Configure Layer 2 ACLs on S series switches


A Layer 2 ACL with the number ranging from 4000 to 4999 can be configured on an S series switch (except the S1700 switch). A Layer 2 ACL defines rules based on information in Ethernet frame headers of packets, such as source MAC addresses, destination MAC addresses, and Layer 2 protocol types.

For example, create a rule in ACL 4001 to allow the ARP packets with the destination MAC address 0000-0000-0001, source MAC address 0000-0000-0002, and Layer 2 protocol type 0x0806 to pass.
[HUAWEI] acl 4001
[HUAWEI-acl-L2-4001] rule permit destination-mac 0000-0000-0001 source-mac 0000-0000-0002 l2-protocol 0x0806

Create a rule in the Layer 2 ACL deny-vlan10-mac to reject the packets from the MAC addresses ranging from 00e0-fc01-0000 to 00e0-fc01-ffff in VLAN 10.
[HUAWEI] acl name deny-vlan10-mac link
[HUAWEI-acl-L2-deny-vlan10-mac] rule deny vlan-id 10 source-mac 00e0-fc01-0000 ffff-ffff-0000

Other related questions:
Can S series switches deliver ACL rules at Layer 2 and Layer 3 simultaneously
You can match the fields of ACL rules at Layer 2 and Layer 3 in the classifier at the same time. After the configuration, an S series switch can deliver ACL rules at Layer 2 and Layer 3 simultaneously.

Can S series switches implement rate limitation using Layer 2 ACL rules
S series switches can implement rate limitation on traffic using Layer 2 ACL rules. For example, set the maximum bandwidth for the traffic of which the source and destination MAC addresses are 0000-0000-0002 and 0000-0000-0001, respectively, to 4 Mbit/s. [HUAWEI] acl 4000 [HUAWEI-acl-L2-4000] rule permit destination-mac 0000-0000-0001 source-mac 0000-0000-0002 [HUAWEI-acl-L2-4000] quit [HUAWEI] traffic classifier c1 [HUAWEI-classifier-c1] if-match acl 4000 [HUAWEI-classifier-c1] quit [HUAWEI] traffic behavior b1 [HUAWEI-behavior-b1] car cir 4096 [HUAWEI-behavior-b1] quit [HUAWEI] traffic policy p1 [HUAWEI-trafficpolicy-p1] classifier c1 behavior b1 [HUAWEI-trafficpolicy-p1] quit [HUAWEI] interface gigabitethernet 1/0/1 [HUAWEI-GigabitEthernet1/0/1] traffic-policy p1 inbound

Why can Layer 2 ACLs not take effect on AR1200 series
Fixed local area network (LAN) interfaces on the AR1200 series do not support Layer 2 access control lists (ACLs).

ACL configuration on S series switch
An ACL filters packets based on rules. A switch with an ACL configured matches packets based on the rules to obtain the packets of a certain type, and then decides to forward or discard these packets according to the policies used by the service module to which the ACL is applied. The S series switch supports basic ACL (2000-2999), advanced ACL (3000-3999), Layer 2 ACL (4000-4999), user-defined ACL (5000-5999), USER acl (6000-9999), basic ACL6 (2000-2999), and advanced ACL6 (3000-3999). For more information about the ACL feature supported by S series switches, except S1700, click S1720&S2700&S3700&S5700&S6700&S7700&S9700 Common Operation Guide or S1720&S2700&S3700&S5700&S6700&S7700&S9700 Typical Configuration Examples.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top