8
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol
header fields, such as source MAC address, destination MAC address, 802.1p priority (VLAN
priority), and link layer protocol type.
Ethernet frame header ACLs identifies Ethernet packets that are sent to the control plane (such as
VTY and local user services), but not those sent to the forwarding plane (such as QoS, firewall, and
debug services).
To configure an Ethernet frame header ACL:
Step
Command
Remarks
1.
Enter system
view.
system-view N/A
2.
Create an
Ethernet frame
header ACL and
enter its view.
acl number
acl-number
[
name
acl-name
]
[
match-order
{
auto
|
config
} ]
By default, no ACL exists.
Ethernet frame header ACLs are numbered in the
range of 4000 to 4999.
You can use the
acl
name
acl-name
command to
enter the view of a named Ethernet frame header
ACL.
3.
Configure a
description for
the Ethernet
frame header
ACL.
description
text
Optional.
By default, an Ethernet frame header ACL has no
ACL description.
4.
Set the rule
numbering step.
step
step-value
Optional.
The default setting is 5.
5.
Create or edit a
rule.
rule
[
rule-id
] {
deny
|
permit
} [
cos
vlan-pri
|
counting
|
dest-mac
dest-address
dest-mask
|
{
lsap
lsap-type
lsap-type-mask
|
type
protocol-type
protocol-type-mask
} |
source-mac
source-address
source-mask
|
time-range
time-range-name
] *
By default
,
an Ethernet frame header ACL does not
contain any rule.
6.
Add or edit a rule
comment.
rule
rule-id
comment
text
Optional.
By default, no rule comments are configured.
7.
Add or edit a rule
range remark.
rule
[
rule-id
]
remark
text
Optional.
By default, no rule range remarks are configured.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL)
has the same properties and content as the source ACL, but not the same ACL number and name.
To successfully copy an ACL, make sure that:
•
The destination ACL number is from the same category as the source ACL number.
•
The source ACL already exists, but the destination ACL does not.
