User Manual

NETGEAR M4500 Series Switches CLI Command Reference Manual 555
Format no ip access-group {<1-199> | <name>} [vlan <vlan-id>] {in | out}
Default None
Mode Global Config
Interface Config
5.21.2.13. {deny|permit}
This command creates a new rule for the current IP access list. Each rule is appended to the list of configured
rules for the list.
The ‘no’ form of this command is not supported, since the rules within an IP ACL cannot
be deleted individually. Rather, the entire IP ACL must be deleted and respecified.
An implicit ‘deny all’ IP rule always terminates the access list.
A rule may either deny or permit traffic according to the specified classification fields. At a minimum, either the
‘every’ keyword or the protocol, source address, and destination address values must be specified. The source
and destination IP address fields may be specified using the keyword ‘any’ to indicate a match on any value in
that field. The remaining command parameters are all optional, but the most frequently used parameters
appear in the same relative order as shown in the command format.
The assign-queue parameter allows specification of a particular hardware queue for handling traffic that
matches this rule. The allowed <queue-id> value is 0-(n-1), where n is the number of user configurable queues
available for the hardware platform. The assign-queue parameter is valid only for a permit rule.
The mirror parameter allows the traffic matching this rule to be copied to the specified <slot/port>, while the
redirect parameter allows the traffic matching this rule to be forwarded to the specified <slot/port>. The assign-
queue and redirect parameters are only valid for a permit rule.
The time-range parameter allows imposing time limitation on the IP ACL rule as defined by the parameter time-
range-name . If a time range with the specified name does not exist and the IP ACL containing this ACL rule is
applied to an interface or bound to a VLAN, then the ACL rule is applied immediately. If a time range with
specified name exists and the IP ACL containing this ACL rule is applied to an interface or bound to a VLAN, then
!
Parameter
Description
name
The ACL name which is used to identify a specific IP ACL. It is a case-sensitive
alphanumeric string from 1 to 31 characters uniquely identifying the MAC
access list.
<1-199>
The identifier of this ACL. Range 1 to 99 is the access list number for an IP
standard ACL. Range 100 to 199 is the access list number for an IP extended
ACL.
vlan-id
The VLAN ID. The VLAN keyword is only valid in the 'Global Config' mode.
in | out
The direction value is either in or out.