Cisco 3845 - Security Bundle Router Software Manual page 519

Chapter 27 Configuring QoS
Switch(config)# access-list 100 permit ip any any dscp 32
This example shows how to create an ACL that permits IP traffic from a source host at 10.1.1.1 to a
destination host at 10.1.1.2 with a ToS value of 5:
Switch(config)# access-list 100 permit ip host 10.1.1.1 host 10.1.1.2 tos 5
Creating Layer 2 MAC ACLs
Beginning in privileged EXEC mode, follow these steps to create a Layer 2 MAC ACL for non-IP traffic:
Command
Step 1 configure terminal
Step 2 mac access-list extended name
Step 3
permit {any | host dst-MAC-addr |
dst-MAC-addr mask} [type mask]
Note Although visible in the
command-line help, the host
src-MAC-addr mask keywords
are not supported.
Step 4 end
Step 5 show access-lists [access-list-number |
access-list-name]
Step 6
copy running-config startup-config
To delete an access list, use the no mac access-list extended access-list-name global configuration
command.
This example shows how to create a Layer 2 MAC ACL with a permit statement that allows traffic from
the host with MAC address 0001.0000.0001 to the host with MAC address 0002.0000.0001.
Switch(config)# mac access-list extended maclist1
Switch(config-ext-macl)# permit 0001.0000.0001 0.0.0 0002.0000.0001 0.0.0
Switch(config-ext-macl)# exit
OL-23400-01
Purpose
Enter global configuration mode.
Create a Layer 2 MAC ACL by specifying the name of the list and enter
extended MAC ACL configuration mode.
Always use the permit keyword for ACLs used as match criteria in QoS
policies.
• For dst-MAC-addr, enter the MAC address of the host to which the
packet is being sent. You can specify in hexadecimal format (H.H.H),
use the any keyword for source 0.0.0, source-wildcard ffff.ffff.ffff, or
use the host keyword for source 0.0.0.
• For mask, enter the wildcard bits by placing ones in the bit positions
that you want to ignore.
(Optional) For type mask, specify the Ethertype number of a packet
•
with Ethernet II or SNAP encapsulation to identify the protocol of
the packet. For type, the range is from 0 to 65535, typically specified
in hexadecimal. For mask, enter the don't care bits applied to the
Ethertype before testing for a match. Although other Ethertypes are
visible in the command-line help, only IPv4 and MPLS are
supported. If you enter another Ethertype, the command is rejected.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Cisco ME 3800X and 3600X Switch Software Configuration Guide
Configuring QoS
27-31