ELTEX LTP-4X, Operation Manual

Page: 66 / 199

66
Chapter 16.
Configuring Access Control List and policy
Introduction
ACL (Access Control List) – the table which defined filtering rules for incoming traffic according to data
transmitted in the incoming packets: protocols, TCP/UDP ports, IP address or MAC address. The ACL based on
IPv4 and MAC should have different names. You can set one type of the lists per interface. Each access list
contains up to 20 rules.
16.1 Configuring MAC Access List
In a MAC access list, filtering is implemented according to the following criteria and a mask:
Table 16.1 – The list of MAC access list criteria
Criterion Mask Example of a command
Src MAC yes
permit A8:F9:4B:00:00:00 FF:FF:FF:00:00:00 any
Dst MAC yes
permit any A8:F9:4B:00:00:00 FF:FF:FF:00:00:00
Vlan no
permit any any vlan 10
COS yes
permit any any vlan any cos 4 4
Ethertype yes
Permit any any vlan any cos any ethertype 0x0800 0xFF00
Step 1. Create a mac access-list
LTP-8X# switch
LTP-8X(switch)# configure
LTP-8X(switch)(config)# mac access-list extended eltexsrc
Step 2. Configure rules and assign the list to a port
LTP-8X(switch)(config-mac-al)# deny A8:f9:4B:00:AA:00 FF:FF:FF:FF:FF:00 any
LTP-8X(switch)(config-mac-al)# deny any any vlan any cos 7 7
LTP-8X(switch)(config-mac-al)# permit A8:F9:4B:00:00:00 FF:FF:FF:00:00:00 any vlan 2 cos 4 4
LTP-8X(switch)(config-mac-al)# exit
LTP-8X(switch)(config)# interface front-port 7
LTP-8X(switch)(config-if)# service-acl mac eltexsrc
LTP-8X(switch)(config-if)# exit
LTP-8X(switch)(config)# commit
Step 3. Check the list configuration
LTP-8X(switch)# show access-list
Extended MAC access list "eltexsrc"(#0), filters count: 3
Rule 1 (deny):
MAC SA A8:F9:4B:00:AA:00 [FF:FF:FF:FF:FF:00]
Rule 2 (deny):
COS 7 [7]
Rule 3 (permit):