Chapter 33: Access Control Lists
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
950
Once a name is given to an ACL, it cannot be assigned to another ACL
The same name cannot be associated with multiple acl-nums.
If an access-list already has a name assigned to it, the user can change that name by reissuing the name command and
setting the acl-index to either the access-list number or its old name.
Data Plane Filter IP ACLs
The Data Plane ACL feature provides the ability to filter all traffic in the data plane entering or exiting the chassis through
the RCM or cable-side interfaces. Packets can be selectively passed or dropped based on the configuration of the entries
within either IPv4 or IPv6 ACLs. It enables the MSO to limit access through the C4/c CMTS to network services such as
administrative and billing systems to a subset of authorized users. It can also be used to drop traffic from known virus and
denial of service attacks.
This feature does not replace SCM Access ACLs (valid for IPv4 ACLs only), which are used for in-band traffic management.
Unlike in-band ACLs, Data Plane Filter ACLs apply to all data traffic as it enters and leaves the network- or cable-side
interfaces.
IPv4 CLI Commands
This section lists some of the CLI commands that support IPv4 Access Control Lists.
Use the following command to configure [or disable] the data plane IP filter IPv4 ACLs on an RCM Ethernet interface:
configure interface {gigabitEthernet | tengigabitEthernet | cable} <slot>/<port> [no] ip
access-group {acl-name|acl-number} {in|out}
Use the no form of the command to disable ACL packet filtering for these interfaces. This command can be entered
one time for an interface in each direction. If it is entered a second time for a given interface, the acl-index replaces the
one that was entered the first time.
For cable MACs, use the following command:
configure interface cable-mac <mac-id> [no] ip access-group {acl-name|acl-number} {in|out} [no]
Use the no form of the command to disable ACL packet filtering for a cable-mac interface.
For IPv4 standard ACLs, the access list ID number must be in the range of 1-99 with filtering based on source IP address
only. Use the following command to delete an IPv4 ACL:
