Allied Telesis x510-28GPX, Справочник по командам

Страница: 1481 / 2822

C613-50170-01 Rev B Command Reference for x510 Series 1481
AlliedWare Plus™ Operating System - Version 5.4.7-1.x
IP
V
4 H
ARDWARE
A
CCESS
C
ONTROL
L
IST
(ACL) C
OMMANDS
ACCESS
-
LIST
(
NUMBERED HARDWARE
ACL
FOR
MAC
ADDRESSES
)
Mode Global Configuration
Default On an interface controlled by a hardware ACL, any traffic that does not explicitly
match a filter is permitted.
Usage This command creates an ACL for use with hardware classification. Once you have
configured the ACL, use the
access-group or the match access-group command to
apply this ACL to a port, VLAN or QoS class-map.
ACLs numbered in the range 4000-4699 match on packets that have the specified
source and destination MAC addresses.
You can use ACLs to redirect packets, by sending them to the CPU, the mirror port,
or a specific VLAN on a specific port. Use such ACLs with caution. They could
prevent control packets from reaching the correct destination, such as EPSR
healthcheck messages and VCStack messages.
Hardware ACLs will permit access unless explicitly denied by an ACL action.
Examples To create an access-list that will permit packets with a source MAC address of
0000.00ab.1234 and any destination address, use the commands:
awplus# configure terminal
awplus(config)# access-list 4000 permit 0000.00ab.1234
0000.0000.0000 any
<source-mac>
The source MAC address to match against, followed by the mask.
Enter the address in the format <HHHH.HHHH.HHHH>, where each
H is a hexadecimal number.
Enter the mask in the format <HHHH.HHHH.HHHH>, where each H
is a hexadecimal number. For a mask, each value is either 0 or F,
where FF = Ignore, and 00 = Match.
any
Match against any source MAC address.
<dest-mac>
The destination MAC address to match against, followed by the
mask.
Enter the address in the format <HHHH.HHHH.HHHH>, where each
H is a hexadecimal number.
Enter the mask in the format <HHHH.HHHH.HHHH>, where each H
is a hexadecimal number. For a mask, each value is either 0 or F,
where FF = Ignore, and 00 = Match.
any
Match against any destination MAC address.
vlan < 1-4094 >
Match against the specified ID in the packet’s VLAN tag.
inner-vlan
< 1-4094 >
Match against the inner VLAN tag (VID). This parameter is used
within double-tagged VLANs. It is sometimes referred to as the
C-TAG (Customer VLAN TAG), where the vlan VID tag is referred to as
the S-TAG (Service VLAN TAG).
Parameter Description