Supermicro SSE-F3548S/SSE-F3548SR Configuration User’s Guide
220
The permit rule is widely used for QoS applications. In some cases permit rules are useful when all traffic
is denied by a rule and a few specific hosts are to be permitted. In this case, permit rules have to be
created before deny rules to make sure switch hardware processes permit rules first.
MAC Extended ACLs allow users to configure the traffic flow with the following fields.
Source MAC Address
Destination MAC Address
Non-IP Protocol
Ethernet type field in an Ethernet Header
VLAN Identifier
MAC Extended ACL rules can be created and identified either with an ACL number such as 1, 2 , 3 or with
a name string. An ACL identifier number can be any number from 1 to 32768. An ACL identifier name can
be any string length not exceeding 32 characters No special characters are allowed.
User can associate priority values to MAC extended ACL rules. Based on the configured priority, the rules
will be orderly arranged in the hardware ACL table. The ACL rules are checked on the incoming packets
based on the order of priority. Higher priority ACL rules take precedence over lower priority rules. In case
of multiple rules with the same priority value, rules that were created earlier will take precedence over
those created later.
If the user does not specify the priority, all rules will have a priority value of 1 by default.
8.2.1
Creating MAC Extended ACLs
Follow the steps below to create a MAC Extended ACL.
Step Command
Description
Step 1 configure terminal
Enter the configuration mode
Step 2 mac access-list extended { <access-list-number>|
<access-list-name> }
Creates a MAC Extended ACL using the
mac-access-list extended command.
access-list-number–can be any number
from 1 to 65535
access-list-name– any name string up
to 32 characters.
Step 3 deny
{
any
|
host
<
src-mac-address
>}{
any
|
host
<
dest-mac-address
> }<
value (1-65535)
>]
[
Vlan
<
vlan-id (1-4069)
>] [
priority
<
value (1-
255)
>]
or
permit
{
any
|
host
<
src-mac-address
>}{
any
|
host
<
dest-mac-address
> }
priority
<
value (1-
65535)
>][
Vlan
<
vlan-id (1-4069)
>]
[
priority
<
value (1-255)
>]
or
Configures a deny ACL rule, a permit
ACL rule or a redirect ACL rule.
The source and destination MAC
addresses are provided with the
keyword host. The keyword anyis used
to refer any MAC addresses. If a source
or destination MAC address is
configured as any, the switch will not
check that source or destination MAC
address to match the packets for this
ACL.
