Users Guide

Security Commands 1161
Command Mode
Management Access-list Configuration mode
User Guidelines
Rules with gigabitethernet, tengigabitethernet, fortygigabitethernet, vlan,
and port-channel parameters are valid only if an IP address is defined on the
appropriate interface.
If the priority-value is not specified when inputing a rule, the system assigns
the lowest numbered unused priority-value in the range 1–64. If a rule is
input with an existing priority-value, the original rule is overwritten.
Examples
The following example shows how to permit access to switch management via
VLAN interface 9. Be sure to restrict access to this VLAN to the fewest ports
possible remembering that, by default, trunk mode ports are members of all
VLANs.
console(config)#vlan 9
console(config-vlan9)#exit
console(config)#management access-list mlist
console(config-macal)#permit vlan 9 priority 1
console(config-macal)#exit
console(config)#management access-class mlist
The following example shows how to configure all VLAN interfaces to
support switch management access except for two VLAN interfaces.
console(config)#vlan 9,10
console(config-vlan9-10)#exit
console(config)#management access-list mlist
console(config-macal)#deny vlan 9 priority 1
console(config-macal)#deny vlan 10 priority 2
console(config-macal)#permit priority 3
console(config-macal)#exit
console(config) #management access-class mlist
show management access-class
Use the show management access-class command to display information
about the active management access list.