User Manual

Manage Device Security
295
Insight Managed 8-Port Gigabit Ethernet Smart Cloud Switch with 2 SFP Fiber Ports
7. In the Sequence Number field, enter a whole number in the range of 1 to 2147483647 to
identify the rule.
8. From the Action menu, select the action that must be taken if a packet matches the rule’s
criteria:
• Permit. Forwards packets that meet the ACL criteria.
• Deny. Drops packets that meet the ACL criteria.
9. In the Assign Queue field, specify the hardware egress queue identifier that must be used
to handle all packets matching this ACL rule.
The valid range of queue IDs is 0 to 7.
10. From the Mirror Interface menu, select the specific egress interface to which the matching
traffic stream must be copied, in addition to being forwarded normally by the switch.
This field cannot be set if a redirect interface is already configured for the ACL rule. This
field is visible for a Permit action.
11. From the Redirect Interface menu, select the egress interface to which the matching traffic
stream must be redirected, bypassing any forwarding decision normally performed by the
switch.
This field cannot be set if a mirror interface is already configured for the ACL rule.
12. From the Match Every menu, select whether each Layer 2 MAC packet must be matched
against the rule:
• True. Each packet must match the selected ACL rule.
• False. Not all packets need to match the selected ACL rule.
13. In the CoS field, specify the 802.1p user priority that must be compared against the
information in an Ethernet frame.
The valid range of values is 0 to 7.
14. In the Destination MAC field, specify the destination MAC address that must be compared
against the information in an Ethernet frame.
The valid format is xx:xx:xx:xx:xx:xx. The BPDU keyword can be specified using a
destination MAC address of 01:80:C2:xx:xx:xx.
15. In the Destination MAC Mask field, specify the destination MAC address mask that must
be compared against the information in an Ethernet frame.
The valid format is xx:xx:xx:xx:xx:xx. The BPDU keyword can be specified using a
destination MAC mask of 00:00:00:ff:ff:ff.
The MAC mask specifies which bits in the MAC address must be compared against an
Ethernet frame. You can use Fs and zeros in the MAC mask, which is in a wildcard
format. An F means that the bit is not checked, and a zero in a bit position means that the
data must equal the value given for that bit. For example, if the MAC address is
aa:bb:cc:dd:ee:ff, and the mask is 00:00:ff:ff:ff:ff, all MAC addresses with
aa:bb:xx:xx:xx:xx result in a match (where x is any hexadecimal number). A MAC mask of
00:00:00:00:00:00 matches a single MAC address.