Dell N3200-ON EMC Networking N-Series Switches CLI Reference Guide version 6.7 - Page 295

Default Configuration This command has no default configuration. Command Mode Global Configuration and Interface Configuration (Ethernet, VLAN, or Port Channel) modes User Guidelines The Global Configuration mode command configures the ACL on all Ethernet and port-channel interfaces, whereas the interface mode command does so for the selected interface. Dell EMC Networking switches support configuration of multiple access groups. Packets are matched against group entries, from lowest sequence number to highest. Configuring an access-group, using the same sequence number as an existing entry, replaces the original group entry. If the access-list specified in the command does not exist, an error is given. The ACLs in the access-group are configured in hardware when the interface becomes active. Resource contention issues will only become apparent at that time. It is recommended that ACLs be configured on an active interface as a check prior to deployment in the network. The optional control-plane keyword allows application of an ACL on the CPU port. Control-plane match actions occur in the egress direction. System level rules are applied on ingress, after application of any user defined ingress rules, therefore, it is not possible to rate limit packets matching the system defined rules with an ACL having a control-plane target. Use the rate-limit cpu command to reduce the effects of low priority traffic on the switch CPU. An implicit deny-all rule is added after the end of the last access group in each direction (in or out). Examples console(config)#ip access-list aclname console(config-ip-acl)#exit console(config)#ip access-group aclname in console(config)#no ip access-group aclname in console(config)#ip access-list aclname1 console(config-ip-acl)#exit console(config)#ip access-group aclname1 out Layer 2 Switching Commands 295