Configuration Guide User guide

1728 FastIron Configuration Guide
53-1002494-02
Applying an ACL to a virtual interface in a protocol- or subnet-based VLAN
Syntax: show running-config
The following example shows the comment text for an ACL in a show access-list display. The output
is identical in a show ip access-list display.
Syntax: show access-list <ACL-num> | <ACL-name> | all
or
Syntax: show ip access-list <ACL-num> | <ACL-name> | all
Applying an ACL to a virtual interface in a protocol-
or subnet-based VLAN
By default, when you apply an ACL to a virtual interface in a protocol-based or subnet-based VLAN,
the ACL takes effect on all protocol or subnet VLANs to which the untagged port belongs. To
prevent the Brocade device from denying packets on other virtual interfaces that do not have an
ACL applied, configure an ACL that permits packets in the IP subnet of the virtual interface in all
protocol-based or subnet-based VLANs to which the untagged port belongs. The following is an
example configuration.
Brocade#conf t
Brocade(config)#vlan 1 name DEFAULT-VLAN by port
Brocade(config-vlan-1)#ip-subnet 192.168.10.0 255.255.255.0
Brocade(config-vlan-ip-subnet)#static ethe 1
Brocade(config-vlan-ip-subnet)#router-interface ve 10
Brocade(config-vlan-ip-subnet)#ip-subnet 10.15.1.0 255.255.255.0
Brocade(config-vlan-ip-subnet)#static ethe 1
Brocade(config-vlan-ip-subnet)#router-interface ve 20
Brocade(config-vlan-ip-subnet)#logging console
Brocade(config-vlan-ip-subnet)#exit
Brocade(config-vlan-1)#no vlan-dynamic-discovery
Vlan dynamic discovery is disabled
Brocade(config-vlan-1)#int e 2
Brocade(config-if-e1000-2)#disable
Brocade(config-if-e1000-2)#interface ve 10
Brocade(config-vif-10)#ip address 192.168.10.254 255.255.255.0
Brocade(config-vif-10)#int ve 20
Brocade(config-vif-20)#ip access-group test1 in
Brocade(config-vif-20)#ip address 10.15.1.10 255.255.255.0
Brocade(config-vif-20)#exit
Brocade(config)#ip access-list extended test1
Brocade#show access-list
IP access list rate-limit 100 aaaa.bbbb.cccc
Extended IP access list TCP/UDP (Total flows: N/A, Total packets: N/A)
ACL Remark: The following line permits TCP packets
permit tcp 0.0.0.40 255.255.255.0 0.0.0.2 255.255.255.0 (Flows: N/A, Packets:
N/A)
ACL Remark: The following line permits UDP packets
permit udp 0.0.0.52 255.255.255.0 0.0.0.2 255.255.255.0 (Flows: N/A, Packets:
N/A)
deny ip any any (Flows: N/A, Packets: N/A)