![background image](http://html1.mh-extra.com/html/smc-networks/8708l2/8708l2_management-manual_1300245419.webp)
A
CCESS
C
ONTROL
L
IST
C
OMMANDS
4-129
Command Usage
• Packets crossing a port are checked against all the rules in the ACL until
a match is found. The order in which these packets are checked is
determined by the mask, and not the order in which the ACL rules were
entered.
• First create the required ACLs and ingress or egress masks before
mapping an ACL to an interface.
• If you enter
dscp
, you cannot enter
tos
or
precedence
. You can enter
both
tos
and
precedence
without
dscp
.
• Masks that include an entry for a Layer 4 protocol source port or
destination port can only be applied to packets with a header length of
exactly five bytes.
Example
This example creates an IP ingress mask with two rules. Each rule is
checked in order of precedence to look for a match in the ACL entries.
The first entry matching a mask is applied to the inbound packet.
This shows that the entries in the mask override the precedence in which
the rules are entered into the ACL. In the following example, packets with
the source address 10.1.1.1 are dropped because the “deny 10.1.1.1
255.255.255.255” rule has the higher precedence according the “mask host
any” entry.
Console(config)#access-list ip mask-precedence in
Console(config-ip-mask-acl)#mask host any
Console(config-ip-mask-acl)#mask 255.255.255.0 any
Console(config-ip-mask-acl)#
Console(config)#access-list ip standard A2
Console(config-std-acl)#permit 10.1.1.0 255.255.255.0
Console(config-std-acl)#deny 10.1.1.1 255.255.255.255
Console(config-std-acl)#exit
Console(config)#access-list ip mask-precedence in
Console(config-ip-mask-acl)#mask host any
Console(config-ip-mask-acl)#mask 255.255.255.0 any
Console(config-ip-mask-acl)#
Summary of Contents for 8708L2
Page 2: ......
Page 24: ...TABLES xxiv ...
Page 28: ...FIGURES xxviii ...
Page 290: ...CONFIGURING THE SWITCH 3 238 ...
Page 584: ...COMMAND LINE INTERFACE 4 294 ...
Page 592: ...TROUBLESHOOTING B 4 ...
Page 605: ......