Digitus DN-80233, User Manual

Page: 212 / 379

211
9.2 IP Access Control List (ACL) Commands
IP Access Control Lists (ACLs) ensure that only authorized users have access to specific
resources while blocking off any unwarranted attempts to reach network resources.
Note:
„
IP ACL configuration for IP packet fragments is not supported.
„
The maximum number of ACLs of any type that can be created is 100.
„
The maximum number of rules per IP ACL translates into the number of hardware classifier
entries used when an IP ACL is attached to an interface. Increasing these values in the switch
increases the RAM and NVSTORE usage.
„
ACLs are configured separately for Layer 2 and Layer 3. Some types of hardware do not allow
both types of ACLs to be applied to the same interface.
„
Wildcard masking for ACLs operates differently from a subnet mask. A wildcard mask is in
essence the inverse of a subnet mask. With a subnet mask, the mask has ones (1's) in the bit
positions that are used for the network address, and has zeros (0's) for the bit postions that are
not used. In contrast, a wildcard mask has (0’s) in a bit position that must be checked. A ‘1’ in a
bit position of the ACL mask indicates the corresponding bit can be ignored.
9.2.1 access-list
This command creates an IP Access Control List (ACL) that is identified by the
parameter <
accesslistnumber>.
The IP ACL number (<
accesslistnumber>)
is an integer from 1 to 199. The <
accesslistnumber>
range 1 to 99 is for an IP standard ACL and the <
accesslistnumber>
range 100 to 199 is for an
IP extended ACL.
The IP ACL rule is specified with either a
permit or deny
action.
The protocol to filter for an IP ACL rule is specified by giving the protocol to be used like
i
cmp,igmp,ip,tcp,udp.
The command specifies a source ipaddress and source mask for match condition of the IP ACL
rule specified by the
srcip
and
srcmask
parameters.
The source layer 4 port match condition for the IP ACL rule are specified by the
port value
parameter. The <
startport>
and
<endport>
parameters identify the first and last ports that are part of
the port range. They have values from 0 to 65535. The ending port must have a value equal or
greater than the starting port. The starting port, ending port, and all ports in between will be part of
the destination port range.
The <
portvalue>
parameter uses a single keyword notation and currently has the values of
domain,
echo, ftp, ftpdata, http, smtp, snmp, telnet, tftp
, and
www
. Each of these values translates into its
equivalent port number, which is used as both the start and end of a port range.
The command specifies a destination ipaddress and destination mask for match condition of the IP
ACL rule specified by the
dstip
and
dstmask
parameters.
The command specifies the TOS for an IP ACL rule depending on a match of precedence or
DSCP values using the parameters
dscp, precedence
,
tos, tosmask
.
The command specifies the assign-queue which is the queue identifier to which packets matching
this rule are assigned.
The command specifies the redirect interface which is the unit/slot/port to which packets matching