PLANET XGSW-28040 - Manual (Page 433)

User’s Manual of XGSW-28040
Security Network ACL Add
Description:
Add or modify Access Control Entry (ACE).
If the ACE ID parameter <ace_id> is specified and an entry with this ACE ID already exists, the ACE will be modified.
Otherwise, a new ACE will be added. If the ACE ID is not specified, the next available ACE ID will be used.
If the next ACE ID parameter <ace_id_next> is specified, the ACE will be placed before this ACE in the list. If the next
ACE ID is not specified, the ACE will be placed last in the list.
If the Switch keyword is used, the rule applies to all ports. If the Port keyword is used, the rule applies to the specified port
only. If the Policy keyword is used, the rule applies to all ports configured with the specified policy. The default is that the
rule applies to all ports.
Syntax:
Security Network ACL Add [<ace_id>] [<ace_id_next>] [(port <port>)] [(policy <policy> <policy_bitmask>)] [<vid>]
[<tag_prio>] [<dmac_type>] [(etype [<etype>] [<smac>] [<dmac>]) | (arp [<sip>] [<dip>] [<smac>] [<arp_opcode>]
[<arp_flags>]) | (ip [<sip>] [<dip>] [<protocol>] [<ip_flags>]) | (icmp [<sip>] [<dip>] [<icmp_type>] [<icmp_code>]
[<ip_flags>]) | (udp [<sip>] [<dip>] [<sport>] [<dport>] [<ip_flags>]) | (tcp [<sip>] [<dip>] [<sport>] [<dport>] [<ip_flags>]
[<tcp_flags>])] [permit|deny] [<rate_limiter>] [<port_redirect>] [<logging>] [<shutdown>]
Parameters:
<ace_id> : ACE ID (1-512), default: Next available ID
<ace_id_next> : Next ACE ID (1-512), default: Add ACE last
port : Port ACE keyword
<port> : Port number or 'all'
policy : Policy ACE keyword
<policy> : Policy number (0-255)
<policy_bitmask> : Policy number bitmask (0x0-0xFF)
<vid> : VLAN ID (1-4095) or 'any'
<tag_prio> : VLAN tag priority (0-7) or 'any'
<dmac_type> : DMAC type: any|unicast|multicast|broadcast
etype : Ethernet Type keyword
<etype> : Ethernet Type: 0x600 - 0xFFFF or 'any' but excluding 0x800(IPv4) 0x806(ARP) and 0x86DD(IPv6)
<smac> : Source MAC address ('xx-xx-xx-xx-xx-xx' or 'xx.xx.xx.xx.xx.xx' or 'xxxxxxxxxxxx', x is a hexadecimal
digit) or 'any'
<dmac> : Destination MAC address ('xx-xx-xx-xx-xx-xx' or 'xx.xx.xx.xx.xx.xx' or 'xxxxxxxxxxxx', x is a
hexadecimal digit) or 'any'
arp : ARP keyword
433