Deny - Motorola RFS7000 Series Reference Manual

11-4 Overview

11.1.2 deny

MAC Extended ACL Config Commands
Use this command to specify packets that you want to reject.
NOTE Use a decimal value representation of ethertypes to implement a
permit/deny/mark
MAC ACLs provide the hexadecimal values for each listed ether type. The switch
supports all ethertypes. Use the decimal equvilant of the ethertype listed or for
any other type of ethertype.
Syntax
{deny}{any|host source MAC address|source MAC/source MAC address mask} {any|host
destination MAC address|destination MAC/destination MAC address mask}[vlan vlan-
id] [dot1p dot1p-value] [type value|ip|ipv6|arp|vlan|wisp | 0-65535] [log] [rule-
precedence access-list-entry precedence]
Parameters
Source Mask
Destination Mask
dot1p<0-7>
rule-precedence<1-5000>
type(<1-
65535>|arp|ip|ipv6|vlan|wisp)
vlan<1-4095>
Usage Guidelines
The deny command disallows traffic based on layer 2 (data-link layer) information. The MAC access list denies
traffic from a particular source MAC address or any MAC address. It also has an option to disallow traffic from
a list of MAC addresses based on the source mask.
The MAC access list can be configured to disallow traffic based on VLAN information and ethernet type.
The most common ethernet type are:
• arp
• wisp
designation for a packet. The command set for Extended
Bit mask specifying the bits to match. Source wildcard can be any one
of the following:
•
xx:xx:xx:xx:xx:xx/xx:xx:xx:xx:xx:xx
address and mask.
• – Any source host.
any
• Exact source MAC address to match.
host –
Bit mask specifying the bits to match. Source wildcard can be any one
of the following:
•
xx:xx:xx:xx:xx:xx/xx:xx:xx:xx:xx:xx
address and mask.
• – Any destination host.
any
• Exact destination MAC address to match.
host –
802.1p priority value to match.
Access-list entry precedence.
Ether type value represented as integer or keywords for well-known
ethertypes like IP, IPv6, ARP etc.
VLAN tag ID to match.
–Source MAC
–Destination MAC