HP Mellanox SX1018 Mellanox MLNX-OS User Manual for SX1018HP Ethernet Managed - Page 74

Configuring Access Control List, ACL Actions

Get HP Mellanox SX1018 PDF manuals and user guides View all HP Mellanox SX1018 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 74 highlights

Rev 1.6.2 5.9.1 Configuring Access Control List Access Control List (ACL) is configured by the user and is applied to a port once the ACL search engine matches search criteria with a received packet.  To configure ACL: Step 1. Log in as admin. Step 2. Enter config mode. Run: switch > enable switch # configure terminal Step 3. Create a MAC / IPv4 ACL (access-list) entity. switch (config) mac access-list mac-acl switch (config mac access-list mac-acl) # Step 4. Add a MAC / IP rules to the appropriate access-list. switch (config mac access-list mac-acl)seq-number 10 deny 0a:0a:0a:0a:0a:0a mask ff:ff:ff:ff:ff:ff any vlan 6 cos 2 protocol 80 switch (config mac access-list mac-acl) # Step 5. Bind the created access-list to an interface (slot/port or port-channel). switch (config) switch (config) # interface ethernet 1/1 switch (config interface ethernet 1/1) # mac port access-group mac-acl 5.9.2 ACL Actions An ACL action is a set of actions can be activated in case the packet hits the ACL rule.  To modify the VLAN tag of the egress traffic as part of the ACL "permit" rule: Step 1. Create access-list action profile: a.Create an action access-list profile using the command access-list action b.Add rule to map a VLAN using the command vlan-map within the action profile configuration mode Step 2. Create an access-list and bind the action rule: Step 3. a.Create an access-list profile using the command ipv4/mac access-list b.Add access list rule using the command deny/permit (action ) Bind the access-list to an interface using the command ipv4/mac port access-group Create an action profile and add vlan mapping action: switch (config)#access-list action my-action switch (config access-list action my-action) # vlan-map 20 switch (config access-list action my-action) #exit Create an access list and bind rules: switch (config)# mac access-list my-list switch (config mac access-list my-list)# permit any any action my-action switch (config mac access-list my-list)# exit Bind an access-list to a port: Switch (config)# interface ethernet 1/1 Switch (config interface ethernet 1/1)# mac port access-group my-list Mellanox Technologies 74

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
Rev 1.6.2
Mellanox Technologies
74
5.9.1
Configuring Access Control List
Access Control List (ACL) is configured by the user and is applied to a port once the ACL search
engine matches search criteria with a received packet.
To configure ACL:
Step 1.
Log in as admin.
Step 2.
Enter config mode. Run:
Step 3.
Create a MAC / IPv4 ACL (access-list) entity.
Step 4.
Add a MAC / IP rules to the appropriate access-list.
Step 5.
Bind the created access-list to an interface (slot/port or port-channel).
5.9.2
ACL Actions
An ACL action is a set of actions can be activated in case the packet hits the ACL rule.
To modify the VLAN tag of the egress traffic as part of the ACL “permit” rule:
Step 1.
Create access-list action profile:
a.Create an action access-list profile using the command
access-list action <action-profile-
name>
b.Add rule to map a VLAN using the command
vlan-map <vlan-id>
within the action profile config-
uration mode
Step 2.
Create an access-list and bind the action rule:
a.Create an access-list profile using the command
ipv4/mac access-list
b.Add access list rule using the command
deny/permit
(action <action profile name>)
Step 3.
Bind the access-list to an interface using the command
ipv4/mac port access-group
switch > enable
switch # configure terminal
switch (config) mac access-list mac-acl
switch (config mac access-list mac-acl) #
switch (config mac access-list mac-acl)seq-number 10 deny 0a:0a:0a:0a:0a:0a mask
ff:ff:ff:ff:ff:ff any vlan 6 cos 2 protocol 80
switch (config mac access-list mac-acl) #
switch (config)
switch (config) # interface ethernet 1/1
switch (config interface ethernet 1/1) # mac port access-group mac-acl
Create an action profile and add vlan mapping action:
switch (config)#access-list action my-action
switch (config access-list action my-action) # vlan-map 20
switch (config access-list action my-action) #exit
Create an access list and bind rules:
switch (config)# mac access-list my-list
switch (config mac access-list my-list)# permit any any action my-action
switch (config mac access-list my-list)# exit
Bind an access-list to a port:
Switch (config)# interface ethernet 1/1
Switch (config interface ethernet 1/1)# mac port access-group my-list