Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 269 / 698

ACLs
ExtremeWare XOS 11.3 Concepts Guide
269
conditions, actions, and action-modifiers are the same as those that are available for ACL policy files
(see
“ACL Policy File Syntax” on page 262 ). In contrast to the ACL policy file entries, dynamic ACLs are
created directly in the CLI. Use the following command to create a dynamic ACL:
create access-list <dynamic-rule> <conditions> <actions>
As an example of creating a dynamic ACL rule, let’s compare an ACL policy file entry with the CLI
command that creates the equivalent dynamic ACL rule. The following ACL policy file entry will drop
all ICMP echo-requests:
entry icmp-echo {
if {
protocol icmp;
icmp-type echo-request;
} then {
deny;
}
}
To create the equivalent dynamic ACL rule, use the following command:
create access-list icmp-echo “protocol icmp;icmp-type echo-request” “deny”
Notice that the
conditions
parameter is a quoted string that corresponds to the match conditions in the
if { ... }
portion of the ACL policy file entry. The individual match conditions are concatenated into
a single string. The
actions
parameter corresponds to the
then { ... }
portion of the ACL policy file
entry.
From the command line, you can get a list of match conditions and actions by using the following
command:
check policy attribute {<attr>}
Limitations. Dynamic ACL rule names must be unique, but can be the same as used in a policy-file
based ACL. Any dynamic rule counter names must be unique. Dynamic ACLs only apply to ACLs and
do not apply to CLEAR-Flow rules.
Configuring the ACL Rule on the Interface
Once a dynamic ACL rule has been created, it can be applied to a port, VLAN, or to the wildcard
any
interface. When the ACL is applied, you will specify the precedence of the rule among the dynamic
ACL rules. Use the following command to configure the dynamic ACL rule on an interface:
configure access-list add <dynamic_rule> [after <rule> | before <rule> | first |
last][any | ports <portlist> | vlan <vlanname>] {ingress | egress}
To remove a dynamic ACL from an interface, use the following command:
configure access-list delete <ruleName> [all | any | ports <portlist> | vlan
<vlanname>] {ingress | egress}
ACL Evaluation Precedence
This section discusses the precedence for evaluation among ACL rules.