[Example]
Create MAC access list #2000 which denies frames from MAC address 00-A0-DE-12-34-56, and add the comment "Test."
SWR2311P(config)#access-list 2001 deny mac 00A0.DE12.3456 0000.0000.0000 any
SWR2311P(config)#access-list 2001 description Test
9.1.9 Apply MAC access list
[Syntax]
access-group
mac-acl-id
direction
no
access-group
mac-acl-id
direction
[Parameter]
mac-acl-id
:
<2001-3000>
ID of MAC access list to apply
direction
:
Specifies the direction of applicable frames
Setting value
Description
in
Apply to received frames
[Initial value]
none
[Input mode]
interface mode
[Description]
Applies a MAC access list to the LAN/SFP port.
If the received frame matches the conditions in the access list, the action in the access list will be the action (permit, deny) for
the corresponding frame.
If this is executed with the "no" syntax, the applied access list is deleted from the LAN/SFP port.
[Note]
The restrictions of the access list apply only to frames that are subject to being relayed. Frames that are transmitted
autonomously are excluded from these restrictions.
It is not possible to register multiple access lists for a single interface.
Access lists can be applied only to LAN/SFP ports. (Logical interfaces are not supported.)
[Example]
Apply access list #2001 to received frames of LAN port #1.
SWR2311P(config)#interface port1.1
SWR2311P(config-if)#access-group 2001 in
9.1.10 Show generated access list
[Syntax]
show
access-list
[
acl_id
]
[Parameter]
acl-id
:
<1-2000>, <2001-3000>, <3001-4000>
ID of access list
[Input mode]
unprivileged EXEC mode, priviledged EXEC mode
[Description]
Shows the registered access list.
If acl-id is omitted, all access lists are shown.
Command Reference | Traffic control |
223