D-Link DGS-3130 Emulator - Page 62

DGS-3130 Layer 3 Stackable Managed Switch CLI Reference Guide The user can use the access-list resequence command to change the start sequence number and the increment number of entries for the specified access list. After the command is applied, new entries without any specified sequence number will be assigned a number based on the new sequence setting of the specified access list. When you manually assign the sequence number, it is better to have a reserved interval for future lower sequence number entries. Otherwise, it will be more difficult to insert an entry with a lower sequence number. The sequence number must be unique in the domain of an access list. If you enter a sequence number that is already present, an error message will be shown. Example This example shows how to create four entries for an IPv6 extended access list named "ipv6-control". These entries are: permit TCP packets destined for network ff02::0:2/16, permit TCP packets destined for host ff02::1:2, permit all TCP packets go to port 80, and permit all ICMP packets. Switch# configure terminal Switch(config)# ipv6 access-list extended ipv6-control Switch(config-ipv6-ext-acl)# permit tcp any ff02::0:2/16 Switch(config-ipv6-ext-acl)# permit tcp any host ff02::1:2 Switch(config-ipv6-ext-acl)# permit tcp any any eq 80 Switch(config-ipv6-ext-acl)# permit icmp any any Switch(config-ipv6-ext-acl)# This example shows how to create two entries for an IPv6 standard access-list named "ipv6-std-control". These entries are: permit IP packets destined for network ff02::0:2/16, and permit IP packets destined for host ff02::1:2. Switch# configure terminal Switch(config)# ipv6 access-list ipv6-std-control Switch(config-ipv6-acl)# permit any ff02::0:2/16 Switch(config-ipv6-acl)# permit any host ff02::1:2 Switch(config-ipv6-acl)# 4-17 permit | deny (mac access-list) This command is used to define the rule for packets that will be permitted or denied. Use the no form command to remove an entry [SEQUENCE-NUMBER] {permit | deny} {any | host SRC-MAC-ADDR | SRC-MAC-ADDR SRC-MACWILDCARD} {any | host DST-MAC-ADDR | DST-MAC-ADDR DST-MAC-WILDCARD} [ethernet-type TYPE MASK [cos VALUE [inner INNER-COS]] [{vlan VLAN-ID} [inner INNER-VLAN]] [time-range PROFILENAME] no SEQUENCE-NUMBER Parameters SEQUENCE-NUMBER any host SRC-MAC-ADDR SRC-MAC-ADDR SRCMAC-WILDCARD host DST-MAC-ADDR Specifies the sequence number. The range is from 1 to 65535. The lower the number is, the higher the priority of the permit/deny rule. Specifies any source MAC address or any destination MAC address. Specifies a specific source host MAC address. Specifies a group of source MAC addresses by using a wildcard bitmap. The bit corresponding to the bit value 1 will be ignored. The bit corresponding to the bit value 0 will be checked. Specifies a specific destination host MAC address. 58