Configure Global and Default Actions for an ACL

Configure the default action to specify packet treatment if a packet does not match an ACE.

Configure the global action to specify packet treatment if a packet does match an ACE. You can only configure the global action for ingress ACLs.

Before you begin

Ensure that the ACL exists.

Enter Global Configuration mode:

enable

configure terminal
Configure the global action for an ACL:

filter acl set <1-2048> global-action [monitor-dst-ports {slot/port[/sub-port][-slot/port[/sub-port]][,...]}] [monitor-dst-mlt <1–512>]
Configure the default action for an ACL using one of the following commands:
- Configure the default action to permit: filter acl set <1-2048> default-action permit [policer svc-rate <0-4000000000> peak-rate <8-4000000000>]
- Configure the default action to deny: filter acl set <1-2048> default-action deny [control-packet-action <deny | permit>]

The following table defines parameters for the filter acl set commands.


Variable	Value
`<1-2048>`	Specifies the ACL ID.
control-packet-action <deny \| permit>	Specifies the action to apply on control packets when none of the ACEs match. The default is permit. To use this optional parameter, you must configure the default-action to deny.
default-action <permit \| deny>	Specifies the default action to take when none of the ACEs match. Options are <permit \| deny>. The default is permit.
monitor-dst-mlt <1–512>	Configures mirroring to a destination MLT in the range of 1 to 512.
monitor-dst-ports `{slot/port[/sub-port] [-slot/port[/sub-port]] [,...]}`	Specifies the global action to take for matching ACEs: monitor destination ports—Configures mirroring to a destination port or ports. Identifies the slot and port in one of the following formats: a single slot and port (slot/port), a range of slots and ports (slot/port-slot/port), or a series of slots and ports (slot/port,slot/port,slot/port). If the platform supports channelization and the port is channelized, you must also specify the sub-port in the format slot/port/sub-port.
policer svc-rate `<0-4000000000>` peak-rate `<8-4000000000>`	Specifies the policer for filter with service rate and peak transfer rate of packets. The service rate value specifies the rate of traffic committed to be delivered. Packets above the specified peak rate value are dropped on ingress. To use this optional parameter, you must configure the default-action to permit.