BigIron RX Series Configuration Guide 51153-1001986-01Configuring Layer 2 ACLs 20The | any parameter specifies the source MAC address. You can enter aspecific address and a comparison mask or the keyword any to filter on all MAC addresses. Specifythe mask using F’s and zeros. For example, to match on the first two bytes of the addressaabb.ccdd.eeff, use the mask ffff.0000.0000. In this case, the clause matches all source MACaddresses that contain “aabb” as the first two bytes and any values in the remaining bytes of theMAC address. If you specify any, you do not need to specify a mask and the clause matches on allMAC addresses.The | any parameter specifies the destination MAC address. The syntax rulesare the same as those for the | any parameter.The optional | any parameter specifies the vlan-id to be matched against the vlan-id ofthe incoming packet. You can specify any to ignore the vlan-id match.The optional etype argument specifies the Ethernet type field of the incoming packetin order for a match to occur.The can be one of the following keywords:• IPv4-Len-5 (Etype=0x0800, IPv4, HeaderLen 20 bytes)• ARP (Etype=0x0806, IP ARP)• IPv6 (Etype=0x86dd, IP version 6)The optional parameter enables the logging mechanism. The device accepts thiscommand only when a deny clause is configured. When you enable logging for a Layer 2 ACL, alltraffic matching the clause is sent to the CPU for processing and traffic is denied by the CPU. TheCPU creates a log entry for the first packet that is denied and once every 10 seconds thereafter.The logging mechanism includes sending SNMP traps and log messages to the Syslog servers andwriting the log entry to the log buffer on the device.In addition, if specified with a ‘permit’ action, the log-enable keyword is ignored and the user iswarned that he cannot log permit traffic.NOTETraffic denied by the implicit deny mechanism is not subject to logging. The implicit deny mechanismkicks in when the traffic does not match any of the clauses specified and there is no permit any anyclause specified at the end.Use the [no] parameter to delete the Layer 2 ACL clause from the table. When all clauses aredeleted from a table, the table is automatically deleted from the system.Example Layer 2 ACL clausesThe following shows some examples of valid Layer 2 ACL clauses.BigIron RX(config)# access-list 400 permit any anyBigIron RX(config)# access-list 400 permit any any log-enableBigIron RX(config)# access-list 400 permit any any 100BigIron RX(config)# access-list 400 permit any any 100 log-enableBigIron RX(config)# access-list 400 permit any any anyBigIron RX(config)# access-list 400 permit any any any log-enableBigIron RX(config)# access-list 400 permit any any 100 etype ipv4BigIron RX(config)# access-list 400 permit any any 100 etype ipv4 log-enableThe following shows an example of a valid Layer 2 ACL clause.BigIron RX(config)# access-list 400 permit any any 100 etype ipv4
