>}
|dscp <value 0-63>|[icmp {type <value 0-255>|code <value 0-255>}|igmp {type <value 0-
255>}
|tcp {src_port <value 0-65535> {mask <hex 0x0-0xffff>}|dst_port <value 0-65535>
{mask <hex 0x0-0xffff>}|urg|ack|psh|rst|syn|fin}|udp {src_port <value 0-65535> {mask <hex
0x0-0xffff>}
|dst_port <value 0-65535> {mask <hex 0x0-0xffff>}}|protocol_id <value 0-255>
{user_define <hex 0x0-0xffffffff>
{mask <hex 0x0-0xffffffff>}}]}(1)|packet_content {destination_mac <macaddr> {mask
<macmask>}
| source_mac <macaddr> {mask <macmask>} | outer_tag <hex 0x0-0x0fff> {mask <hex
0x0-0x0fff>}
| offset1 <hex 0x0-0xff> {mask <hex 0x0-0xff>} | offset2 <hex 0x0-0xff> {mask <hex 0x0-
0xff>}
| offset3 <hex 0x0-0xff> {mask <hex 0x0-0xff>} | offset4 <hex 0x0-0xff> {mask <hex 0x0-
0xff>}
| offset5 <hex 0x0-0xff> {mask <hex 0x0-0xff>} | offset6 <hex 0x0-0xff> {mask <hex 0x0-
0xff>}}(1)
|ipv6 { class <value 0-255>| flowlabel <hex 0x0-0xfffff> | source_ipv6 <ipv6addr> {mask
<ipv6mask>}
| destination_ipv6 <ipv6addr> {mask <ipv6mask>} | [ tcp { src_port <value 0-65535>
{mask <hex 0x0-0xffff>}
| dst_port <value 0-65535> {mask <hex 0x0-0xffff>} } | udp { src_port <value 0-65535>
{mask <hex 0x0-0xffff>}
| dst_port <value 0-65535> {mask <hex 0x0-0xffff>} } ]}(1)] [port [<portlist>|all] | vlanbased
[vlan_name <vlan_name>
| vlan_id <value 1-4094>] ] [permit {priority <value 0-7> {replace_priority} |rx_rate
[no_limit|<value 1-15624>]
|replace_dscp_with <value 0-63>} |mirror |deny] {time_range <range_name 32>}|delete
access_id <value 1-1024> ]
show access_profile {profile_id <value 1-12>| profile_name <name 1-32 >}
show time_range
show current_config
access_profile
Access profiles allow users to establish criteria to determine whether or not the Switch will forward packets based on the
information contained in each packet’s header.
Creating an access profile is divided into two basic parts. First, an access profile must be created using the create access_profile
command. For example, if users want to deny all traffic to the subnet 10.42.73.0 to 10.42.73.255, users must first create an
access profile that instructs the Switch to examine all of the relevant fields of each frame.
First create an access profile that uses IP addresses as the criteria for examination:
create access_profile profile_id 1 profile_name 1 ip source_ip_mask 255.255.255.0
Here we have created an access profile that will examine the IP field of each frame received by the Switch. Each source IP address
the Switch finds will be combined with the
source_ip_mask with a logical AND operation. The profile_id parameter is used to
give the access profile an identifying number
−
in this case, 1 – and it is used to assign a priority in case a conflict occurs. The
profile_id establishes a priority within the list of profiles. A lower profile_id gives the rule a higher priority. In case of a conflict
in the rules entered for different profiles, the rule with the highest priority (lowest profile_id) will take precedence. See below for
information regarding limitations on access profiles and access rules.
397