Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 270 / 698

Access Lists (ACLs)
ExtremeWare XOS 11.3 Concepts Guide
270
Precedence of Dynamic ACLs
Dynamic ACLs have a higher precedence than any ACLs applied using policy files. The precedence
among any dynamic ACLs is determined as they are configured.
Precedence within an ACL
An ACL is a policy file that contains one or more rules. In ExtremeWare XOS, each rule can be one of
following types:
●
L2 rule—a rule containing only Layer 2 (L2) matching conditions, such as Ethernet MAC address
and Ethernet type.
●
L3 rule—a rule containing only Layer 3 (L3) matching conditions, such as source or destination IP
address and protocol.
●
L4 rule—a rule containing both Layer 3 (L3) and Layer 4 (L4) matching conditions, such as TCP/
UDP port number.
NOTE
BlackDiamond 10K switch only—L2 matching conditions cannot be mixed with L3/L4 matching conditions in a rule,
otherwise, syntax checking will fail.
BlackDiamond 10K Only. When an ACL file contains both L2 and L3/L4 rules:
●
L3/L4 rules have higher precedence over L2 rules. L3/L4 rules are evaluated before any L2 rules.
●
The precedence among L3/L4 rules is determined by their relative position in the ACL file. Rules are
evaluated sequentially from top to bottom.
●
The precedence among L2 rules is determined by their position in the ACL file. Rules are evaluated
sequentially from top to bottom.
●
It is recommended that L2 and L3/L4 rules be grouped together for easy debugging.
BlackDiamond 8800 family and Summit X450 Only. Rule precedence is solely determined by the rule’s
relative order in the policy file. L2, L3, and L4 rules are evaluated in the order found in the file.
Precedence among interface types
As an example of precedence among interface types, suppose a physical port 1:2 is member port of a
VLAN
yellow . The ACL evaluation is performed in the following sequence:
●
If the ACL is configured on port 1:2, the port-based ACL is evaluated and the evaluation process
terminates.
●
If the ACL is configured on the VLAN yellow , the VLAN-based ACL is evaluated and the evaluation
process terminates.
●
If the wildcard ACL is configured, the wildcard ACL is evaluated and evaluation process terminates.
In summary, the port-based ACL has highest precedence, followed by the VLAN-based ACL and then
the wildcard ACL.