Quick Reference Guide

PowerConnect B-Series TI24X Configuration Guide 385
53-1002269-02
Enabling ACL filtering based on VLAN membership or VE port membership
13
Enter the no form of the command to disable this feature.
Applying an IPv4 ACL to specific VLAN members on
a port (Layer 2 devices only)
When you bind an IPv4 ACL to a port, the port filters all inbound traffic on the port. However, on a
tagged port, there may be a need to treat packets for one VLAN differently from packets for another
VLAN. You can configure a tagged port on a Layer 2 device to filter packets based on the packets’
VLAN membership.
NOTE
Before you can bind an ACL to specific VLAN members on a port, you must first enable support for
this feature. If this feature is not already enabled on your device, enable it as instructed in the
section “Enabling ACL filtering based on VLAN membership or VE port membership” on page 384.
To apply an IPv4 ACL to a specific VLAN on a port, enter commands such as the following on a
tagged port.
PowerConnect(config)# vlan 12 name vlan12
PowerConnect(config-vlan-12)# untag ethernet 5 to 8
PowerConnect(config-vlan-12)# tag ethernet 23 to 24
PowerConnect(config-vlan-12)# exit
PowerConnect(config)# access-list 10 deny host 209.157.22.26 log
PowerConnect(config)# access-list 10 deny 209.157.29.12 log
PowerConnect(config)# access-list 10 deny host IPHost1 log
PowerConnect(config)# access-list 10 permit
PowerConnect(config)# int e 23
PowerConnect(config-if-e10000-23))# per-vlan 12
PowerConnect(config-if-e10000-23-vlan-12))# ip access-group 10 in
The commands in this example configure port-based VLAN 12, and add ports e 5 – 8 as untagged
ports and ports e 23 – 24 as tagged ports to the VLAN. The commands following the VLAN
configuration commands configure ACL 10. Finally, the last three commands apply ACL 10 on
VLAN 12 for which port e 23 is a member.
Syntax: per-vlan <VLAN ID>
Syntax: [no] ip access-group <ACL ID>
The <VLAN ID> parameter specifies the VLAN name or number to which you will bind the ACL.
The <ACL ID> parameter is the access list name or number.
Applying an IPv4 ACL to a subset of ports on a virtual
interface (Layer 3 devices only)
You can apply an IPv4 ACL to a virtual routing interface. The virtual interface is used for routing
between VLANs and contains all the ports within the VLAN. The IPv4 ACL applies to all the ports on
the virtual routing interface. You also can specify a subset of ports within the VLAN containing a
specified virtual interface when assigning an ACL to that virtual interface.
Use this feature when you do not want the IPv4 ACLs to apply to all the ports in the virtual interface
VLAN or when you want to streamline IPv4 ACL performance for the VLAN.