Home » Netgear Manuals » Hubs & Switches » Netgear GSM7224P » Manual Viewer

Netgear GSM7224P GSM5212P/GSM7212P/GSM7212F/GSM7224P User Manual - Page 364

MAC ACL Example Configuration

Add to My Manuals
Save this manual to your list of manuals

Page 364 highlights

Web Management User Guide criteria to a particular queue or redirect the traffic to a particular port. A default deny all rule is the last rule of every list. 2. APPLY the access list to an interface in the inbound direction. ProSafe® Managed Switches allow ACLs to be bound to physical ports and LAGs. The switch software supports MAC ACLs and IP ACLs. MAC ACL Example Configuration The following example shows how to create a MAC-based ACL that permits Ethernet traffic from the Sales department on specified ports and denies all other traffic on those ports. 1. From the MAC ACL screen, create an ACL with the name Sales_ACL for the Sales department of your network (See MAC ACL on page 534). By default, this ACL will be bound on the inbound direction, which means the switch will examine traffic as it enters the port. 2. From the MAC Rules screen, create a rule for the Sales_ACL with the following settings: • ID: 1 • Action: Permit • Assign Queue ID: 0 • Match Every: False • CoS: 0 • Destination MAC: 01:02:1A:BC:DE:EF • Destination MAC Mask: 00:00:00:00:FF:FF • EtherType User Value: • Source MAC: 02:02:1A:BC:DE:EF • Source MAC Mask: 00:00:00:00:FF:FF • VLAN ID: 2 For more information about MAC ACL rules, see MAC Rules on page 536. 3. From the MAC Binding Configuration screen, assign the Sales_ACL to the interface gigabit ports 6, 7, and 8, and then click APPLY (See MAC Binding Configuration on page 538). You can assign an optional sequence number to indicate the order of this access list relative to other access lists if any are already assigned to this interface and direction. 4. The MAC Binding Table displays the interface and MAC ACL binding information (See MAC Binding Table on page 540). The ACL named Sales_ACL looks for Ethernet frames with destination and source MAC addresses and MAC masks defined in the rule. Also, the frame must be tagged with VLAN ID 2, which is the Sales department VLAN. The CoS value of the frame must be 0, which is the default value for Ethernet frames. Frames that match this criteria are permitted on interfaces 6, 7, and 8 and are assigned to the hardware egress queue 0, which is the default queue. All other traffic is explicitly denied on these interfaces. To allow additional traffic to enter these 364

Section	Page
ProSafe® Managed Switch	1
Contents	3
1. Getting Started	8
Switch Management Interface	8
Web Access	8
Understanding the User Interfaces	9
Using the Web Interface	9
Using SNMP	14
Interface Naming Convention	14
2. Configuring System Information	16
Management	16
System Information	16
Switch Statistics	21
System CPU Status	24
Loopback Interface	26
Network Interface	27
Time	31
DNS	38
SDM Template Preference	40
Services	42
DHCP Server	42
DHCP Relay	51
DHCP L2 Relay	52
UDP Relay	55
PoE	57
Basic	57
Advanced	59
SNMP	64
SNMPV1/V2	64
SNMP V3	70
LLDP	71
LLDP	72
LLDP-MED	78
ISDP	87
Basic	87
Advanced	88
Timer Schedule	93
Timer Global Configuration	93
Timer Schedule Configuration	94
3. Configuring Switching Information	96
VLANs	96
Basic	97
Advanced	99
Spanning Tree Protocol	112
Basic	112
Advanced	115
Multicast	127
MFDB	127
IGMP Snooping	129
MLD Snooping	140
MVR Configuration	147
Basic	147
Advanced	148
Address Table	152
Basic	152
Advanced	154
Ports	158
Port Configuration	158
Port Description	160
Link Aggregation Groups	161
LAG Configuration	162
LAG Membership	163
4. Routing	166
Routing Table	166
Basic	167
Advanced	169
IP	171
Basic	171
Advanced	178
VLAN	186
VLAN Routing Wizard	187
VLAN Routing Configuration	188
ARP	189
Basic	189
Advanced	190
Router Discovery	193
5. Configuring Quality of Service	196
Class of Service	197
Basic	197
Advanced	199
Differentiated Services	204
DiffServ Wizard	205
Auto VoIP Configuration	207
Basic	207
Advanced	209
6. Managing Device Security	224
Management Security Settings	224
Local User	224
Enable Password Configuration	227
Line Password Configuration	227
RADIUS	228
Configuring TACACS+	234
Authentication List Configuration	236
Login Sessions	240
Configuring Management Access	241
HTTP	241
HTTPS	243
SSH	246
Telnet	249
Console Port	251
Denial of Service	252
Port Authentication	253
Basic	254
Advanced	255
Traffic Control	262
MAC Filter	263
Port Security	265
Private Group	270
Protected Ports Configuration	272
Storm Control	273
Control	275
DHCP Snooping	275
IP Source Guard	281
Dynamic ARP Inspection	283
Configuring Access Control Lists	288
ACL Wizard	288
Basic	289
Advanced	294
7. Monitoring the System	308
Ports	308
Port Statistics	309
Port Detailed Statistics	311
EAP Statistics	317
Cable Test	320
Logs	321
Buffered Logs	322
Command Log Configuration	324
Console Log Configuration	324
SysLog Configuration	325
Trap Logs	326
Event Logs	328
Persistent Logs	329
Port Mirroring	330
Multiple Port Mirroring	330
sFlow	332
Basic	332
Advanced	333
8. Maintenance	336
Save Configuration	336
Save Configuration	336
Auto Install Configuration	337
Reset	337
Device Reboot	338
Factory Default	338
Password Reset	339
Upload File From Switch	339
File Upload	340
HTTP File Upload	341
USB File Upload	342
Download File To Switch	342
File Download	343
HTTP File Download	344
USB File Download	346
File Management	347
Copy	347
Dual Image Configuration	348
Troubleshooting	349
Ping IPv4	349
Ping IPv6	350
Traceroute IPv4	351
Traceroute IPv6	352
9. Help	354
Online Help	354
Support	354
User Guide	355
A. Default Settings	357
B. Configuration Examples	361
Virtual Local Area Networks (VLANs)	361
VLAN Example Configuration	362
Access Control Lists (ACLs)	363
MAC ACL Example Configuration	364
Standard IP ACL Example Configuration	365
Differentiated Services (DiffServ)	366
Class	366
DiffServ Traffic Classes	367
Creating Policies	367
DiffServ Example Configuration	368
802.1X	370
802.1X Example Configuration	371
MSTP	372
MSTP Example Configuration	374
C. Notification of Compliance	378

Match case Limit results 1 per page

364

Web Management User Guide

criteria to a particular queue or redirect the traffic to a particular port. A default

deny all

rule is the last rule of every list.

APPLY the access list to an interface in the inbound direction.

ProSafe® Managed Switches allow ACLs to be bound to physical ports and LAGs. The

switch software supports MAC ACLs and IP ACLs.

MAC ACL Example Configuration

The following example shows how to create a MAC-based ACL that permits Ethernet traffic

from the Sales department on specified ports and denies all other traffic on those ports.

From the MAC ACL screen, create an ACL with the name Sales_ACL for the Sales

department of your network (See

MAC ACL

on page

534).

By default, this ACL will be bound on the inbound direction, which means the switch will

examine traffic as it enters the port.

From the MAC Rules screen, create a rule for the Sales_ACL with the following settings:

•

ID: 1

•

Action: Permit

•

Assign Queue ID: 0

•

Match Every: False

•

CoS: 0

•

Destination MAC: 01:02:1A:BC:DE:EF

•

Destination MAC Mask: 00:00:00:00:FF:FF

•

EtherType User Value:

•

Source MAC: 02:02:1A:BC:DE:EF

•

Source MAC Mask: 00:00:00:00:FF:FF

•

VLAN ID: 2

For more information about MAC ACL rules, see

MAC Rules

on page

536.

From the MAC Binding Configuration screen, assign the Sales_ACL to the interface gigabit

ports 6, 7, and 8, and then click

APPLY

(See

MAC Binding Configuration

on page

538).

You can assign an optional sequence number to indicate the order of this access list

relative to other access lists if any are already assigned to this interface and direction.

The MAC Binding Table displays the interface and MAC ACL binding information (See

MAC

Binding Table

on page

540).

The ACL named Sales_ACL looks for Ethernet frames with destination and source MAC

addresses and MAC masks defined in the rule. Also, the frame must be tagged with VLAN ID

2, which is the Sales department VLAN. The CoS value of the frame must be 0, which is the

default value for Ethernet frames. Frames that match this criteria are permitted on interfaces

6, 7, and 8 and are assigned to the hardware egress queue 0, which is the default queue. All

other traffic is explicitly denied on these interfaces. To allow additional traffic to enter these