Configure MAC Extended ACL
MAC extended ACL can make the classification rule according to the Ethernet protocol type, source MAC address, destination MAC address, VLAN ID, and 802.1p priority, so as to filter the packets.
Configuration Condition
None
Configure MAC Extended ACL
MAC extended ACL name can use the number and also can use the customized character string. If the MAC extended ACL name adopts the numbers, we can configure the maximum quantity limitation of ACL; if adopting the customized character string, there is no limitation for the maximum quantity of ACL. The user can select the ACL name as desired. MAC extended ACL is richer, more correct, and more flexible than the contents defined by MAC standard ACL.
Table 15-8 Configure the MAC extended ACL
|
Step
|
Command
|
Description
|
|
Enter global configuration mode
|
configure terminal
|
-
|
|
Configure the MAC extended ACL
|
mac access-list extended { access-list-number | access-list-name }
|
Mandatory
By default, MAC extended ACL is not configured.
The sequence range of the MAC extended ACL is 3001-4000.
|
|
Configure the permit rule of ACL
|
[ sequence ] permit { any | source-addr source-wildcard | host source-addr } { any | destination-addr destination-wildcard | host destination-addr } [ ether-type type ] [ cos cos ] [ vlan-id vlan ] [ time-range time-range-name ] [log] [ l2-action-group l2-action-group-name ] [ egr-action-group egr-action-group-name ] [ vfp-action-group vfp-action-group-name ]
|
Optional
By default, the permit rule of ACL is not configured.
|
|
Configure the refuse rule of ACL
|
[ sequence ] deny { any | source-addr source-wildcard | host source-addr } { any | destination-addr destination-wildcard | host destination-addr } [ ether-type type ] [ cos cos ] [ vlan-id vlan ] [ time-range time-range-name ] [log] [ l2-action-group l2-action-group-name ] [ egr-action-group egr-action-group-name ] [ vfp-action-group vfp-action-group-name ]
|
Optional
By default, the refuse rule of ACL is not configured.
|
|
Configure the ACL remarks
|
[ sequence ] remark comment
|
Optional
By default, the remarks of ACL are not configured.
|
-
When using the mac access-list extended command to create the MAC extended ACL, the ACL can be created only after configuring the rules in the MAC extended ACL configuration mode.
- Sequence means the order number of the rule in the ACL. ACL matches and filters the packet strictly according to the order from small sequence to large sequence. The rule with the small sequence first takes effect. When all rules do not match, execute the default drop action, that is, all the packets not permitted to pass are dropped.
Configure MAC Extended ACL Named by Numbers
The MAC extended ACL named by numbers can let the user identify the type of the ACL quickly. However, the MAC extended ACL named by numbers has some limitations. For example, the ACL quantity is limited. MAC extended ACL is richer, more correct, and more flexible than the contents defined by MAC standard ACL.
Table 15-9 Configure the MAC extended ACL named by numbers
|
Step
|
Command
|
Description
|
|
Enter global configuration mode
|
configure terminal
|
-
|
|
Configure the MAC extended ACL named by numbers
|
access-list access-list-number { permit | deny } { any | source-addr source-wildcard | host source-addr } { any | destination-addr destination-wildcard | host destination-addr } [ ether-type type ] [ cos cos ] [ vlan-id vlan ] [ time-range time-range-name ] [log] [ l2-action-group l2-action-group-name ] [ egr-action-group egr-action-group-name ] [ vfp-action-group vfp-action-group-name ]
|
Mandatory
By default, the MAC extended ACL named by numbers is not configured.
The sequence range of the MAC extended ACL is 3001-4000.
|
|
Configure the remarks of the MAC extended ACL named by numbers
|
access-list access-list-number remark comment
|
Optional
By default, the remarks of the MAC extended ACL named by numbers are not configured.
|
-
If the ACL with the specified sequence does not exist, create one new ACL and add new rules. If the ACL with the specified number exists, just add new rules.
Switch
.png){kind=icon}
.png){kind=logo}
