ADC

MAC Address Wildcard Mask for ACLs

A wildcard mask parameter has been introduced for extended ACLs and ACL6s and is used with the source MAC address parameter to define a range of MAC addresses to be match against the source MAC address of incoming packets.

Wild card masks specify which hexadecimal digits of the MAC address are used and which hexadecimal digits are ignored. The wildcard mask parameter specifies a series of ones and zeroes and has a length of 12 digits. Each digit is a mask for the corresponding hexadecimal digit of the MAC address. A zero digit in the wildcard mask indicates that the corresponding hexadecimal digit of the MAC address must be considered and a one digit indicates that the corresponding hexadecimal digit to be ignored.

The wildcard mask should meet the following conditions:

  • Has only one series of zeroes
  • Has only one series of ones
  • Start with a series of zeroes

The following are some of the examples of valid wildcard masks:

  • 000000111111
  • 000000011111
  • 000011111111

The following are some of the examples of invalid wildcard masks:

  • 000000111100
  • 111110000000
  • 010101010101

For an ACL, a wildcard mask of 000000111111 for MAC address 96:fa:95:1d:67:4a defines the MAC address range 96:FA:95:00:00:00 - 96:FA:95:FF:FF:FF. This MAC address range is matched against the source MAC address of the incoming packets.

To specify a range of source MAC addresses in an ACL rule by using the CLI:

At the command prompt, type:

  • add ns acl <name> <action> -srcMac <mac_addr> -srcMacMask <string>
  • show ns acl <aclname>

Example:

> add ns acl ACL-1 ALLOW –protocol TCP –srcport 2000-3000 -srcMac 96:fa:95:1d:67:4a
 –srcMacMask 000000111111
Done
<!--NeedCopy-->

To specify a range of source MAC addresses in an ACL6 rule by using the CLI:

At the command prompt, type:

  • add ns acl6 <name> <action> -srcMac <mac_addr> -srcMacMask <string>
  • show ns acl6 <acl6name>

Example:

> add ns acl6 ACL6-1 ALLOW -destIPv6 2001::45 -srcMac 96:fa:90:1d:67:4a
–srcMacMask 000000001111
Done
<!--NeedCopy-->
MAC Address Wildcard Mask for ACLs