ACL Rule Syntax Details
The following table lists the match conditions that can be used with ACLs, and whether the condition can be used for ingress ACLs only, or with both ingress and egress. The conditions are not case-sensitive; for example, the match condition listed in the table as TCP-flags can also be written as tcp-flags. Within ACL Match Conditions are five different data types used in matching packets.
ACL Match Conditions lists general match conditions that apply to all traffic, unless otherwise noted. ACL Match Condition Data Types the data types and details on using them.
| Match Conditions | Description | Applicable IP Protocols/ Direction |
|---|---|---|
| ethernet-type number | Ethernet packet type. In place of the numeric value, you can specify one of the following text synonyms (the field values are also listed): ETHER-P-IP (0x0800), ETHER-P-8021Q (0x8100), ETHER-P-IPV6 (0x86DD). | Ethernet/Ingress and Egress |
| [ethernet-source-address | ethernet-destination-address][ mac-address | pre-defined-mac ] { [ mask | / ] mask } |
Match Ethernet source MAC address or Ethernet destination MAC address. The mask is optional, and is in the same format as the MAC address for example: ethernet-source-address 00:01:02:03:01:01 mask ff:ff:ff:ff:00:00 or ethernet-source-address 00:01:02:03:01:01 / ff:ff:ff:ff:00:00 Pre-defined-mac can be any one of the following: cdp-mac, csp-mac (Port Extender Control and Status Protocol), eaps-flush-fdb-mac, eaps-mac, eaps-ver1-mac, eaps-ver2-mac, edp-mac, elrp-dst-mac, elrpsrc-mac, elsm-mac, erps-mac, esrp-mac, lacp-mac, lldp-mac, msrp-mac, pvstp-mac, stp-mac, system-lla-mac and system-mac Example with pre-defined-mac: ethernet-source-address edp-mac mask ff:ff:ff:ff:00:00 or ethernet-source-address edp-mac / ff:ff:ff:ff:00:00 Only those bits of the MAC address whose corresponding bit in the mask is set to 1 will be used as match criteria. Therefore, the preceding example matches 00:01:02:03:xx:xx. If the mask is not supplied, it is assumed to be ff:ff:ff:ff:ff:ff. In other words, all bits of the MAC address are used for matching. |
Ethernet/ Ingress and Egress |
| source-address prefix |
IP source address and mask. Use either all IPv4 or all IPv6 addresses in an ACL. On ExtremeSwitching series switches, using arbitrary mask arguments is supported. Masks are not restricted to be of a subnet type. Examples of arbitrary IPv4 and IPv6 masks include 10.22.3.4 and 1:0:0:ffff:2:4. The 1s in the mask indicate the corresponding bits of the source-address that should be used as part of the match criteria. |
All IP/Ingress and Egress |
| destination-address prefix |
IP destination address and mask. On ExtremeSwitching series switches, using arbitrary mask arguments is supported. Masks are not restricted to be of a subnet type. Examples of arbitrary IPv4 and IPv6 masks include 10.22.3.4 and 1:0:0:ffff:2:4. The 1s in the mask indicate the corresponding bits of the destination-address that should be used as part of the match criteria. |
All IP/Ingress and Egress |
| source-port number |
TCP or UDP source port. You must also specify the protocol match condition to determine which protocol is being used on the port, any time you use the this match condition. In place of the numeric value, you can specify one of the text synonyms listed under destination port. If no source-port is specified, the default source-port is “any.” |
TCP, UDP/ Ingress and Egress |
| source-port range | TCP or UDP source port. You must also specify the protocol match condition to determine which protocol is being used on the port, any time you use the this match condition. In place of the numeric value, you can specify one of the text synonyms listed under destination port. If no source-port is specified, the default source-port is “any.” | TCP, UDP/ Ingress |
| source-port number { mask value } | TCP or UDP port and mask. The mask is optional, and it can be decimal value or a hexadecimal value. | TCP,UDP/ Ingress and Egress |