insert before

Use this command to insert an access list rule entry.

Syntax

insert before entry {remark “text” | {permit | deny} {any | host source-macAddr | source-macAddr source-wildcard} [any | host destination-macAddr | destination-macAddr destination-wildcard] [dei] [cos cos] [vlan vlan [vidhi]] [ethertype data] [log | log-verbose]

Parameters

`entry`	Specifies an entry to place the inserted rule before. An entry is a valid pre-existing access list rule or the explicit deny which is the default entry 1.
remark `text`	Specify a text remark that will be associated with this ACL. Valid values: Up to 64 characters within double quotes (“”).
deny \| permit	Denies or permits access if specified conditions are met.
any	Specifies that any source MAC address and optionally any destination MAC address is applied to this permit or deny rule entry.
host `source-macAddr`	Specifies a host source MAC address in the formats x:x:x:x:x:x or H.H.H to apply to this permit or deny rule entry.
`source-macAddr source-wildcard`	Specifies a source MAC address and mask to apply to this permit or deny rule entry, in the formats x:x:x:x:x:x or H.H.H.
host `destination-macAddr`	(Optional) Sepcifies a host destination MAC address in the formats x:x:x:x:x:x or H.H.H to apply to this permit or deny rule entry.
`destination-macAddr destination-wildcard`	(Optional) Specifies a destination MAC address and mask to apply to this permit or deny rule entry, in the formats x:x:x:x:x:x or H.H.H.
dei	(Optional) Specifies that the drop eligibility indicator in the VLAN tag is applied to this permit or deny rule entry.
cos `cos`	(Optional) Specifies that the indicated class of service value is applied to this permit or deny rule entry.
vlan `vlan`	(Optional) Specifies that the indicated VLAN identifier in the VLAN tag is applied to this permit rule entry or specifies the low end of a range of VLANs to apply to this permit or deny rule entry.
`vidhi`	(Optional) Specifies the high end of a range of VLAN identifiers in the VLAN tag to apply to this permit or deny rule entry
ethertype `data`	(Optional) Specifies that the indicated Ethernet II type (0x0 - 0xFFFF) to apply to this permit or deny rule entry.
log \| log-verbose	(Optional) Enables syslog or verbose syslog messaging for an ACL rule hit.

Defaults

If any destination, a specific destination or host destination MAC address is not specified, no destination address is applied to the inserted rule entry.
If the drop eligibility indicator keyword is not specified, the VLAN tag DEI flag is not applied to the inserted rule entry.
If a CoS is not specified, CoS is not applied to the inserted rule entry.
If a single or range of VLANs is not specified, the VLAN identifier is not applied to the inserted rule entry.
If an Ethernet II type is is not specified, the Ethernet II type is not applied to the inserted rule entry.
If a logging option is not specified, ACL rule logging is not enabled for the inserted rule entry.

Mode

Configuration command, L2 ACL configuration mode.

Usage

ACL logging is throttled to 1 log message per second. If there are multiple ACL rules with logging enabled (log or log-verbose), and more then one frame is transmitted per second that can hit those rules, only the first frame will generate a message. Logging is sampling and does not report every time that a rule with logging enabled is hit.

Examples

This example inserts the remark “I am a remark entry at sequence number 17” in the L2 ACL list1:

System(rw-config)->l2 access-list list1
System(rw-cfg-l2-acl)->insert before 17 remark “I am a remark entry at sequence number 17”

This example enters configuration mode for the list1 L2 ACL and inserts at list sequence 5 a permit entry for packets containing (verbose logging is enabled for the inserted entry):

Any source address
A destination host with a MAC address of 00:11:88:fd:8e:f0
VLANs 11 through 13

An Ethernet II type 800

System(rw-config)->l2 access-list list1
System(rw-cfg-l2-acl)->insert before 5 permit any host 00:11:88:fd:8e:f0 vlan 11 13 ethertype 800 log-verbose
System(rw-cfg-l2-acl)->

Published May 2016prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback