CLI Reference Guide-R07

Chapter 10 | Access Control Lists
MAC ACLs
– 348 –
permit, deny (MAC ACL) This command adds a rule to a MAC ACL. The rule filters packets matching a
specified MAC source or destination address (i.e., physical layer address), or
Ethernet protocol type. Rules can also filter packets based on IPv4/v6 addresses,
including Layer 4 ports and protocol types. Use the no form to remove a rule.
Syntax
{permit | deny}
{any | host source | source address-bitmask}
{any | host destination | destination address-bitmask}
[cos cos cos-bitmask] [vid vid vid-bitmask]
[ethertype ethertype [ethertype-bitmask]]
[time-range time-range-name]
no {permit | deny}
{any | host source | source address-bitmask}
{any | host destination | destination address-bitmask}
[cos cos cos-bitmask] [vid vid vid-bitmask]
[ethertype ethertype [ethertype-bitmask]]
Note: The default is for Ethernet II packets.
{permit | deny} tagged-eth2
{any | host source | source address-bitmask}
{any | host destination | destination address-bitmask}
[cos cos cos-bitmask] [vid vid vid-bitmask]
[ethertype ethertype [ethertype-bitmask]]
[time-range time-range-name]
no {permit | deny} tagged-eth2
{any | host source | source address-bitmask}
{any | host destination | destination address-bitmask}
[cos cos cos-bitmask] [vid vid vid-bitmask]
[ethertype ethertype [ethertype-bitmask]]
{permit | deny} untagged-eth2
{any | host source | source address-bitmask}
{any
| host destination | destination address-bitmask}
[ethertype ethertype [ethertype-bitmask]]
[time-range time-range-name]
no {permit | deny} untagged-eth2
{any | host source | source address-bitmask}
{any | host destination | destination address-bitmask}
[ethertype ethertype [ethertype-bitmask]]
{permit | deny} tagged-802.3
{any | host source | source address-bitmask}
{any | host destination | destination address-bitmask}
[cos cos cos-bitmask] [vid vid vid-bitmask]
[time-range time-range-name]
no {permit | deny} tagged-802.3
{any | host
source | source address-bitmask}