3Com Switch 7700, Configuration Manual

Page: 239 / 390

7
Q
O
S/ O
PERATION
■
ACL Overview
■
Configuring ACLs
■
Displaying and Debugging an ACL
■
Configuring QoS
■
Configuring ACL Control
ACL Overview
The Access Control List (ACL) classifies the data packets with a series of matching
rules, including source address, destination address and port number. The switch
verifies the data packets with the rules in the ACL and decides to forward,
prioritize, or discard them.
A series of matching rules are required for the network devices to identify the
packets. After identifying the packets, the switch can permit or deny them to pass
through according to the defined policy. The ACL is used to implement these
functions.
The data packet matching rules, that are defined by ACL, can also be used in other
cases requiring traffic classification, such as defining traffic classification for QoS.
An access control rule includes several statements. Different statements specify
different ranges of packets. When matching a data packet with the access control
rule, the issue of match-order arises.
Configuring ACL Overview is described in the following sections:
■
Filtering or Classifying Data Transmitted by the Hardware
■
Filtering or Classifying Data Transmitted by the Software
■
ACL Support on the Switch 7700
Filtering or Classifying
Data Transmitted by the
Hardware
An ACL can be used to filter or classify the data transmitted by the hardware of
the switch. In this case, the match order of the ACL’s sub-rules is determined by
the switch hardware and this match order takes precedence over the match order
defined by the user.
An ACL is configured with multiple sub-rules. The sub-rule with the more accurate
range is matched first. If some rules define the same range, the latest sub-rule will
be matched first. For example, ACL 2000 has rule 0 and rule 1, the definition of
rule 0 is “rule 0 permit ip source 1.1.1.1 0.0.255.255 destination 2.2.2.2
0.0.255.255”, the definition of rule 1 is “rule 1 permit ip source 1.1.1.1 0.0.0.255
destination 2.2.2.20.0.0.255”, rule 1 is more accurate, it will be matched first.