SMC Networks SMC6824M manual Masks for Access Control Lists, Access Control List Commands

COMMAND LINE INTERFACE

•Egress MAC ACLs only work for destination-mac-known packets, not for multicast, broadcast, or destination-mac-unknown packets.

The order in which active ACLs are checked is as follows:

1.User-defined rules in the Egress MAC ACL for egress ports.

2.User-defined rules in the Egress IP ACL for egress ports.

3.User-defined rules in the Ingress MAC ACL for ingress ports.

4.User-defined rules in the Ingress IP ACL for ingress ports.

5.Explicit default rule (permit any any) in the ingress IP ACL for ingress ports.

6.Explicit default rule (permit any any) in the ingress MAC ACL for ingress ports.

7.If no explicit rule is matched, the implicit default is permit all.

Masks for Access Control Lists

You must specify masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny the rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ACL. A mask must be bound exclusively to one of the basic ACL types (i.e., Ingress IP ACL, Egress IP ACL, Ingress MAC ACL or Egress MAC ACL), but a mask can be bound to up to four ACLs of the same type.

Table 4-35 Access Control List Commands

Command Groups	Function	Page
IP ACLs	Configures ACLs based on IP addresses, TCP/UDP	4-122
	port number, protocol type, and TCP control code
MAC ACLs	Configures ACLs based on hardware addresses, packet	4-138
	format, and Ethernet type
ACL Information	Displays ACLs and associated rules; shows ACLs	4-150
	assigned to each port

4-121