CLI Guide

Security Commands 1164
Default Configuration
This command has no default configuration.
Command Mode
Global Configuration mode
User Guidelines
A management access list is only supported on the switched interfaces. It is
not supported on the out-of-band interface.
This command enters the access-list configuration mode, where access
conditions may be defined with deny and permit commands.
If no match criteria are defined the default is to deny the packet (i.e., the
packet is dropped).
If editing an access-list context, new rules are appended to the end of the
access-list.
Use the management access-class command to select the active access-list.
The active management list cannot be updated or removed.
Management access list names can consist of any printable character,
including blanks. Enclose the name in quotes to embed blanks in the name.
Question marks are disallowed.
Examples
The following example shows how to permit access to switch management via
two Ethernet interfaces, Gigabit Ethernet 1/0/1 and Gigabit Ethernet 1/0/9.
console(config)#management access-list mlist
console(config-macal)# permit gigabitethernet 1/0/1 priority 1
console(config-macal)# permit gigabitethernet 1/0/9 priority 1
console(config-macal)# exit
console(config)#management access-class mlist
The following example shows how to configure all the interfaces to be
management interfaces except for two interfaces, Gigabit Ethernet 1/0/1 and
Gigabit Ethernet 1/0/9.
console(config)# management access-list mlist
console(config-macal)# deny gigabitethernet 1/0/1 priority 1
console(config-macal)# deny gigabitethernet 1/0/9 priority 2
console(config-macal)# permit priority 2