Users Guide

Layer 2 Switching Commands 735
If a packet matches a deny ACL class specified in a class-map, the packet does
not match, no further matching is performed, and the class-map clause is not
matched.
No counters are instantiated for ACLs referenced in a class map.
Command History
Command introduced in version 6.5 firmware.
Example
The following example configures an access list arp-list with a policy that
implements a simple policer for ARP packets coming from any of the hosts
listed in the access list. The policer operates on the aggregate bandwidth of
the matched packet streams.
console(config)#mac access-list extended arp-list
console(config-mac-access-list)#permit 00:01:02:03:04:05 0000.0000.0000 any
0x0806
console(config-mac-access-list)#permit 00:03:04:05:06:07 0000.0000.0000 any
0x0806
console(config-mac-access-list)#permit 00:03:04:05:06:08 0000.0000.0000 any
0x0806
console(config-mac-access-list)#permit 00:03:04:05:06:01 0000.0000.0000 any
0x0806
console(config-mac-access-list)#exit
console(config)#class-map match-any class-arp
console(config-classmap)#match protocol none
console(config-classmap)#match access-group arp-list
console(config-classmap)#exit
console(config)#policy-map arp-limiter in
console(config-policy-map)#class class-arp
console(config-policy-classmap)#police-simple 1000 16 conform-action
transmit violate-action drop
console(config-policy-classmap)#exit
console(config-policy-map)#exit
The above policy must be configured on one or more interfaces to be enabled.