delete access_profile all
# список админов
create access_profile ip destination_ip_mask 255.255.255.255 profile_id 10
config access_profile profile_id 10 add access_id 1 ip destination_ip 10.16.97.1 port 1-10 permit
config access_profile profile_id 10 add access_id 11 ip destination_ip 10.16.97.171 port 1-10 permit

# список пользователей
create access_profile ip source_ip_mask 255.255.255.255 profile_id 20
config access_profile profile_id 20 add access_id 1 ip source_ip 10.16.98.1 port 1 permit
config access_profile profile_id 20 add access_id 2 ip source_ip 10.16.98.2 port 1 permit

config access_profile profile_id 20 add access_id 4 ip source_ip 10.16.97.10 port 2 permit
config access_profile profile_id 20 add access_id 5 ip source_ip 10.16.97.11 port 2 permit
config access_profile profile_id 20 add access_id 6 ip source_ip 10.16.97.12 port 2 permit

# закрываем всем доступ
create access_profile ip source_ip_mask 0.0.0.0 profile_id 200
config access_profile profile_id 200 add access_id 1 ip destination_ip 0.0.0.0 port 1-10 deny

<?php
/*****************************************
 * Author: netdog at tut dot by
 * Date: Tue Oct 02 08:32:55 EEST 2007
 ****************************************/
 
echo create_access_rule(20,'aa:bb:cc:dd:ee:ff','10.16.10.1','1','permit');
echo create_access_rule(20,'aa:bb:cc:dd:ee:ff','10.16.10.2','1','permit');
/**
 * генератор access rule для профиля:
 * create access_profile packet_content_mask offset_0-15 0x0 0x0000ffff 0xffffffff 0x0 offset_16-31 0xffff0000 0x0 0x0 0x0000ffff  offset_32-47 0xffff0000 0x0 0x0 0x0 profile_id 20
 *
 * @param int $profile_id   prodile_id
 * @param string $src_mac   src mac
 * @param string $src_ip   src ip
 * @param int $port         Физический порт свитча
 * @param string $action   Действие: permit/deny
 * @return string
 */
function create_access_rule($profile_id, $src_mac, $src_ip, $port, $action) {
   static $access_id_array;
   
   if (!in_array($action,array('permit','deny'))) die('Error action ('.$action.') need: permit/deny');
   
   $bin_src_mac = str_replace(array('-',':'),null,strtoupper(trim($src_mac)));
   
   $e_ip = explode('.',trim($src_ip));
   
   if (count($e_ip) == 4) {
      $bin_src_ip = null;
      foreach ($e_ip as $ip_seg) {
         $bin_src_ip .= str_pad(dechex($ip_seg),2,STR_PAD_LEFT);
      }
   } else {
      die('Invalid IP address format');
   }
   
   if (strlen($bin_src_mac) != 12) die('Invalid MAC address format');
   
   if (empty($access_id_array)) $access_id_array = array();
   
   if (empty($access_id_array[$profile_id])) {
      $access_id_array[$profile_id] = 1;      
   } else {
      $access_id_array[$profile_id]++;
   }
   
   $access_id = $access_id_array[$profile_id];
   
   $str  =  null;
   $str .= 'config access_profile profile_id '.$profile_id.' ';
   $str .= 'add access_id '.$access_id.' ';
   $str .= 'packet_content_mask ';
   $str .= 'offset_0-15 0x0 0x0000'.substr($bin_src_mac,0,4).' 0x'.substr($bin_src_mac,4,12).' 0x0 ';
   $str .= 'offset_16-31 0x08000000 0x0 0x0 0x0000'.substr($bin_src_ip,0,4).' ';
   $str .= 'offset_32-47 0x'.substr($bin_src_ip,4,8).'0000 0x0 0x0 0x0 ';
   $str .= 'port '.$port.' '.$action;
   $str .= "\n";
   
   return $str;
}
?>