D-Link 3312SR Reference Manual - Page 192

DGS-3312SR Layer 3 Gigabit Switch

186

25

A

CCESS

C

ONTROL

L

IST

(ACL) C

OMMANDS

The DGS-3312SR implements Access Control Lists that enable the switch to deny network access to specific devices or device

groups based on IP settings or MAC address. The ACL commands in the Command Line Interface (CLI) are listed (along with

the appropriate parameters) in the following table.

Command

Parameters

create access_profile

[ethernet {vlan | source_mac <macmask> | destination_mac

<macmask> | 802.1p | ethernet_type} | ip {vlan | source_ip_mask

<netmask> | destination_ip_mask <netmask> | dscp | [icmp {type |

code} | igmp {type} | tcp {src_port_mask <hex 0x0-0xffff> |

dst_port_mask <hex 0x0-0xffff> | flag_mask [all | {urg | ack | psh |

rst | syn | fin}]} | udp {src_port_mask <hex 0x0-0xffff> |

dst_port_mask <hex 0x0-0xffff>} | protocol_id {user_mask <hex

0x0-0xffffffff>}]} | packet_content_mask {offset_0-15 <hex 0x0-

0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-

0xffffffff> | offset_16-31 <hex0x0-0xffffffff> <hex 0x0-0xffffffff>

<hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_32-47 <hex 0x0-


0xffffffff> | offset_48-63 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff>



0xffffffff>}] {port [<portlist> | all]} [profile_id <value 1-255>]

delete access_profile

profile_id

<value 1-255>

config access_profile

profile_id

<value 1-255> [add access_id <value 1-255> [ethernet {vlan

<vlan_name 32> | source_mac <macaddr> | destination_mac

<macaddr> | 802.1p <value 0-7> | ethernet_type <hex 0x0-0xffff>

[permit {priority <value 0-7> {replace_priority}} | deny ] | ip {vlan

<vlan_name 32> | source_ip <ipaddr> | destination_ip <ipaddr> |

dscp <value 0-63> | [icmp {type <value 0-255> code <value 0-

255>} | igmp {type <value 0-255>} | tcp {src_port <value 0-65535>

| dst_port <value 0-65535> | flag_mask [all | {urg | ack | psh | rst |

syn | fin}]} | udp {src_port <value 0-65535> | dst_port <value 0-

65535>} | protocol_id <value 0 - 255> {user_define <hex 0x0-

0xffffffff>}]} [permit {priority <value 0-7> {replace_priority }} | deny ]

| packet_content {offset_0-15 <hex 0x0-0xffffffff> <hex 0x0-

0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_16-31

<hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex

0x0-0xffffffff> | offset_32-47 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff>



0xffffffff> | offset_64-79 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff>

<hex 0x0-0xffffffff> <hex 0x0-0xffffffff>}] [permit {priority <value 0-

7> {replace_priority} | deny] | delete access_id <value 1-255>]

show access_profile

{profile_id <value 1-255>}

Access profiles allow you to establish criteria to determine whether or not the switch will forward packets based on the

information contained in each packet’s header.

These criteria can be specified on a VLAN-by-VLAN basis.

Creating an access profile is divided into two basic parts.

First, an access profile must be created using the

create

access_profile

command.

For example, if you want to deny all traffic to the subnet 10.42.73.0 to 10.42.73.255, you must first

create

an access profile that instructs the switch to examine all of the relevant fields of each frame:

Section	Page
Introduction	7
	7
	7
Accessing the Switch via the Serial Port	7
Setting the Switch’s IP Address	8
Using the Console CLI	10
	10
	10
Connecting to the Switch	10
Command Syntax	16
Basic Switch Commands	18
Switch Port Commands	30
Port Security Commands	33
Network Management (SNMP) Commands	37
Switch Utility Commands	58
Network Monitoring Commands	62
Multiple Spanning Tree Protocol (MSTP) Commands	75
Forwarding Database Commands	88
Broadcast Storm Control Commands	95
QoS Commands	97
Port Mirroring Commands	105
VLAN Commands	110
Link Aggregation Commands	117
IP Commands (Including IP Multinetting)	123
IGMP Commands	128
IGMP Snooping Commands	131
MAC Notification Commands	139
Access Authentication Control Commands	143
SSH Commands	167
SSL Commands	175
802.1X Commands	180
Access Control List (ACL) Commands	192
Traffic Segmentation Commands	201
Stacking Commands	203
D-Link Single IP Management Commands	206
Time and SNTP Commands	216
ARP Commands	222
VRRP Commands	226
Routing Table Commands	233
Route Redistribution Commands	237
BOOTP Relay Commands	243
DNS Relay Commands	247
RIP Commands	251
DVMRP Commands	254
PIM Commands	259
IP Multicasting Commands	263
MD5 Configuration Commands	265
OSPF Configuration Commands	268
Command History List	288
Technical Specifications	290
	296
	296
	296
	296
	296
	296
	296
Copyright Statement: No part of this publication or documentation accompanying this product may be reproduced in any form or by any means or used to make any derivative such as translation, transformation, or adaptation without permission from D-Link Co	296

D-Link 3312SR Reference Manual - Page 192

Access Control List (ACL) Commands, create, access_profile

Page 192 highlights