11.5. FLEX ACL Commands

Command Purpose

Use this command to remove a filter from FLEX MAC ACL.

Prerequisites

Command Syntax

no sequence-num SEQUENCE_NUM

Command Mode

FLEX MAC ACL Configuration

FLEX IP ACL Configuration

Default

None

Usage

User can delete a ACL which is already attached to the class-map and used by a interface immediately.

Examples

This example shows how to remove a filter with the sequence-num 10 from FLEX MAC ACL:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# no sequence-num 10

This example shows how to remove a filter with the sequence-num 10 from FLEX IP ACL:

Switch# configure terminal
Switch(config)# ip access-list list_ip_1
Switch(config-ip-acl)# no sequence-num 10

Related Commands

deny

deny tcp

deny udp

deny icmp

deny igmp

permit

permit tcp

permit udp

permit icmp

permit igmp

Command Purpose

Use this command to create a MAC filter for discarding ongoing packets matching the filter rule.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) deny src-mac (any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR) (dest-mac (any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR)| ) (untag-vlan|vlan VLAN_ID| ) (cos COS| ) (inner-vlan INNER_VLAN| ) (inner-cos INNER_COS| ) (protocol (arp (arp-op-code)|rarp|ETH_TYPE mask ETH_TYPE_MASK)|packet-length OPERATOR LENGTH| ) (TIME_RANGE_NAME| )

Command Mode

FLEX MAC ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the FLEX MAC ACL. i.e. when the maximum existing sequence number is 100, the sequence number of subsequent created MAC filter is 110. Eth-type is not supported in egress ACL.

Examples

This example shows how to create a filter in FLEX MAC ACL to deny the packets with source MAC address 0058.3f2C.A1DF:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 1 deny src-mac host 0058.3f2C.A1DF

This example shows how to create a filter in FLEX MAC ACL to deny all the packets:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 2 deny src-mac any

This example shows how to create a filter in FLEX MAC ACL to deny the packet whose source MAC address is between the ranges specified:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 3 deny src-mac 0058.3f2C.A1DF 0058.3f2C.0000

Related Commands

no sequence-num

Command Purpose

Use this command to create a MAC filter for allowing packets matching the filter rule to be delivered.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) permit src-mac (any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR) (dest-mac (any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR)| ) (untag-vlan|(vlan VLAN| ) (cos COS| ) (inner-vlan INNER_VLAN| ) (inner-cos INNER_COS| ) ) (protocol (arp (arp-op-code)|rarp|ETH_TYPE mask ETH_TYPE_MASK)|packet-length OPERATOR LENGTH| ) (TIME_RANGE_NAME| )

Command Mode

FLEX MAC ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the FLEX MAC ACL. i.e. when the maximum existing sequence number is 105, the sequence number of subsequent created MAC filter is 115. Eth-type is not supported in egress ACL.

Examples

This example shows how to create a filter in FLEX MAC ACL to permit the packets with source MAC address 0058.3f2C.A1DF:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 1 permit src-mac host 0058.3f2C.A1DF

This example shows how to create a filter in FLEX MAC ACL to permit all the packets:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 2 permit src-mac any

This example shows how to create a filter in FLEX MAC ACL to permit the packets with source MAC address between the ranges specified:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 3 permit src-mac 0058.3f2C.A1DF 0058.3f2C.0000

Related Commands

no sequence-num

Command Purpose

Use this command to add remarks for the FLEX MAC ACL.

To remove remarks of the FLEX MAC ACL, use the no form of this command.

Prerequisites

Command Syntax

remark REMARK

no remark

Command Mode

FLEX MAC ACL Configuration

FLEX IP ACL Configuration

Default

None

Usage

The remarks are up to 100 characters. The exceed parts will not be stored and will be truncated.

Examples

This example shows how to add a remark to describe the FLEX MAC ACL:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# remark remark of List for mac

This example shows how to remove the remark of the FLEX MAC ACL:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# no remark

Related Commands

Command Purpose

Use this command to create FLEX IP ACL and then enter FLEX IP ACL configuration mode.

To remove this ACL, use the no form of this command.

Prerequisites

Command Syntax

ip access-list ACL_NAME

no ip access-list ACL_NAME

Command Mode

Global Config

Default

None

Usage

If the system already has an FLEX IP ACL with the same name, this command will enter the FLEX IP ACL configuration mode. However, if the ACL name is used by other type of ACL, a prompt message will be shown.

When the name is not used by any ACL, this command is to create the FLEX IP ACL firstly and then enter the FLEX IP ACL configuration mode.

Examples

This example shows how to create an FLEX IP ACL named list_ipv4_1 and then enter the FLEX IP ACL configuration mode:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)#

This example shows how to remove the FLEX IP ACL named list_ipv4_1:

Switch# configure terminal
Switch(config)# no ip access-list list_ipv4_1

Related Commands

match access-group

Command Purpose

Use this command to delete a filter from extend FLEX IP ACL.

Prerequisites

Command Syntax

no sequence-num SEQUENCE_NUM

Command Mode

FLEX IP ACL Configuration

Default

None

Usage

None

Examples

This example shows how to delete an IP or MAC filter with sequence number 10 from an extend FLEX IP ACL:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# no sequence-num 10

Related Commands

deny

deny udp

deny icmp

deny igmp

permit

permit tcp

permit udp

permit icmp

permit igmp

deny src-mac

permit src-mac

Command Purpose

Use this command to create a filter for discarding ongoing packets matching the filter rule.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) deny src-mac (any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR) (dest-mac (any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR)| ) (vlan VLAN_ID| ) (cos COS| ) (inner-vlan INNER_VLAN_ID| ) (inner-cos INNER_COS| ) (arp-packet ((arp-op-code) (sender-ip (IP_ADDR IP_ADDR_MASK|any|host IP_ADDR)| ) (target-ip (IP_ADDR IP_ADDR_MASK|any|host IP_ADDR)| ))|packet-length OPERATOR LENGTH| ) (time-range TIME-RANGE-NAME| )

Command Mode

FLEX IP ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the extend FLEX IP ACL. i.e. when the maximum existing sequence number is 100, the sequence number of subsequent created MAC filter is 110.

Examples

This example shows how to create a filter in extend FLEX IP ACL to deny the packets with source MAC address 0058.3f2C.A1DF:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 1 deny src-mac host 0058.3f2C.A1DF

This example shows how to create a filter in extend FLEX IP ACL to deny all the packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 2 deny src-mac any

This example shows how to create a filter in extend FLEX IP ACL to deny the packet whose source MAC address is between the ranges specified:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 3 deny src-mac 0058.3f2C.A1DF 0058.3f2C.0000

Related Commands

no sequence-num

Command Purpose

Use this command to create a filter for allowing packets matching the filter rule to be delivered.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) permit src-mac (any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR) (dest-mac(any|MAC_ADDR MAC_ADDR_MASK|host MAC_ADDR)| ) (vlan VLAN_ID| ) (cos VALUE| ) (inner-vlan INNER_VLAN_ID| ) (inner-cos INNER_COS| ) (arp-packet ((arp-op-code) (sender-ip (IP_ADDR IP_ADDR_MASK|any|host IP_ADDR)| ) (target-ip (IP_ADDR IP_ADDR_MASK|any|host IP_ADDR)| ))|packet-length OPERATOR LENGTH| ) (time-range TIME-RANGE-NAME| )

Command Mode

FLEX IP ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the extend FLEX IP ACL. i.e. when the maximum existing sequence number is 105, the sequence number of subsequent created MAC filter is 115.

Examples

This example shows how to create a filter in extend FLEX IP ACL to permit the packets with source MAC address 0058.3f2C.A1DF:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-ac)# 1 permit src-mac host 0058.3f2C.A1DF

This example shows how to create a filter in extend FLEX IP ACL to permit all the packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-ac)# 2 permit src-mac any

This example shows how to create a filter in FLEX MAC ACL to permit the packets with source MAC address between the ranges specified:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 3 permit src-mac 0058.3f2C.A1DF 0058.3f2C.0000

Related Commands

no sequence-num

Command Purpose

Use this command to discard ongoing IP packets matching the IP filter.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) deny (PROTO_NUM|any) (SRC_IP SRC_IP_MASK|any|host SRC_IP) (DST_IP DST_IP_MASK|any|host DST_IP) (ip-precedence PRECEDENCE|dscp DSCP| ) (ecn <0-3>| ) (non-fragment|first-fragment|non-or-first-fragment|small-fragment|non-first-fragment) (routed-packet| ) (options| ) (packet-length OPERATOR LENGTH| ) (time-range TIME-RANGE-NAME| )

Command Mode

FLEX IP ACL Configuration

Default

None

Usage

If an IP address wildcard bit is provided, the IP address is logically-anded in bitwise with the reverse bits of the wildcard bits. For example, 10.10.10.0 0.0.0.255 means the addresses from 10.10.10.0 to 10.10.10.255 are matched.

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the extend FLEX IP ACL. i.e. when the maximum existing sequence number is 100, the sequence number of subsequent created IP filter is 110.

Examples

This example shows how to create a filter in extend FLEX IP ACL to deny any IP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acll)# 1 deny any any any

This example shows how to create a filter in extend FLEX IP ACL to deny the fragment packets with the source IP addresss 1.1.1.1:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acll)# 2 deny any host 1.1.1.1 any fragments

This example shows how to create a filter in extend FLEX IP ACL to deny any routed packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acll)# 3 deny any any any routed-packet

Related Commands

no sequence-num

Command Purpose

Use this command to reject TCP packets matching the IP filter.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) deny tcp (SRC_IP SRC_IP_MASK|any|host SRC_IP) (src-port OPERATOR SRC_PORT| ) (DST_IP DST_IP_MASK|any|host DST_IP) (dst-port OPERATOR DST_PORT| ) (ip-precedence PRECEDENCE|dscp DSCP| ) (ecn <0-3>| ) (established| (match-any|match-all FLAG-NAME| )| ) (non-fragment|first-fragment|non-or-first-fragment|small-fragment|non-first-fragment) (routed-packet| ) (options| ) (packet-length OPERATOR LENGTH| ) (time-range TIME-RANGE-NAME| )

Command Mode

FLEX IP ACL Configuration

Default

None

Usage

The fragments will be invalid when the layer 4 information is specified (i.e. src-port).

Examples

This example shows how to create a filter in extend FLEX IP ACL to deny any TCP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 1 deny tcp any any

This example shows how to create a filter in extend FLEX IP ACL to deny the TCP packets with the source IP address 1.1.1.1, source port 0-100:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 2 deny tcp host 1.1.1.1 src-port range 0 100 any

This example shows how to create a filter in extend FLEX IP ACL to deny any TCP packets in established TCP streams:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 3 deny tcp any any established

This example shows how to create a filer in extend FLEX IP ACL to deny the TCP ACK packets with the source IP address 10.10.10.10:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 4 deny tcp 10.10.10.0 0.0.0.0 any match-any ack

Related Commands

no sequence-num

Command Purpose

Use this command to reject UDP packets matching the IP filter.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) deny udp (SRC_IP SRC_IP_MASK|any|host SRC_IP) (src-port OPERATOR SRC_PORT| ) (DST_IP DST_IP_MASK|any|host DST_IP) (dst-port OPERATOR DST_PORT| ) (ip-precedence PRECEDENCE|dscp DSCP| ) (ecn <0-3>| ) (non-fragment|first-fragment|non-or-first-fragment|small-fragment|non-first-fragment) (routed-packet| ) (options| ) (packet-length OPERATOR LENGTH| ) (time-range TIME-RANGE-NAME| )

Command Mode

FLEX IP ACL Configuration

Default

None

Usage

The fragments will be invalid when the layer 4 information is specified (i.e. src-port).

Examples

This example shows how to create a filter in FLEX IP ACL to deny any UDP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 1 deny udp any any

This example shows how to create a filter in FLEX IP ACL to deny the UDP packets with the source IP 1.1.1.1, source port 10, and destination port less than 2000:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acl)# 2 deny udp host 1.1.1.1 src-port eq 10 any dst-port lt 2000

Related Commands

`no sequence-num``

Command Purpose

Use this command to reject ICMP packets matching the IP filter.

Prerequisites

Command Syntax

(SEQUENCE_NUM| ) deny icmp (SRC_IP SRC_IP_MASK|any|host SRC_IP) (DST_IP DST_IP_MASK|any|host DST_IP) (icmp-type TYPE-NUM (icmp-code CODE-NUM| )| ) (ip-precedence PRECEDENCE|dscp DSCP| ) (ecn <0-3>| ) (non-fragment|first-fragment|non-or-first-fragment|small-fragment|non-first-fragment) (routed-packet| ) (options| ) (packet-length OPERATOR LENGTH| ) (time-range TIME-RANGE-NAME| )

Command Mode

FLEX IP ACL Configuration

Default

None

Usage

None

Examples

This example shows how to create a filter in extend FLEX IP ACL to deny any UDP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acll)# 1 deny udp any any

This example shows how to create a filter in extend FLEX IP ACL to deny the UDP packets with the source IP 1.1.1.1, source port 10, and destination port less than 2000:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1 extend
Switch(config-ex-ip-acll)# 2 deny udp host 1.1.1.1 src-port eq 10 any dst-port lt 2000

Related Commands