Users Guide

can congure ACL logging only on ACLs that are applied to ingress interfaces; you cannot enable logging for ACLs
that are associated with egress interfaces.
You can activate ow-based monitoring for a monitoring session by entering the flow-based enable
command in the Monitor Session mode. When you enable this capability, trac with particular ows that are
traversing through the ingress and egress interfaces are examined and, appropriate ACLs can be applied in both
the ingress and egress direction. Flow-based monitoring conserves bandwidth by monitoring only specied trac
instead all trac on the interface. This feature is particularly useful when looking for malicious trac. It is available
for Layer 2 and Layer 3 ingress and egress trac. You may specify trac using standard or extended access-lists.
This mechanism copies all incoming or outgoing packets on one port and forwards (mirrors) them to another port.
The source port is the monitored port (MD) and the destination port is the monitoring port (MG).
NOTE: When ACL logging and byte counters are congured simultaneously, byte counters may display an
incorrect value. Congure packet counters with logging instead.
seq ether-type
Congure an egress lter with a specic sequence number that lters trac with specied types of Ethernet packets. This command is
supported only on 12-port GE line cards with SFP optics. For specications, refer to your line card documentation.
Syntax
seq sequence-number {deny | permit} ether-type protocol-type-number
{destination-mac-address mac-address-mask | any} vlan vlan-id {source-mac-
address mac-address-mask | any} [count [byte] [order] [log [interval minutes]
[threshold-in-msgs [count]] [monitor]
To remove this lter, use the no seq sequence-number command.
Parameters
sequence-number Enter a number from 0 to 4294967290.
deny Enter the keyword deny to drop all trac meeting the lter criteria..
permit Enter the keyword permit to forward all trac meeting the lter criteria.
destination-mac-
address mac-
address-mask
Enter a MAC address and mask in the nn:nn:nn:nn:nn format.
For the MAC address mask, specify which bits in the MAC address must match.
The MAC ACL supports an inverse mask; therefore, a mask of ::::: allows entries
that do not match and a mask of 00:00:00:00:00:00 only allows entries that match
exactly.
any Enter the keyword any to match and drop specic Ethernet trac on the interface.
vlan vlan-id
Enter the keyword vlan and then enter the VLAN ID to lter trac associated with a
specic VLAN. The range is 1 to 4094 and 1 to 2094 for ExaScale (you can use IDs 1 to
4094). To lter all VLAN trac specify VLAN 1.
source-mac-
address mac-
address-mask
Enter a MAC address and mask in the nn:nn:nn:nn:nn format.
For the MAC address mask, specify which bits in the MAC address must match.
246 Access Control Lists (ACL)