Korenix Technology Co., Ltd.
Industrial
Layer 3 Managed Ethernet Switch
_____________________________________________________________________________
Industrial Layer 3 Managed Ethernet SwitchUser Manual
Page: 608/1568
6.22.2.5
access-list
This command creates an Access Control List (ACL) that is identified by the parameter.
Syntax
access-list {(<1-99> {deny | permit} {every | <srcip> <srcm ask>}) | ( {<100-199> {deny | permit} {every
| {{icmp | igmp | ip | tcp | udp | <number>} any | <srcip> <srcmask> [{eq {<0-65535> | <portkey>}]( any |
<dstip> <dstmask>) [{eq {<0-65535> | <portkey>}] {[precedence <precedence>] | [tos <tos>
<tosmask>] | [dscp <dscp>] [log] [time-range time-range-name] [assign-queue <queue-id>] [{mirror |
redirect} <slot/port>] [<rule-id>]}}}})}
<accesslistnumber>
- The ACL number is an integer from 1 to 199. The range 1 to 99 is for the
normal ACL List and 100 to 199 is for the extended ACL List.
permit or deny
- The ACL rule is created with two options. The protocol to filter for an ACL rule is
specified by giving the protocol to be used like
i
cmp ,igmp ,ip ,tcp, udp
.
The command specifies a
source ip address and source mask for match condition of the ACL rule specified by the
srcip
and
srcmask
parameters. The source layer 4 port match condition for the ACL rule is specified by the
port key p
arameter.
<portkey>
- uses a single keyword notation and currently has the values of
domain, echo, ftp,
ftpdata, http, smtp, snmp, telnet, tftp
,
. Each of these values translates into its
equivalent port number, which is used as both the start and end of a port range. The command
specifies a destination ip address and destination mask for match condition of the ACL rule specified
by the
dstip
and
dstmask
parameters. The command specifies the TOS for an ACL rule depending
on a match of precedence or DSCP values using the parameters
tos, tosmask, dscp
.
[time-range time-range-name]
- Allows imposing time limitation on the ACL rule as defined by the
parameter time-range-name. If a time range with the specified name does not exist and the ACL
containing this ACL rule is applied to an interface or bound to a VLAN, then the ACL rule is applied
immediately. If a time range with specified name exists and the ACL containing this ACL rule is
applied to an interface or bound to a VLAN, then the ACL rule is applied when the time-range with
specified name becomes active. The ACL rule is removed when the time-range with specified name
becomes inactive.
Default Setting
None
Command Mode
Global Config