Cisco WAP125 - Page 78

When you choose Deny, the rule blocks all traffic that meets the rule criteria from entering the WAP device. Traffic
that does not meet the criteria is forwarded unless this rule is the final rule. Because there is an implicit deny all
rule at the end of every ACL, traffic that is not explicitly permitted is dropped.
• Service (ETH Type) — Choose to compare the match criteria against the value in the header of an Ethernet frame.
You can select an ETH Type from the drop down list.
◦ Any — Allows for any protocol.
◦ Select From List — Choose one of these protocol types: ARP, IPv4, IPv6, IPX, NetBIOS, PPPoE.
◦ Custom — Enter a custom protocol identifier to which the packets are matched. The value is a four-digit
hexadecimal number in the range of 0600 to FFFF.
• Source MAC Address — Requires the packet's source MAC address to match the address defined in the appropriate
fields.
◦ Any — Allows for any source MAC address.
◦ Single Address — Enter the source MAC address to compare against an Ethernet frame.
◦ Address/ Mask — Enter the source MAC address mask specifying which bits in the source MAC to compare
against an Ethernet frame.
For each bit position in the MAC mask, a 0 indicates that the corresponding address bit is significant and a
1 indicates that the address bit is ignored. For example, to check only the first four octets of a MAC address,
a MAC mask of 00:00:00:00:ff:ff is used. A MAC mask of 00:00:00:00:00:00 checks all address bits and is
used to match a single MAC address.
• Destination MAC Address — Requires the packet's destination MAC address to match the address defined in the
appropriate fields.
◦ Any — Allows for any destination MAC address.
◦ Single Address — Enter the destination MAC address to compare against an Ethernet frame.
◦ Address/Mask — Enter the destination MAC address mask to specify which bits in the destination MAC to
compare against an Ethernet frame
• VLAN ID — The VLAN ID to compare against an Ethernet frame.
◦ Any — Allows for any VLAN ID.
◦ Custom — Enter the specific VLAN ID to compare against an Ethernet frame. This field is located in the
first/only 802.1Q VLAN tag. The port range is 1 to 4094.
• Class Of Service — Specifies the class of service 802.1p user priority value.
◦ Any — Allows for any class of service.
◦ Custom — Enter an 802.1p user priority to compare against an Ethernet frame. The valid range is from 0 to
7.
Step 7
Click OK. The changes are saved to the Startup Configuration.
Cisco WAP125 Wireless-AC/N Dual Band Desktop Access Point with PoE
72
Access Control
Configure MAC ACLs