QTECH
Software Configuration Manual
13-177
time-range-name ]
Define the matching order of ACL :
access-list
access-list-number
match-order
{ config | auto }
Delete all the subitems or one subitem in one ACL with number ID or name ID or all ACLs.
no access-list
{ all | {
access-list-number
|
name
access-list-name
} [
subitem
] }
Use access-list command repeatedly to define more rules for the same ACL.
The number ID of layer 2 ACL is in the range of 200 to 299.
Interface parameter in above command specifies layer 2 interface, such as Ethernet interface. Concrete
parameter meaning refers to corresponded command line.
13.3.5.2
Define layer 2 ACL with name ID.
Defining layer 2 ACL with name ID should enter specified configuration mode : use access-list link in
global configuration mode which can specify matching order of ACL. Use exit command to be back from this mode.
Enter layer 2 ACL with name ID configuration mode(global configuration mode)
access-list
link
name
[
match-order
{ config | auto } ]
Defining layer 2 ACL rule(layer 2 ACL with name ID configuration mode)
{
permit
|
deny
} [
protocol
] [
cos
vlan-pri
]
ingress
{ { [
source-vlan-id
] [
source-mac-addr
source-mac-wildcard
] [
interface
interface-num
] } | any }
egress
{ { [
dest-mac-addr
dest-mac-wildcard
] [
interface
interface-num
|
cpu
] } | any } [
time-range
time-range-name
]
Delete all the subitems or one subitem in one ACL with number ID or name ID or all ACLs.(global
configuration mode)
no access-list
{ all | {
access-list-number
|
name
access-list-name
} [
subitem
] }
Use { permit | deny } command repeatedly to define more rules for the same ACL. Specifying matching
order cannot be modified.
By default, the matching order is user configured order (config).
Concrete parameter meaning refers to corresponded command line.
13.3.6
Activate ACL
After activating ACL, it can be effective. Use access-group command to activate accessing control list.
Configure it in global configuration mode.
Activate ACL
access-group
{
user-group
{
access-list-number
|
access-list-name
} [
subitem
subitem
] |
{ [
ip-group
{
access-list-number
|
access-list-name
} [
subitem
subitem
] ] [
link-group
{
access-list-number
|
access-list-name
} [
subitem
subitem
] ] } }
Cancel activating ACL
no access-group
{
all
|
user-group
{
access-list-number
|
access-list-name
} [
subitem
subitem
] |
{ [
ip-group
{
access-list-number
|
access-list-name
} [
subitem
subitem
] ] [
link-group
{
access-list-number
|
access-list-name
} [
subitem
subitem
] ] } }
Instruction :
This command supports activating accessing control list of layer 2 and layer 3 at the same time, but the
action of each accessing control list should not be conflict, if there is conflict (such as one is permit, the other is deny),
the activation fails. Switch uses straight through to activate layer 2 and layer 3 ACL, that is, subitem 1 of layer 2 ACL
and layer 3 ACL combine together, and the rest may be deduced by analogy; if the number of two groups of ACL
is not the same, the rest subitem can activate separately.
13.3.7
Monitor and maintanence of ACL
Configure followings in any configuration mode except user mode.
Display time information