11.4. ACL Commands

Command Purpose

Use this command to create MAC ACL and then enter MAC ACL in global configuration mode. Use no mac access-list command to delete the MAC ACL.

Prerequisites

Command Syntax

mac access-list ACL_NAME

no mac access-list ACL_NAME

Command Mode

Global Config

Default

None

Usage

If the system already has a MAC ACL with the same name, this command will enter the MAC ACL configuration mode. However, if the ACL name is used by other type of ACL, a prompt message will be shown.

When the name is not used by any ACL, this command is to create the MAC ACL firstly and then enter the MAC ACL configuration mode.

Examples

This example shows how to create a MAC ACL named list_mac_1 and then enter the MAC ACL configuration mode:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)#

This example shows how to remove the MAC ACL named list_mac_1:

Switch# configure terminal
Switch(config)# no mac access-list list_mac_1

Related Commands

match access-group

Command Purpose

Use this command to remove a filter from MAC ACL.

Prerequisites

Command Syntax

no sequence-num SEQUENCE_NUM

Command Mode

MAC ACL Configuration

IP ACL Configuration

Default

None

Usage

User can delete a ACL which is already attached to the class-map and used by a interface immediately.

Examples

This example shows how to remove a filter with the sequence-num 10 from MAC ACL:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# no sequence-num 10

This example shows how to remove a filter with the sequence-num 10 from IP ACL:

Switch# configure terminal
Switch(config)# ip access-list list_ip_1
Switch(config-ip-acl)# no sequence-num 10

Related Commands

deny

deny tcp

deny udp

deny icmp

deny igmp

permit

permit tcp

permit udp

permit icmp

permit igmp

Command Purpose

Use this command to create a MAC filter for discarding ongoing packets matching the filter rule.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny src-mac ( any | MAC_ADDR MAC_ADDR_MASK | host MAC_ADDR ) ( dest-mac ( any | MAC_ADDR MAC_ADDR_MASK | host MAC_ADDR ) | ) ( untag-vlan | ( ( vlan VLAN_ID | ) ( cos COS | ) ( inner-vlan INNER_VLAN | ) ( inner-cos INNER_COS | ) ) ( protocol ( arp ( arp-op-code ) | rarp | ETH_TYPE mask ETH_TYPE_MASK ) | packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

MAC ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the MAC ACL. i.e. when the maximum existing sequence number is 100, the sequence number of subsequent created MAC filter is 110. Eth-type is not supported in egress ACL.

Examples

This example shows how to create a filter in MAC ACL to deny the packets with source MAC address 0058.3f2C.A1DF:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 1 deny src-mac host 0058.3f2C.A1DF

This example shows how to create a filter in MAC ACL to deny all the packets:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 2 deny src-mac any

This example shows how to create a filter in MAC ACL to deny the packet whose source MAC address is between the ranges specified:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 3 deny src-mac 0058.3f2C.A1DF 0058.3f2C.0000

Related Commands

no sequence-num

Command Purpose

Use this command to create a MAC filter for allowing packets matching the filter rule to be delivered.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) permit src-mac ( any | MAC_ADDR MAC_ADDR_MASK | host MAC_ADDR ) ( dest-mac ( any | MAC_ADDR MAC_ADDR_MASK | host MAC_ADDR ) | ) ( untag-vlan | ( vlan VLAN | ) ( cos COS | ) ( inner-vlan INNER_VLAN | ) ( inner-cos INNER_COS | ) ) ( protocol ( arp ( arp-op-code ) | rarp | ETH_TYPE mask ETH_TYPE_MASK ) | packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

MAC ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the MAC ACL. i.e. when the maximum existing sequence number is 105, the sequence number of subsequent created MAC filter is 115. Eth-type is not supported in egress ACL.

Examples

This example shows how to create a filter in MAC ACL to permit the packets with source MAC address 0058.3f2C.A1DF:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 1 permit src-mac host 0058.3f2C.A1DF

This example shows how to create a filter in MAC ACL to permit all the packets:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 2 permit src-mac any

This example shows how to create a filter in MAC ACL to permit the packets with source MAC address between the ranges specified:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# 3 permit src-mac 0058.3f2C.A1DF 0058.3f2C.0000

Related Commands

no sequence-num

Command Purpose

Use this command to add remarks for the MAC ACL.

To remove remarks of the MAC ACL, use the no form of this command.

Prerequisites

Command Syntax

remark REMARK

no remark

Command Mode

MAC ACL Configuration

IP ACL Configuration

Default

None

Usage

The remarks are up to 100 characters. The exceed parts will not be stored and will be truncated.

Examples

This example shows how to add a remark to describe the MAC ACL:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# remark remark of List for mac

This example shows how to remove the remark of the MAC ACL:

Switch# configure terminal
Switch(config)# mac access-list list_mac_1
Switch(config-mac-acl)# no remark

Related Commands

mac access-list

Command Purpose

Use this command to show the MAC ACL information.

Prerequisites

Command Syntax

show access-list mac ( ACL_NAME | )

Command Mode

Privileged EXEC

Default

None

Usage

If no mac acl are specified, all mac access-lists in the system should be shown.

Examples

This example shows how to show the MAC ACL information:

Switch# show access-list mac

mac access-list list_mac_1
 10 deny src-mac host 0000.0001.0002
 20 permit src-mac any

Related Commands

mac access-list

Command Purpose

Use this command to create IP ACL and then enter IP ACL configuration mode.

To remove this ACL, use the no form of this command.

Prerequisites

Command Syntax

ip access-list ACL_NAME

no ip access-list ACL_NAME

Command Mode

Global Config

Default

None

Usage

If the system already has an IP ACL with the same name, this command will enter the IP ACL configuration mode. However, if the ACL name is used by other type of ACL, a prompt message will be shown.

When the name is not used by any ACL, this command is to create the IP ACL firstly and then enter the IP ACL configuration mode.

Examples

This example shows how to create an IP ACL named list_ipv4_1 and then enter the IP ACL configuration mode:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)#

This example shows how to remove the IP ACL named list_ipv4_1:

Switch# configure terminal
Switch(config)# no ip access-list list_ipv4_1

Related Commands

match access-group

Command Purpose

Use this command to discard ongoing IP packets matching the IP filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny ( PROTO_NUM | any ) ( SRC_MAC SRC_MAC_MASK | any | host SRC_MAC ) ( DST_MAC DST_MAC_MASK | any | host DST_MAC ) ( ip-precedence PRECEDENCE | dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

IP ACL Configuration

Default

None

Usage

If IP address wildcard bit is provided, the IP address is logical-and in bitwise with the reverse bits of the wildcard bits. For example, 10.10.10.0 0.0.0.255 means the addresses from 10.10.10.0 to 10.10.10.255 are matched.

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the IP ACL. i.e. when the maximum existing sequence number is 100, the sequence number of subsequent created IP filter is 110.

Examples

This example shows how to create a filter in IP ACL to deny any IP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 1 deny any any

This example shows how to create a filter in IP ACL to deny the fragment packets with the source IP addresss 1.1.1.1:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 2 deny any host 1.1.1.1 any fragments

This example shows how to create a filter in IP ACL to deny any routed packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 3 deny any any any routed-packet

Related Commands

no sequence-num

Command Purpose

Use this command to reject TCP packets matching the IP filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny tcp ( SRC_MAC SRC_MAC_MASK | any | host SRC_MAC ) ( src-port OPERATOR SRC_PORT | ) ( DST_MAC DST_MAC_MASK | any | host DST_MAC ) ( dst-port OPERATOR DST_PORT | ) ( ip-precedence PRECEDENCE | dscp DSCP | ) ( ecn <0-3> | ) ( established | ( match-any | match-all FLAG-NAME | ) | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

IP ACL Configuration

Default

None

Usage

The fragments will be invalid when the layer 4 information is specified (i.e. src-port).

Examples

This example shows how to create a filter in IP ACL to deny any TCP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 1 deny tcp any any

This example shows how to create a filter in IP ACL to deny the TCP packets with the source IP address 1.1.1.1, source port 0-100:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 2 deny tcp host 1.1.1.1 src-port range 0 100 any

This example shows how to create a filter in IP ACL to deny any TCP packets in established TCP streams:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 3 deny tcp any any established

This example shows how to create a filer in IP ACL to deny the TCP ACK packets with the source IP address 1.1.1.1:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 4 deny tcp 10.10.10.0 0.0.0.0 any match-any ack

Related Commands

no sequence-num

Command Purpose

Use this command to reject UDP packets matching the IP filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny udp ( SRC_MAC SRC_MAC_MASK | any | host SRC_MAC ) ( src-port OPERATOR SRC_PORT | ) ( DST_MAC DST_MAC_MASK | any | host DST_MAC ) ( dst-port OPERATOR DST_PORT | ) ( ip-precedence PRECEDENCE | dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

IP ACL Configuration

Default

None

Usage

The fragments will be invalid when the layer 4 information is specified (i.e. src-port).

Examples

This example shows how to create a filter in IP ACL to deny any UDP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 1 deny udp any any

This example shows how to create a filter in IP ACL to deny the UDP packets with the source IP 1.1.1.1, source port 10, and destination port less than 2000:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 2 deny udp host 1.1.1.1 src-port eq 10 any dst-port lt 2000

Related Commands

no sequence-num

Command Purpose

Use this command to reject ICMP packets matching the IP filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny icmp ( SRC_MAC SRC_MAC_MASK | any | host SRC_MAC ) ( DST_MAC DST_MAC_MASK | any | host DST_MAC ) ( icmp-type TYPE-NUM ( icmp-code CODE-NUM | ) | ) ( ip-precedence PRECEDENCE | dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

IP ACL Configuration

Default

None

Usage

This type of filter is mostly used to reject ICMP packets.

Examples

This example shows how to create a filter in IP ACL to deny any ICMP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 1 deny icmp any any

This example shows how to create a filter in IP ACL to deny the ICMP packets with the icmp-type 3 and icmp-code 3:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 2 deny icmp any any icmp-type 3 icmp-code 3

Related Commands

no sequence-num

Command Purpose

Use this command to reject IGMP packets matching the IP filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny igmp ( SRC_MAC SRC_MAC_MASK | any | host SRC_MAC ) ( DST_MAC DST_MAC_MASK | any | host DST_MAC ) ( IGMP-TYPE | ) ( ip-precedence PRECEDENCE | dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

IP ACL Configuration

Default

None

Usage

This type of filter is mostly used to reject IGMP packets.

Examples

This example shows how to create a filter in IP ACL to deny any IGMP packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 1 deny igmp any any

This example shows how to create a filter in IP ACL to deny the IGMP packets with the source IP address 1.1.1.1, any destination IP address and the igmp-type pim:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 2 deny igmp host 1.1.1.1 any pim

Related Commands

no sequence-num

Command Purpose

Use this command to reject GRE packets matching the IP filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny gre ( SRC_MAC SRC_MAC_MASK | any | host SRC_MAC ) ( DST_MAC DST_MAC_MASK | any | host DST_MAC ) ( key KEY mask KEY-MASK ) ( ip-precedence PRECEDENCE | dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Command Mode

IP ACL Configuration

Default

None

Usage

This type of filter is mostly used to reject GRE packets.

Please reference to command “deny” for the other parameters.

Examples

This example shows how to create a filter in IP ACL to deny any GRE packets:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 1 deny gre any any key 0 mask 0

This example shows how to create a filter in IP ACL to deny the GRE packets with the source IP address 1.1.1.1, any destination IP address and the gre key is 10:

Switch# configure terminal
Switch(config)# ip access-list list_ipv4_1
Switch(config-ip-acl)# 2 deny gre host 1.1.1.1 any key 10 mask 0xffffffff

Related Commands

no sequence-num

Command Purpose

Use this command to reject NVGRE packets matching the IP filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny nvgre ( SRC_MAC SRC_MAC_MASK | any | host SRC_MAC ) ( DST_MAC DST_MAC_MASK | any | host DST_MAC ) ( vsid VSID mask VSID-MASK ) ( ip-precedence PRECEDENCE | dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( TIME_RANGE_NAME | )

Please reference to command “deny” for the other parameters.