Qtech QSW-2900-24T-AC [130/209] User defined acl

8-128
access-list link name [ match-order { config | auto } ]
Defining layer 2 ACL rule(layer 2 ACL with name ID configuration mode)
{ permit | deny } [ protocol ] ingress { { [ source-vlan-id ] [ interface interface-num] } | any }
[ time-range time-range-name ]
Delete all the subitems or one subitem in one ACL with number ID or name ID or all ACLs.(global
configuration mode)
no access-list { all | { access-list-number | name access-list-name } [ subitem ] }
Use { permit | deny } command repeatedly to define more rules for the same ACL. Specifying matching order
cannot be modified.
By default, the matching order is user configured order (config).
Concrete parameter meaning refers to corresponded command line.
8.3.6 User-defined ACL
Switch can define at most 100 user-defined ACL with the number ID (the number is in the range of 300 to
399), at most 1000 user-defined ACL with the name ID and totally 3000 sub-rules. It can define 128 sub-rules for an
ACL (this rule can suit both ACL with name ID and number ID). User-defined ACL can match 13 byte after Source
MAC or 802.1Q TAG of data frame according to the users definition and match ingress interface and VLAN ID to
make corresponded handling to data packet. Using user-defined ACL correctly should be better understanding the
construction of layer 2 data frame. In switch system, packet is in the form of 802.3 frame of SNAP+tag, so
user-defined ACL should be configured as the form of 802.3 frame of SNAP+tag.
In user-defined ACL, user can using rule mask and offset value to extract 13 byte from data frame to
compare with user-defined rule to filtrate matched data frame to make corresponded handling. User-defined rule can
be some fixed attribution of data, such as: user can define rule to be 06, rule mask to be FF, offset value to be 12.
Rule mask and offset value can extract TCP protocol byte content of received data frame to compare with rule to
match all TCP packet.
a) Define user-defined ACL based on number ID
User-defined ACL based on number ID is using number to be ID of user-defined ACL. Use following
command to define user-defined ACL based on number ID.
access-list access-list-number4 { permit | deny } { rule-string rule-mask offset }&<1-20> [ ingress
interface interface-num ] [ time-range time-range-name ]
Define the matching order of ACL:
access-list access-list-number match-order { config | auto }
Delete all the subitems or one subitem in one ACL with number ID or name ID or all ACLs.
no access-list { all | { access-list-number | name access-list-name } [ subitem ] }
Use access-list command repeatedly to define more rules for the same ACL.
The number ID of user-defined ACL is in the range of 300 to 399. Concrete parameter meaning refers to
corresponded command line.
b) Define standard ACL with name ID.
Defining user-defined ACL with name ID should enter specified configuration mode: use access-list user in
global configuration mode which can specify matching order of ACL. Use exit command to be back from this mode.
Use following commands to define user-defined ACL with name ID. Configure it in corresponded mode.
Enter user-defined ACL with name ID configuration mode(global configuration mode)
access-list user name [ match-order { config | auto } ]

Содержание

Скачать
Случайные обсуждения