Filter
Top Products
574 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Enabling ACL filtering based on VLAN membership or VE port membership
16
You can apply an inbound IPv4 ACL to specific VLAN members on a port (Layer 2 devices only) or to
specific ports on a virtual interface (VE) (Layer 3 Devices only). By default, this feature support is
disabled. To enable it, enter the following commands at the Global CONFIG level of the CLI.
PowerConnect(config)#enable ACL-per-port-per-vlan
PowerConnect(config)#write memory
PowerConnect(config)#exit
PowerConnect#reload
NOTE
For complete configuration examples, see “Applying an IPv4 ACL to specific VLAN members on a port
(Layer 2 devices only)” on page 574 and “Applying an IPv4 ACL to a subset of ports on a virtual
interface (Layer 3 devices only)” on page 575.
Syntax: [no] enable ACL-per-port-per-vlan
Enter the no form of the command to disable this feature.
Configuration notes
• Before enabling this feature on an IPv4 device, make sure the VLAN numbers are contiguous.
For example, the VLAN numbers can be 201, 202, 203, and 204, but not 300, 401, 600, and
900.
• Dell PowerConnect devices do not support a globally-configured PBR policy together with
per-port-per-VLAN ACLs.
• IPv4 ACLs that filter based on VLAN membership or VE port membership
(ACL-per-port-per-VLAN), are supported together with IPv6 ACLs on the same device, as long as
they are not bound to the same port or virtual interface.
Applying an IPv4 ACL to specific VLAN members on
a port (Layer 2 devices only)
NOTE
This section applies to IPv4 ACLs only. IPv6 ACLs do not support ACL filtering based on VLAN
membership.
When you bind an IPv4 ACL to a port, the port filters all inbound traffic on the port. However, on a
tagged port, there may be a need to treat packets for one VLAN differently from packets for another
VLAN. In this case, you can configure a tagged port on a Layer 2 device to filter packets based on
the packets’ VLAN membership.
To apply an IPv4 ACL to a specific VLAN on a port, enter commands such as the following.
PowerConnect(config)#enable ACL-per-port-per-vlan
...
PowerConnect(config)#vlan 12 name vlan12
PowerConnect(config-vlan-12)#untag ethernet 5 to 8
PowerConnect(config-vlan-12)#tag ethernet 23 to 24
PowerConnect(config-vlan-12)#exit
PowerConnect(config)#access-list 10 deny host 209.157.22.26 log
PowerConnect(config)#access-list 10 deny 209.157.29.12 log
PowerConnect(config)#access-list 10 deny host IPHost1 log