Table of Contents
Advertisement
The assign-queue parameter allows specification of a particular hardware queue for handling traffic that matches this rule.
The allowed <queue-id> value is 0–7, and the number of user-configurable queues available for the switch is 8. The
assign-queue parameter is valid only for a permit rule.
The mirror parameter allows the traffic matching this rule to be copied to the specified <slot/port>.
Note: The special command form {deny | permit} any any is used to match all Ethernet layer 2 packets,
and is the equivalent of the IP access list "match every" rule.
Format
{deny|permit} {<srcmac> | any} {<dstmac> | any} [<ethertypekey> | <0x0600-
0xFFFF>] [vlan {eq <0-4095>}] [cos <0-7>] [[log] [assign-queue <queue-id>]]
[{mirror | redirect} <slot/port>]
Mode
Mac-Access-List Config
mac access-group
This command either attaches a specific MAC Access Control List (ACL) identified by <name> to an interface, or associates
it with a VLAN ID, in a given direction. The <name> parameter must be the name of an existing MAC ACL.
An optional sequence number may be specified to indicate the order of this mac access list relative to other mac access lists
already assigned to this interface and direction. A lower number indicates higher precedence order. If a sequence number
is already in use for this interface and direction, the specified mac access list replaces the currently attached mac access
list using that sequence number. If the sequence number is not specified for this command, a sequence number that is one
greater than the highest sequence number currently in use for this interface and direction is used.
This command specified in 'Interface Config' mode only affects a single interface, whereas the 'Global Config' mode setting
is applied to all interfaces. The VLAN keyword is only valid in the 'Global Config' mode. The 'Interface Config' mode
command is only available on platforms that support independent per-port class of service queue configuration.
Format
mac access-group <name> [vlan <vlan-id>] in [sequence <1-4294967295>]
Modes
• Global Config
• Interface Config
no mac access-group
This command removes a MAC ACL identified by <name> from the interface in a given direction.
Format
no mac access-group <name> [vlan <vlan-id>] in
Modes
• Global Config
• Interface Config
show mac access-lists
This command displays a MAC access list and all of the rules that are defined for the MAC ACL. Use the [name] parameter
to identify a specific MAC ACL to display.
Format
show mac access-lists [name]
Mode
Privileged EXEC
MAC Access Control List Commands
399
Advertisement
Table of Contents
