Ip Access-Group - Cisco ME 3400 Command Reference Manual

ip access-group

ip access-group
Use the ip access-group interface configuration command to control access to a Layer 2 interface. Use
the no form of this command to remove all access groups or the specified access group from the
interface. If the switch is running the metro IP access image, you can also control access to Layer 3
interfaces.
Syntax Description access-list-number
name
in
out
Defaults
No access list is applied to the interface.
Command Modes Interface configuration
Command History Release
12.2(25)EX
Usage Guidelines
You can apply named or numbered standard or extended IP access lists to an interface. To define an
access list by name, use the ip access-list global configuration command. To define a numbered access
list, use the access list global configuration command. You can used numbered standard access lists
ranging from 1 to 99 and 1300 to 1999 or extended access lists ranging from 100 to 199 and 2000 to
2699.
The switch must be running the metro IP access image for Layer 3 support.
You can use this command to apply an access list to a Layer 2 interface (port ACL) or Layer 3 interface.
However, note these limitations for port ACLs:
•
•
•
•
Cisco ME 3400 Ethernet Access Switch Command Reference
2-118
ip access-group {access-list-number | name} {in | out}
no ip access-group [access-list-number | name] {in | out}
The number of the IP access control list (ACL). The range is 1 to 199 or
1300 to 2699.
The name of an IP ACL, specified in the ip access-list global configuration
command.
Specify filtering on inbound packets.
Specify filtering on outbound packets. This keyword is valid only on
Layer 3 interfaces.
Modification
This command was introduced.
You can only apply ACLs in the inbound direction; the out keyword is not supported for Layer 2
interfaces.
You can only apply one IP ACL and one MAC ACL per interface.
Port ACLs do not support logging; if the log keyword is specified in the IP ACL, it is ignored.
An IP ACL applied to a Layer 2 interface only filters IP packets. To filter non-IP packets, use the
mac access-group interface configuration command with MAC extended ACLs.
Chapter 2 Cisco ME 3400 Ethernet Access Switch Cisco IOS Commands
OL-9640-07