15-48
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 15 Configuring Access Control
Configuring VACLs
This example shows how to disable BDD:
Console> (enable)
set aclmerge bdd disable
Bdd will be disabled on system restart.
Console> (enable)
This example shows how to display the current BDD status and whether BDD will be enabled or disabled
at the next system restart:
Console> (enable)
show aclmerge bdd
Bdd is not enabled.
On system restart bdd will be disabled.
Console> (enable)
To specify the ACL-merge algorithm, perform this task in privileged mode:
This example shows how to specify the ODM algorithm:
Console> (enable)
set aclmerge algo odm
Acl merge algorithm set to odm.
Console> (enable)
This example shows the ACL-merge algorithm that is currently in use:
Console> (enable)
show aclmerge algo
Current acl merge algorithm is odm.
Console> (enable)
Creating an IP VACL and Adding ACEs
To create a new IP VACL and add the ACEs, or to add the ACEs to an existing IP VACL, perform one
of these tasks in privileged mode:
This example shows how to create an ACE for IPACL1 to allow the traffic from source address
172.20.53.4:
Console> (enable)
set security acl ip IPACL1 permit host 172.20.53.4 0.0.0.0
IPACL1 editbuffer modified. Use ‘commit’ command to apply changes.
Console> (enable)
Task
Command
Step 1
Specify the ACL-merge algorithm.
set aclmerge algo
{
bdd
|
odm
}
Step 2
Display the ACL-merge algorithm that is currently
in use.
show aclmerge
{
bdd
|
algo
}
Task
Command
If an IP protocol specification is not
required, use the following syntax.
set security acl ip
{
acl_name
} {
permit
|
deny
} {
src_ip_spec
} [
capture
]
[
before
editbuffer_index
|
modify
editbuffer_index
] [
log
1
]
1.
The
log
keyword provides logging messages for denied IP VACLs only.
If an IP protocol is specified, use the
following syntax.
set security acl ip
{
acl_name
} {
permit
|
deny
|
redirect
mod_num/
port_num
} {
protocol
} {
src_ip_spec
} {
dest_ip_spec
} [
precedence
precedence
] [
tos
tos
] [
capture
] [
before
editbuffer_index
|
modify
editbuffer_index
] [
log
1
]
