SNR S2940-8G-v2, Руководство по настройке

Страница: 288 / 420

SNR S2940-8G-v2 Switch Configuration Guide
ACL Configuration
(i) Configuring a extended MAC-IP access-list based on nomenclature
i. Create an extensive MAC-IP access-list based on nomenclature
Command Explanation
Global Mode
mac-ip-access-list extended <name>
no mac-ip-access-list extended <name> Creates an extended name-based MAC-IP
access rule; the no form command deletes
this name-based extended MAC-IP access
rule.
ii. Specify multiple 'permit' or 'deny' rule entries
Command Explanation
Extended name-based MAC-IP access Mode
[no] { deny | permit } { any-source-mac | { host-source-
mac <host_smac> } | { <smac><smac-mask> } } { any-
destination-mac | { host-destination-mac <host_dmac> }
| { <dmac><dmac-mask> } } icmp { { <source><source-
wildcard> } | any-source | { host-source<source-host-ip> }
} { { <destination><destination-wildcard> } | any-destination
| { host-destination <destination-host-ip> } } [<icmp-type>
[<icmp-code>]] [precedence <precedence>][tos<tos>][time-
range<time-range-name>] Creates an extended name-
based MAC-ICMP access rule;
the no form command deletes
this
name-based extended
MAC-ICMP access rule.
[no] { deny | permit } { any-source-mac | { host-source-
mac <host_smac> } | { <smac><smac-mask> } } { any-
destination-mac | { host-destination-mac <host_dmac> }
| { <dmac><dmac-mask> } } igmp { { <source><source-
wildcard> } | any-source | { host-source<source-host-ip> }
} { { <destination><destination-wildcard> } | any-destination
| { host-destination <destination-host-ip> } } [<igmp-type>]
[precedence <precedence>] [tos <tos>][time-range<time-
range-name>] Creates an extended name-
based MAC-IGMP access rule;
the no form command deletes
this
name-based extended
MAC-IGMP access rule.
[no] { deny | permit } { any-source-mac | { host-
source-mac<host_smac>
} | { <smac><smac-mask>
} } { any-destination-mac | { host-destination-mac
<host_dmac> } | { <dmac><dmac-mask> } } tcp { {
<source><source-wildcard> } | any-source | { host-
source<source-host-ip> } } [s-port { <port1> | range
<sPortMin> <sPortMax> } ] { { <destination><destination-
wildcard>
} | any-destination | { host-destination
<destination-host-ip> } } [d-port { <port3> | range
<dPortMin> <dPortMax> } ] [ack+fin+psh+rst+urg+syn]
[precedence<precedence>][tos<tos>][time-range<time-
range-name>]
Creates an extended name-
based MAC-TCP access rule;
the no form command deletes
this
name-based extended
MAC-TCP access rule.
288