Extreme Networks ExtremeWare XOS 11.3, Manual

Page: 271 / 698

ACLs
ExtremeWare XOS 11.3 Concepts Guide
271
Fragmented packet handling
Two keywords are used to support fragmentation in ACLs:
●
fragments—FO field > 0 (FO means the fragment offset field in the IP header.)—BlackDiamond 10K
only.
●
first-fragments—FO == 0.
Policy file syntax checker. The
fragments
keyword cannot be used in a rule with L4 information. The
syntax checker will reject such policy files.
Packet processing flow
The following rules are used to evaluate fragmented packets or rules that use the
fragments
or
first-
fragments
keywords.
With no keyword specified, processing proceeds as follows:
●
An L3-only rule that does not contain either the
fragments
or
first-fragments
keyword matches
any IP packets.
●
An L4 rule that does not contain either the
fragments
or
first-fragments
keyword matches non-
fragmented or initial-fragment packets.
With the
fragment
keyword specified (BlackDiamond 10K only):
●
An L3-only rule with the
fragments
keyword only matches fragmented packets.
●
An L4 rule with the
fragments
keyword is not valid (see above).
With the
first-fragments
keyword specified:
●
An L3-only rule with the
first-fragments
keyword matches non-fragmented or initial fragment
packets.
●
An L4 rule with the first-fragments keyword matches non-fragmented or initial fragment packets.
ACL Metering—BlackDiamond 8800 Family and Summit X450
Only
The BlackDiamond 8800 family and Summit X450 switches provide a metering capability which can be
used to associate an ACL rule to a specified bit-rate and out-of-profile action. The rate granularity is
64kbps (up to 1Gbps for GE ports and up to 10Gbps for 10G ports) and the out-of-profile actions are
drop, set the drop precedence, or mark the DSCP with a configured value. Additionally, each meter has
an associated out-of-profile byte counter which counts the number of packets that were above the
committed-rate (and subject to the out-of-profile-action).
To configure ACL metering, you will do the following steps:
1 Create the meter
2 Configure the meter
3 Associate the meter with an ACL rule entry
Creating the ACL Meter
To create the ACL meter, use the following command: