PLANET XGS3-24040 - Manual (Page 741)

Commands for Security Function Chapter 2 Commands for 802.1x
41-13
Default: No named MAC-IP access-list.
Usage Guide: After assigning this commands for the first time, only an empty name access-list is
created and no list item included.
Examples: Create an MAC-IP ACL named macip_acl.
Switch(config)# mac-ip-access-list extended macip_acl
Switch(Config-MacIp-Ext-Nacl-macip_acl)#
41.19 permit | deny (ip extended)
Command: [no] {deny | permit} icmp {{ } | any-source | {host-source
}} {{ } | any-destination | {host-destination }}
[ []] [precedence ] [tos ][time-range]
[no] {deny | permit} igmp {{ } | any-source | {host-source }}
{{ } | any-destination | {host-destination }} []
[precedence ] [tos ][time-range]
[no] {deny | permit} tcp {{ } | any-source | {host-source }}
[s-port { | range }] {{ } | any-destination |
{host-destination }} [d-port { | range }]
[ack+fin+psh+rst+urg+syn] [precedence ] [tos ][time-range ]
[no] {deny | permit} udp {{ } | any-source | {host-source }}
[s-port { | range }] {{ } | any-destination |
{host-destination }} [d-port { | range }] [precedence
] [tos ][time-range ]
[no] {deny | permit} {eigrp | gre | igrp | ipinip | ip | ospf | < protocol-num >} {{
} | any-source | {host-source }} {{ } | any-destination |
{host-destination }} [precedence ] [tos ][time-range]
Functions: Create a name extended IP access rule to match specific IP protocol or all IP protocol.
Parameters: is the source IP address, the format is dotted decimal notation; <sMask > is the
reverse mask of source IP, the format is dotted decimal notation; is the destination IP address,
the format is dotted decimal notation; <dMask> is the reverse mask of destination IP, the format is dotted
decimal notation, attentive position o, ignored position 1; <igmp-type>, the type of igmp, 0-15;
, the type of icmp, 0-255 ; , protocol No. of icmp, 0-255; , IP priority,
0-7; , to value, 0-15; , source port No., 0-65535; , the down boundary of
source port; , the up boundary of source port; , destination port No. 0-65535;
, the down boundary of destination port; , the up boundary of destination port;
, time range name.
Command Mode: Name extended IP access-list configuration mode
Default: No access-list configured.
Examples: Create the extended access-list, deny icmp packet to pass, and permit udp packet with
destination address 192. 168. 0. 1 and destination port 32 to pass.
Switch(config)# access-list ip extended udpFlow