Configuration Guide User guide

1734 FastIron Configuration Guide
53-1002494-02
Enabling ACL filtering based on VLAN membership or VE port membership
Enabling ACL filtering based on VLAN membership or VE port
membership
NOTE
This section applies to IPv4 ACLs only. IPv6 ACLs do not support ACL filtering based on VLAN
membership or VE port membership.
This feature is not applicable to outbound traffic.
You can apply an inbound IPv4 ACL to specific VLAN members on a port (Layer 2 devices only) or to
specific ports on a virtual interface (VE) (Layer 3 Devices only). By default, this feature support is
disabled. To enable it, enter the following commands at the Global CONFIG level of the CLI.
Brocade(config)#enable ACL-per-port-per-vlan
Brocade(config)#write memory
Brocade(config)#exit
Brocade#reload
NOTE
For complete configuration examples, see “Applying an IPv4 ACL to specific VLAN members on a port
(Layer 2 devices only)” on page 1734 and “Applying an IPv4 ACL to a subset of ports on a virtual
interface (Layer 3 devices only)” on page 1735.
NOTE
For FastIron X Series devices, you must save the configuration and reload the software to place the
change into effect.
Syntax: [no] enable ACL-per-port-per-vlan
Enter the no form of the command to disable this feature.
Configuration notes for ACL filtering
• Before enabling this feature on an IPv4 device, make sure the VLAN numbers are contiguous.
For example, the VLAN numbers can be 201, 202, 203, and 204, but not 300, 401, 600, and
900.
• Brocade devices do not support a globally-configured PBR policy together with
per-port-per-VLAN ACLs.
• IPv4 ACLs that filter based on VLAN membership or VE port membership
(ACL-per-port-per-VLAN), are supported together with IPv6 ACLs on the same device, as long as
they are not bound to the same port or virtual interface.
Applying an IPv4 ACL to specific VLAN members on
a port (Layer 2 devices only)
NOTE
This section applies to IPv4 ACLs only. IPv6 ACLs do not support ACL filtering based on VLAN
membership.