Extreme Networks Summit Summit24, Installation And User Manual

Page: 95 / 244

Using Access Control Lists
Summit24e3 Switch Installation and User Guide 95
The permit-established Keyword
The
permit-established
keyword is used to directionally control attempts to open a TCP session.
Session initiation can be explicitly blocked using this keyword.
NOTE
For an example of using the permit-established keyword, refer to “Using the Permit-Established
Keyword” on page 100.
The permit-established keyword denies the access control list. Having a permit-established access
control list blocks all traffic that matches the TCP source/destination, and has the SYN=1 and ACK=0
flags set.
Adding Access Mask, Access List, and Rate Limit Entries
Entries can be added to the access masks, access lists, and rate limits. To add an entry, you must supply
a unique name using the
create
command, and supply a number of optional parameters (see Table 25
for the full command syntax). For access lists and rate limits, you must specify an access mask to use.
To modify an existing entry, you must delete the entry and retype it, or create a new entry with a new
unique name.
To add an access mask entry, use the following command:
create access-mask <name> ...
To add an access list entry, use the following command:
create access-list <name> ...
To add a rate limit entry, use the following command:
create rate-limit <name> ...
Maximum Entries
If you try to create an access mask when no more are available, the system will issue a warning
message. Three access masks are constantly used by the system, leaving a maximum of 13
user-definable access masks. However, enabling some features causes the system to use additional
access masks, reducing the number available.
For each of the following features that you enable, the system will use one access mask. When the
feature is disabled, the mask will again be available. The features are:
• RIP
• IGMP or OSPF (both would share a single mask)
•
DiffServ examination
• QoS monitor
The maximum number of access list allowed by the hardware is 254 for each block of eight 10/100
Mbps Ethernet ports and 126 for each Gbps Ethernet port, for a total of 1014 rules (254*3+126*2). Most
user entered access list commands will require multiple rules on the hardware. For example, a global
rule (an access control list using an access mask without “ports” defined), will require 5 rules, one for
each of the 5 blocks of ports on the hardware.