Jump to content
Калькуляторы

catalyst 6500 VACL

s72033-adventerprisek9_wan-mz.122-33.SXI3.bin

#show mod

Mod Ports Card Type Model Serial No.

--- ----- -------------------------------------- ------------------ -----------

1 48 CEF720 48 port 10/100/1000mb Ethernet WS-X6748-GE-TX SAL1333WG7U

3 48 CEF720 48 port 1000mb SFP WS-X6748-SFP SAD083704PL

4 4 CEF720 4 port 10-Gigabit Ethernet WS-X6704-10GE SAL1152BHR4

6 2 Supervisor Engine 720 (Active) WS-SUP720-3B SAL1130VGY0

 

vlan 14

no sh

vlan 200

no sh

vlan 201

no sh

vlan 202

no sh

 

interface GigabitEthernet3/16

switchport

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 14,200-202

switchport mode trunk

interface GigabitEthernet3/17

switchport

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 14,200-202

switchport mode trunk

 

mac access-list extended all-ex-PPPoE

deny any any 8863 0

deny any any 8864 0

permit any any

 

vlan access-map block-all-ex-PPPoE 10

match mac address all-ex-PPPoE

action drop

 

vlan filter block-all-ex-PPPoE vlan-list 200-202

Задача - ограничить любой трафик внутри виланов 200-202 кроме PPPoE.

Вопрос: учитывая, что интерфейсы в режиме trunk

Работают ли строки: ?

deny any any 8863 0

deny any any 8864 0

Или я должен как то учитывать 0x8100 ? Как ?

 

Share this post


Link to post
Share on other sites

перепишите наоборот

 

mac access-list extended all-ex-PPPoE
permit any any 8863 0
permit any any 8864 0
!
vlan access-map block-all-ex-PPPoE 10
match mac address all-ex-PPPoE
action forward
vlan access-map block-all-ex-PPPoE 20
action drop
!
vlan filter block-all-ex-PPPoE vlan-list 200-202

Share this post


Link to post
Share on other sites
Ваша мысль ясна.

Не ясно почему Вы так считаете ?

потому, что у меня так работает.

Share this post


Link to post
Share on other sites

На строки:

vlan access-map block-all-ex-PPPoE 20

action drop

отругалась:
%FM-VACL: Missing/Invalid match clause - Map block-all-ex-PPPoE sequence 20 is removed
И в конфиг их не занесла.

Это потому что по умолчанию "action drop" для всего ?

Edited by Ivan Rostovikov

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this