Access Control List (Acl) Commands - D-Link xStack DES-3526 Cli Manual

DES-3526 / DES-3526DC Layer 2 Fast Ethernet Switch CLI Reference Manual

Access Control List (ACL) Commands

The DES-3526 implements Access Control Lists that enable the Switch to deny network access to specific devices or device
groups based on IP settings or MAC address.
Note: The ACL command set has been changed for the Release III firmware. In particular, note the
different role of the profile_id and access_id parameters. The new treatment has changed some of
the command parameters as well.
Command Parameters
[ethernet {vlan | source_mac <macmask> | destination_mac <macmask> | 802.1p |
create
ethernet_type} ip {vlan | source_ip_mask <netmask> | destination_ip_mask <netmask> | dscp |
access_profile
[icmp {type | code} | igmp {type} | tcp {src_port_mask <hex 0x0-0xffff> | dst_port_mask <hex
0x0-0xffff> | flag_mask [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask
<hex 0x0-0xffff> | dst_port_mask <hex 0x0-0xffff>} | protocol_id_mask <hex 0x0 - 0xFF>
{user_define_mask <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff>
<hex 0x0-0xffffffff> <hex 0x0-0xffffffff>}]} | packet_content_mask {offset_0-15 <hex 0x0-0xffffffff>
<hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_16-31 <hex 0x0-0xffffffff>
<hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_32-47 <hex 0x0-0xffffffff>
<hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_48-63 <hex 0x0-0xffffffff>
<hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_64-79 <hex 0x0-0xffffffff>
<hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> } ] [profile_id <value 1-255>]
delete profile_id <value 1-255>
access_profile
config profile_id <value 1-255> [add access_id <value 1-65535> [ethernet {vlan <vlan_name 32> |
access_profile source_mac <macaddr> | destination_mac <macaddr> | 802.1p <value 0-7> | ethernet_type
<hex 0x0-0xffff>} | ip {vlan <vlan_name 32> | source_ip <ipaddr> | destination_ip <ipaddr> |
dscp <value 0-63> | [ icmp {type <value 0-255> code <value 0-255>} | igmp {type <value 0-
255>} | tcp {src_port <value 0-65535> | dst_port <value 0-65535> | flag_mask [all | {urg | ack |
psh | rst | syn | fin} | udp {src_port <value 0-65535> | dst_port <value 0-65535>} | protocol_id
<value 0 - 255> {user_define <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex
0x0-0xffffffff> <hex 0x0-0xffffffff>}]} | packet_content_mask {offset_0-15 <hex 0x0-0xffffffff> <hex
0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_16-31 <hex 0x0-0xffffffff> <hex 0x0-
0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_32-47 <hex 0x0-0xffffffff> <hex 0x0-
0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_48-63 <hex 0x0-0xffffffff> <hex 0x0-
0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_64-79 <hex 0x0-0xffffffff> <hex 0x0-
0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff>}] port <portlist> [permit {priority <value 0-7>
{replace_priority} | replace_dscp_with <value 0-63>} | deny] | delete access_id <value 1-65535>]
show {profile_id <value 1-255> {access_id <value 1-65535>}}
access_profile
Access profiles allow you to establish criteria to determine whether or not the Switch will forward packets based on the
information contained in each packet's header.
Creating an access profile is divided into two basic parts. First, an access profile must be created using the create access_profile
command. For example, if you want to deny all traffic to the subnet 10.42.73.0 to 10.42.73.255, you must first create an access
profile that instructs the Switch to examine all of the relevant fields of each frame.
First create an access profile that uses IP addresses as the criteria for examination:
create access_profile ip source_ip_mask 255.255.255.0 profile_id 1
Here we have created an access profile that will examine the IP field of each frame received by the Switch. Each source IP
address the Switch finds will be combined with the source_ip_mask with a logical AND operation. The profile_id parameter is
used to give the access profile an identifying number − in this case, 1 – and it is used to assign a priority in case a conflict occurs.
145
24