Filt
Filters and QOS Configuration for Ethernet Routing Switch 5500
Technical Configuration Guide
7.1.2 L2-ACL Configuration
L2 ACLs are added using the following command:
5500 (config)# qos l2-acl name <1..16 character string> ?
block Specify the label to identify access-list elements that are of
the same block
drop-action Specify the drop action
dst-mac Specify the destination MAC classifier criteria
dst-mac-mask Specify the destination MAC mask classifier criteria
ethertype Specify the ethertype classifier criteria
priority Specify the user priority classifier criteria
set-drop-prec Specify the set drop precedence
src-mac Specify the source MAC classifier criteria
src-mac-mask Specify the source MAC mask classifier criteria
update-1p Specify the update user priority
update-dscp Specify the update DSCP
vlan-min Specify the Vlan ID minimum value classifier criteria
vlan-tag Specify the vlan tag classifier criteria
<cr>
7.1.3 ACL-Assign Configuration
Once you have completed the ACL configuration, the ACL name is then assigned at a port level using the
following command:
5500 (config)# qos acl-assi gn port <port # or port #’s> acl-type <ip|l2> name <acl name>
7.1.4 ACL Configuration Example
7.1.4.1 Configuration
Assuming we wish to configure the following:
remark host 172.1.1.10 ftp traffic to CoS class of Silver
remark host 172.1.1.10 http traffic to CoS class of Gold
apply the ACL to port 1/19
To accomplish the above, please enter the following commands:
5500 (config)# qos ip-acl name host src-ip 172.1.1.10/32 protocol 6 src-port-min 21 src-port-
max 21 update-dscp 18 block tcpcommon
5500 (config)# qos ip-acl name host src-ip 172.1.1.10/32 protocol 6 src-port-min 80 src-port-
max 80 update-dscp 26 block tcpcommon
5500 (config)# qos ip-acl name host drop-action disable
5500 (config)# qos acl-assign port 1/19 acl-type ip name host
Please note the following:
1. The first two IP-ACLs are assigned to a block named tcpcommand. Since we
are only allowed up to eight precedence levels, it is a good idea to use block
configuration whenever possible.
2. The third IP-ACL is required to match all other traffic. As the default implicit
action is drop all non-matching traffic, if this command is not entered, only ftp
and http traffic from host 172.1.1.10 would be allowed.
To Next Page
Loading...
