Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 268 / 698

Access Lists (ACLs)
ExtremeWare XOS 11.3 Concepts Guide
268
NOTE
The BlackDiamond 8800 family and Summit X450 support 128 rules per Gigabit Ethernet port and 1024 rules per
10 Gigabit Ethernet port. Certain features also use rules for their implementation. A single match condition can
require the creation of many rules, and may not be supported on these switches. For example, the match condition
source-port 1000 - 3000 requires creating 2000 rules, and is not supported on these switches. The match condition
source-port > 90 will also not work, as it requires a large number of rules to implement in the hardware. The match
condition source-port 100 - 200 could work, as it uses fewer than 120 rules to implement. See also the section,
“Conserving ACL Masks (BlackDiamond 8800 family and Summit X450 switches only)” , for further information on
ACL limits.
IPv6 ACL Address Masks—BlackDiamond 10K Only
The BlackDiamond 10K uses address masks for matching the 128-bit IPv6 addresses in ACLs. The
default mask is 0:ffff:ffff:ffff:0:ffff:ffff:ffff, so for purposes of ACL matching the BlackDiamond 10K
ignores the bits 1 through 16 and 65 through 80 (counting the highest-order bit as bit 1). There is a
separate mask for the IPv6 source and IPv6 destination address. You can change the masks used for
ACL matching, but the change will not take effect until you reboot the switch. Use the following
command to configure the IPv6 ACL masks:
configure ipv6acl address-mask [destination <ipv6_address> | source <ipv6_address>]
Dynamic ACLs
Dynamic ACLs are created using the CLI. They use a similar syntax and can accomplish the same
actions as single rule entries used in ACL policy files. More than one dynamic ACL can be applied to an
interface, and the precedence among the dynamic ACLs is determined as they are being configured.
Dynamic ACLs have a higher precedence than ACLs applied using a policy file.
There are two steps to using a dynamic ACL on an interface:
1 Create the dynamic ACL rule
2 Configure the ACL rule on the interface
Creating the Dynamic ACL Rule
Creating a dynamic ACL rule is similar to creating an ACL policy file rule entry. You will specify the
name of the dynamic ACL rule, the match conditions, and the actions and action-modifiers. The match
Table 35: ACL match condition data types
Condition Data Type Description
prefix IP source and destination address prefixes. To specify the address prefix, use the
notation
prefix/prefix-length
. For a host address,
prefix-length
should be
set to 32.
number Numeric value, such as TCP or UDP source and destination port number, IP protocol
number.
range A range of numeric values. To specify the numeric range, use the notation:
number -
number
bit-field Used to match specific bits in an IP packet, such as TCP flags and the fragment flag.
mac-address 6-byte hardware address.