Ruijie RG-S2600G-I Series - Page 911

CLI Reference Guide ACL Configuration Commands
 xns-idp
Configuration
Examples
1. Example of the standard IP ACL
The following basic IP ACL allows the packets whose source IP addresses are 192.168.1.64 -
192.168.1.127 to pass:
Ruijie (config)#access-list 1 permit 192.168.1.64 0.0.0.63
2. Example of the extended IP ACL
The following extended IP ACL allows the DNS messages and ICMP messages to pass:
Ruijie(config)#access-list 102 permit tcp any any eq domain log
Ruijie(config)#access-list 102 permit udp any any eq domain log
Ruijie(config)#access-list 102 permit icmp any any echo log
Ruijie(config)#access-list 102 permit icmp any any echo-reply
3. Example of the extended MAC ACL
This example shows how to deny the host with the MAC address 00d0f8000c0c to provide service
with the protocol type 100 on gigabit Ethernet port 1/1. The configuration procedure is as below:
Ruijie(config)#access-list 702 deny host 00d0f8000c0c any aarp
Ruijie(config)# interface gigabitethernet 1/1
Ruijie(config-if)# mac access-group 702 in
4. Example of the extended expert ACL
The following example shows how to create and display an extended expert ACL. This expert ACL
denies all the TCP packets with the source IP address 192.168.12.3 and the source MAC address
00d0.f800.0044.
Ruijie(config)#access-list 2702 deny tcp host 192.168.12.3 mac 00d0.f800.0044
any any
Ruijie(config)# access-list 2702 permit any any any any
Ruijie(config)# show access-lists
expert access-list extended 2702
10 deny tcp host 192.168.12.3 mac 00d0.f800.0044 any any
10 permit any any any any
Related
Commands
Command
Description
show access-lists
Show all the ACLs.
mac access-group
Apply the extended MAC ACL on the interface.
Platform
Description
-
clear expert access-list counters
Use this command to clear the packet matching counter of the expert ACL.
clear expert access-list counters [ id | name ]
Parameter
Parameter
Description