Access Control
Access Control Lists
Cisco 220 Series Smart Switches Administration Guide Release 1.1.0.x
234
17
Access Control Lists
An Access Control List (ACL) is an ordered list of classification filters and actions.
Each single classification rule, together with its action, is called an Access Control
Element (ACE).
Each ACE is made up of filters that distinguish traffic groups and associated
actions. A single ACL may contain one or more ACEs, which are matched against
the contents of incoming frames. Either a DENY or PERMIT action is applied to
frames whose contents match the filter.
The switch supports a maximum of 512 ACLs, and a maximum of 128 ACEs per
ACL.
When a packet matches an ACE filter, the ACE action is taken and that ACL
processing is stopped. If the packet does not match the ACE filter, the next ACE is
processed. If all ACEs of an ACL have been processed without finding a match,
and if another ACL exists, it is processed in a similar manner.
NOTE
If no match is found to any ACE in all relevant ACLs, the packet is dropped (as a
default action). Because of this default drop action you must explicitly add ACEs
into the ACL to permit all traffic, including management traffic, such as Telnet, HTTP,
or SNMP that is directed to the switch itself. For example, if you do not want to
discard all the packets that do not match the conditions in an ACL, you must
explicitly add a lowest priority ACE into the ACL that permits all the traffic.
If IGMP/MLD Snooping is enabled at a port bound with an ACL, add ACE filters in
the ACL to forward IGMP/MLD packets to the switch. Otherwise, IGMP/MLD
Snooping will fail at the port.
The order of the ACEs within the ACL is significant because they are applied in a
first-fit manner. The ACEs are processed sequentially, starting with the first ACE.
ACLs can be used for security, for example by permitting or denying certain traffic
flows, and also for traffic classification and prioritization in QoS advanced mode.
NOTE
A port can be either secured with ACLs or configured with advanced QoS policy,
but not both.
There can only be one ACL per port, with the exception that it is possible to
associate both an IPv4-based ACL and an IPv6-based ACL with a single port.
To associate more than one ACL with a port, a policy with one or more class maps
must be used (see
in the
section).
