Filter
Top Products
AT-9000 Switch Command Line User’s Guide
1181
The VLAN parameter determines if an ACL filters VLANs. You use the
parameter to specify the VID. You can specify one VID per command. If
you omit this parameter, the ACL applies to all traffic. In other words, no
filtering is done by the ACL based on the VLAN.
The following example configures two ACLs. When they are applied in
combination on port 21, they forward tagged packets to UDP source and
destination ports in the range of 67 to 87 only if they are from the
154.11.234.0 network and are going to the 154.11.235.0 network, and
have the VID, 20. The Numbered IPv4 ACL with UDP port example
requires a permit ACL because the permitted traffic is a subset of all UDP
packets on the port:
Creating
Numbered MAC
ACLs
There is one command to create Numbered MAC ACLs. The following
command creates Numbered MAC ACLs that filter source and destination
MAC addresses. Here is the format:
ACCESS-LIST
id_number action src_mac_address
|ANY
src_mac_mask dst_mac_address
|ANY
dst_mac_mask
The id_number parameter specifies the ID number for the new ACL. The
range is 4000 to 4699.
The ACTION parameter specifies the action that the port performs on
packets matching the filtering criteria of the ACL. Here are the possible
actions:
permit— Forwards all ingress packets that match the ACL. Ports,
by default, accept all ingress packets. Consequently, a permit ACL
is only necessary when you want a port to forward a subset of
packets that are otherwise discarded.
deny— Discards all ingress packets that match the ACL.
Table 130. Numbered IPv4 ACL with UDP Port Example
Command Description
awplus> enable Enter the Privileged Executive mode from
the User Executive mode.
awplus# configure terminal Enter the Global Configuration mode.
awplus(config)# access-list 3119
permit udp 154.11.234.0/24 range 67
87 154.11.235.0/24
range 67 87 vlan
20
Define ACL 3119 to permit packets from
UDP ports 67 through 87 on IP addresses
154.11.234.0/24 and 154.11.234.0/24, and
VLAN with a VID of 20.
awplus(config)# access-list 3005
deny udp any any range 67 87
Define ACL 3005 to deny packets from UDP
ports 67 through 87 from any source or
destination IPv4 address.