Example Layer 2 Acl Clauses - Dell PowerConnect B-RX Configuration Manual

The permit | deny argument determines the action to be taken when a match occurs.
The <src-mac> <mask> | any parameter specifies the source MAC address. You can enter a
specific address and a comparison mask or the keyword any to filter on all MAC addresses. Specify
the mask using F's and zeros. For example, to match on the first two bytes of the address
aabb.ccdd.eeff, use the mask ffff.0000.0000. In this case, the clause matches all source MAC
addresses that contain "aabb" as the first two bytes and any values in the remaining bytes of the
MAC address. If you specify any, you do not need to specify a mask and the clause matches on all
MAC addresses.
The <dest-mac> <mask> | any parameter specifies the destination MAC address. The syntax rules
are the same as those for the <src-mac> <mask> | any parameter.
The optional <vlan-id> | any parameter specifies the vlan-id to be matched against the vlan-id of
the incoming packet. You can specify any to ignore the vlan-id match.
The optional etype <etype-str> argument specifies the Ethernet type field of the incoming packet
in order for a match to occur.
The <etype-str> can be one of the following keywords:
•
•
•
The optional <log-enable> parameter enables the logging mechanism. The device accepts this
command only when a deny clause is configured. When you enable logging for a Layer 2 ACL, all
traffic matching the clause is sent to the CPU for processing and traffic is denied by the CPU. The
CPU creates a log entry for the first packet that is denied and once every 10 seconds thereafter.
The logging mechanism includes sending SNMP traps and log messages to the Syslog servers and
writing the log entry to the log buffer on the device.
In addition, if specified with a 'permit' action, the log-enable keyword is ignored and the user is
warned that he cannot log permit traffic.
NOTE
Traffic denied by the implicit deny mechanism is not subject to logging. The implicit deny mechanism
kicks in when the traffic does not match any of the clauses specified and there is no permit any any
clause specified at the end.
Use the [no] parameter to delete the Layer 2 ACL clause from the table. When all clauses are
deleted from a table, the table is automatically deleted from the system.

Example Layer 2 ACL clauses

The following shows some examples of valid Layer 2 ACL clauses.
BigIron RX(config)# access-list 400 permit any any
BigIron RX(config)# access-list 400 permit any any log-enable
BigIron RX(config)# access-list 400 permit any any 100
BigIron RX(config)# access-list 400 permit any any 100 log-enable
BigIron RX(config)# access-list 400 permit any any any
BigIron RX(config)# access-list 400 permit any any any log-enable
BigIron RX(config)# access-list 400 permit any any 100 etype ipv4
BigIron RX(config)# access-list 400 permit any any 100 etype ipv4 log-enable
BigIron RX Series Configuration Guide
53-1001810-01
IPv4-Len-5 (Etype=0x0800, IPv4, HeaderLen 20 bytes)
ARP (Etype=0x0806, IP ARP)
IPv6 (Etype=0x86dd, IP version 6)
Configuring Layer 2 ACLs
20
507