Dell N2000 Series, Configuration Manual

Page: 591 / 1460

Configuring Access Control Lists
591
ACL Configuration Details
How Are ACLs Configured?
To configure ACLs, follow these steps:
1 Create a MAC ACL by specifying a name.
2 Create an IP ACL by specifying a number.
3
Add new rules to the ACL.
4 Configure the match criteria for the rules.
5
Apply the ACL to one or more interfaces.
Editing Access Lists
When editing access lists, new entries are added to the end of the list. There
is an implicit deny all statement at the end of every access-group that is not
shown and is not editable. To insert a rule in the middle of an ACL, you must
delete the list, and then add the rules again, in order, with the newly included
entry. One way to manage this process is to show the running config, copy the
access list to an editor, edit the list offline, delete the access list on the switch,
and then paste the updated access list back into the switch console.
Preventing False ACL Matches
Be sure to specify ACL access-list, permit, and deny rule criteria as fully as
possible to avoid false matches. This is especially important in networks with
protocols that have different frame or EtherType values. For example, L3
ACL rules that specify a TCP or UDP port value should also specify the TCP
or UDP protocol. MAC ACL rules that specify an EtherType value for the
frame should also specify a source or destination MAC address wherever
possible.
NOTE:
When configuring access lists, complete checks are made only when the
access list is applied to an active interface. It is recommended that you configure
and test an access list on an active (up) interface prior to deploying it on links in
the production network. If an ACL is configured on an interface that is not up,
error messages regarding ACL resource allocation may be logged when the
interface is brought up.