Cisco WS-X6066-SLB-APC - Content Switching Module Software Manual page 327

Chapter 16 Configuring Access Control
This example shows how to commit the ACEs to NVRAM:
Console> (enable) commit security acl all
ACL commit in progress.
ACL IPACL1 is committed to hardware.
Console> (enable)
For more information about the commit security acl all command, see the
Note
section on page
Enter the show security acl info IPACL1 command to verify that the changes were committed. If this
VACL has not been mapped to a VLAN, enter the set security acl map command to map it to a VLAN.
This example shows how to create an ACE for IPACL2 to block traffic from source address 172.20.3.2
and place this ACE before ACE number 2 in the VACL. Optionally, you can use the modify keyword to
replace an existing ACE with a new ACE. Enter the show security acl info acl_name [editbuffer]
command to see the current ACE listing stored in NVRAM (enter the editbuffer keyword to see edit
buffer contents).
Console> (enable) set security acl ip IPACL2 deny host 172.20.3.2 before 2
IPACL2 editbuffer modified. Use 'commit' command to apply changes.
Console> (enable)
This example shows how to create an ACE for IPACL2 to redirect IP traffic to port 3/1 from source
address 1.2.3.4 with the destination address of 255.255.255.255. Note that host can be used as an
abbreviation for a source and source-wildcard of 0.0.0.0. This ACE also specifies the following:
precedence—IP precedence values that range between zero for low priority and seven for high
•
priority.
• tos—Type of service levels that range between 0 and 15.
The ToS is bits 3 through 6 of the IP ToS byte as defined by RFC-1349. The precedence is bits 0 through 2
Note
as defined by RFC-791.
Console> (enable) set security acl ip IPACL2 redirect 3/1 ip 1.2.3.4 0.0.0.255 host
255.255.255.255 precedence 1 tos min-delay
IPACL2 editbuffer modified. Use 'commit' command to apply changes.
Console> (enable)
This example shows how to display the contents of the edit buffer:
Console> (enable) show security acl info IPACL2 editbuffer
set security acl ip IPACL2
-----------------------------------------------------------------
1. deny 172.20.3.2
2. redirect 1.2.3.4
Console> (enable)
For more information about the show security acl info command, see the
Note
a VACL" section on page
This example shows how to commit the ACEs to NVRAM:
Console> (enable) commit security acl all
ACL commit in progress.
78-13315-02
16-35.
16-36.
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
Configuring VACLs
"Committing ACLs"
"Showing the Contents of
16-31