HP E4510-48G, Command Reference Manual

Page: 836 / 1334

14-17
Default Level
2: System level
Parameters
rule-id : Ethernet frame header ACL rule number, in the range 0 to 65534.
deny : Drops matched packets.
permit : Allows matched packets to pass.
cos vlan-pri: Defines an 802.1p priority. The vlan-pri argument can be a number in the range 0 to 7 or
in words, best-effort (0), background (1), spare (2), excellent-effort (3), controlled-load (4), video
(5), voice (6), or network-management (7).
dest-mac dest-addr dest-mask: Specifies a destination MAC address range. The dest-addr and
dest-mask arguments indicate a destination MAC address and mask in xxxx-xxxx-xxxx format.
lsap lsap-code lsap-wildcard: Defines the DSAP and SSAP fields in the LLC encapsulation. The
lsap-code argument is a 16-bit hexadecimal number indicating the frame encapsulation. The
lsap-wildcard argument is a 16-bit hexadecimal number indicating the wildcard of the LSAP code.
Support for this keyword and argument combination depends on the device model.
source-mac sour-addr source-mask: Specifies a source MAC address range. The sour-addr and
sour-mask arguments indicate a source MAC address and mask in xxxx-xxxx-xxxx format.
time-range time-range-name : Specifies the time range in which the rule takes effect. The
time-range-name argument is a case insensitive string of 1 to 32 characters. It must start with an
English letter and cannot be the English word of all to avoid confusion.
type type-code type-wildcard: Defines a link layer protocol. The type-code argument is a 16-bit
hexadecimal number indicating the frame type. It corresponds to the type-code field in Ethernet_II and
Ethernet_SNAP frames. The type-wildcard argument is a 16-bit hexadecimal number indicating the
wildcard. Support for this keyword and argument combination depends on the device model.
Description
Use the rule command to create an Ethernet frame header ACL rule or modify an existing Ethernet
frame header ACL rule.
Use the undo rule command to remove an Ethernet frame header ACL rule.
When defining ACL rules, you do not need to assign them IDs; the system can automatically assign
rule IDs starting with 0 and increasing in certain rule numbering steps. A rule ID thus assigned is the
smallest multiple of the step that is bigger than the current biggest number. For example, if the rule
numbering step is 5 and the current highest rule ID is 28, the next rule will be numbered 30.
Before performing the undo rule command to remove an Ethernet frame header ACL rule, you may
use the display acl command to view the ID of the rule.
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an existing
rule in the ACL.
You can only modify the existing rules of an ACL that uses the match order of config . When modifying
a rule of such an ACL, you may choose to change just some of the settings, in which case the other
settings remain the same.
When the ACL match order is auto , a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.