Example layer 2 acl clauses – Brocade BigIron RX Series Configuration Guide User Manual
Page 667
BigIron RX Series Configuration Guide
589
53-1002484-04
Configuring Layer 2 ACLs
21
For more examples of valid Layer 2 ACL clauses, refer to
Syntax: [no] access-list <num> permit | deny <src-mac> <mask> | any <dest-mac> <mask> | any
[<vlan-id> | any [etype <etype-str>] [log-enable]]
The <num> parameter specifies the Layer 2 ACL table that the clause belongs to. The table ID can
range from 400 to 499. You can define a total of 100 Layer 2 ACL tables.
The permit | deny argument determines the action to be taken when a match occurs.
The <src-mac> <mask> | any parameter specifies the source MAC address. You can enter a
specific address and a comparison mask or the keyword any to filter on all MAC addresses. Specify
the mask using F’s and zeros. For example, to match on the first two bytes of the address
aabb.ccdd.eeff, use the mask ffff.0000.0000. In this case, the clause matches all source MAC
addresses that contain “aabb” as the first two bytes and any values in the remaining bytes of the
MAC address. If you specify any, you do not need to specify a mask and the clause matches on all
MAC addresses.
The <dest-mac> <mask> | any parameter specifies the destination MAC address. The syntax rules
are the same as those for the <src-mac> <mask> | any parameter.
The optional <vlan-id> | any parameter specifies the vlan-id to be matched against the vlan-id of
the incoming packet. You can specify any to ignore the vlan-id match.
The optional etype <etype-str> argument specifies the Ethernet type field of the incoming packet
in order for a match to occur.
The <etype-str> can be one of the following keywords:
•
IPv4-Len-5 (Etype=0x0800, IPv4, HeaderLen 20 bytes)
•
ARP (Etype=0x0806, IP ARP)
•
IPv6 (Etype=0x86dd, IP version 6)
The optional <log-enable> parameter enables the logging mechanism. The device accepts this
command only when a deny clause is configured. When you enable logging for a Layer 2 ACL, all
traffic matching the clause is sent to the CPU for processing and traffic is denied by the CPU. The
CPU creates a log entry for the first packet that is denied and once every 10 seconds thereafter.
The logging mechanism includes sending SNMP traps and log messages to the Syslog servers and
writing the log entry to the log buffer on the device.
In addition, if specified with a ‘permit’ action, the log-enable keyword is ignored and the user is
warned that he cannot log permit traffic.
NOTE
Traffic denied by the implicit deny mechanism is not subject to logging. The implicit deny mechanism
kicks in when the traffic does not match any of the clauses specified and there is no permit any any
clause specified at the end.
Use the [no] parameter to delete the Layer 2 ACL clause from the table. When all clauses are
deleted from a table, the table is automatically deleted from the system.
Example Layer 2 ACL clauses
The following shows some examples of valid Layer 2 ACL clauses.