Configuration notes for acl filtering, Enabling acl filtering, Based on vlan membership or ve port membership – Brocade Communications Systems Brocade ICX 6650 6650 User Manual
Page 129
Brocade ICX 6650 Security Configuration Guide
109
53-1002601-01
Enabling ACL support for switched traffic in the router image
Enabling ACL support for switched traffic in the router image
For Brocade ICX 6650, ACL support for switched traffic in the router image is enabled by default.
There is no command to enable or disable it.
For outbound traffic, ACL support is enabled on switched traffic by default. The bridged-routed
command is not applicable.
Enabling ACL filtering based on VLAN membership or VE port
membership
NOTE
This section applies to IPv4 ACLs only. IPv6 ACLs do not support ACL filtering based on VLAN
membership or VE port membership.
This feature is not applicable to outbound traffic.
You can apply an inbound IPv4 ACL to specific VLAN members on a port (Layer 2 devices only) or to
specific ports on a virtual interface (VE) (Layer 3 Devices only). By default, this feature support is
disabled. To enable it, enter the following commands at the Global CONFIG level of the CLI.
Brocade(config)# enable ACL-per-port-per-vlan
Brocade(config)# write memory
Brocade(config)# exit
Brocade# reload
NOTE
For complete configuration examples, see
“Applying an IPv4 ACL to specific VLAN members on a port
“Applying an IPv4 ACL to a subset of ports on a virtual
interface (Layer 3 devices only)”
Syntax: [no] enable ACL-per-port-per-vlan
Enter the no form of the command to disable this feature.
Configuration notes for ACL filtering
•
Before enabling this feature on an IPv4 device, make sure the VLAN numbers are contiguous.
For example, the VLAN numbers can be 201, 202, 203, and 204, but not 300, 401, 600, and
900.
•
Brocade devices do not support a globally-configured PBR policy together with
per-port-per-VLAN ACLs.
•
IPv4 ACLs that filter based on VLAN membership or VE port membership
(ACL-per-port-per-VLAN), are supported together with IPv6 ACLs on the same device, as long as
they are not bound to the same port or virtual interface.