Allied Telesis x510-28GPX, Справочник по командам

Страница: 1496 / 2822

C613-50170-01 Rev B Command Reference for x510 Series 1496
AlliedWare Plus™ Operating System - Version 5.4.7-1.x
IP
V
4 H
ARDWARE
A
CCESS
C
ONTROL
L
IST
(ACL) C
OMMANDS
(
NAMED HARDWARE
ACL: IP
PACKET ENTRY
)
Usage To use this command, first run the command access-list hardware (named
hardware ACL) and enter the desired access-list name. This changes the prompt to
awplus(config-ip-hw-acl)#.
Then use this command (and the other “named hardware ACL: entry” commands)
to add filter entries. You can add multiple filter entries to an ACL. You can insert a
new filter entry into the middle of an existing list by specifying the appropriate
sequence number. If you do not specify a sequence number, the switch puts the
entry at the end of the ACL and assigns it the next available multiple of 10 as its
sequence number.
Then use the access-group or the match access-group command to apply this ACL
to a port, VLAN or QoS class-map. Note that the ACL will only apply to incoming
data packets.
You can use ACLs to redirect packets, by sending them to the CPU, the mirror port,
or a specific VLAN on a specific port. Use such ACLs with caution. They could
prevent control packets from reaching the correct destination, such as EPSR
healthcheck messages and VCStack messages.
Examples To add a filter entry to the access-list named “my-list” that will permit any IP packet
with a source address of 192.168.1.1, use the commands:
awplus# configure terminal
awplus(config)# access-list hardware my-list
awplus(config-ip-hw-acl)# permit ip 192.168.1.1/32 any
To add a filter entry to the access-list named “my-list” that will permit any IP packet
with a source address of 192.168.1.1and a MAC source address of ffee.ddcc.bbaa,
use the commands:
awplus# configure terminal
awplus(config)# access-list hardware my-list
awplus(config-ip-hw-acl)# permit ip 192.168.1.1/32 any mac
ffee.ddcc.bbaa 0000.0000.0000 any
To add a filter entry to the access-list named “my-list” that will deny all IP packets
on vlan 2, use the commands:
awplus# enable
awplus(config)# configure terminal
awplus(config)# access-list hardware my-list
awplus(config-ip-hw-acl)# deny ip any any vlan 2
Related
Commands
access-group
access-list hardware (named hardware ACL)
match access-group
show running-config
show access-list (IPv4 Hardware ACLs)
Command
changes
Version 5.4.6-2.1: send-to-vlan-port action parameter added