Cisco 3845 - Security Bundle Router

27-31
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
Chapter 27 Configuring QoS
Configuring QoS
Switch(config)# access-list 100 permit ip any any dscp 32
This example shows how to create an ACL that permits IP traffic from a source host at 10.1.1.1 to a
destination host at 10.1.1.2 with a ToS value of 5:
Switch(config)# access-list 100 permit ip host 10.1.1.1 host 10.1.1.2 tos 5
Creating Layer 2 MAC ACLs
Beginning in privileged EXEC mode, follow these steps to create a Layer 2 MAC ACL for non-IP traffic:
To delete an access list, use the no mac access-list extended access-list-name global configuration
command.
This example shows how to create a Layer 2 MAC ACL with a permit statement that allows traffic from
the host with MAC address 0001.0000.0001 to the host with MAC address 0002.0000.0001.
Switch(config)# mac access-list extended maclist1
Switch(config-ext-macl)# permit 0001.0000.0001 0.0.0 0002.0000.0001 0.0.0
Switch(config-ext-macl)# exit
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
mac access-list extended name Create a Layer 2 MAC ACL by specifying the name of the list and enter
extended MAC ACL configuration mode.
Step 3
permit {any | host dst-MAC-addr |
dst-MAC-addr mask} [type mask]
Note Although visible in the
command-line help, the host
src-MAC-addr mask keywords
are not supported.
Always use the permit keyword for ACLs used as match criteria in QoS
policies.
• For dst-MAC-addr, enter the MAC address of the host to which the
packet is being sent. You can specify in hexadecimal format (H.H.H),
use the any keyword for source 0.0.0, source-wildcard ffff.ffff.ffff, or
use the host keyword for source 0.0.0.
• For mask, enter the wildcard bits by placing ones in the bit positions
that you want to ignore.
• (Optional) For type mask, specify the Ethertype number of a packet
with Ethernet II or SNAP encapsulation to identify the protocol of
the packet. For type, the range is from 0 to 65535, typically specified
in hexadecimal. For mask, enter the don’t care bits applied to the
Ethertype before testing for a match. Although other Ethertypes are
visible in the command-line help, only IPv4 and MPLS are
supported. If you enter another Ethertype, the command is rejected.
Step 4
end Return to privileged EXEC mode.
Step 5
show access-lists [access-list-number |
access-list-name]
Verify your entries.
Step 6
copy running-config startup-config (Optional) Save your entries in the configuration file.