•
To remove the most recently configured rule for an ACL, select the ID of the appropriate ACL from
the ACL Identifier menu and click
Remove Last Rule
. You must confirm the action before the entry is
deleted.
•
To resequence rules for an ACL, select the ID of the appropriate ACL from the ACL Identifier menu
and click
Resequence Rules
.
Table 300: IP ACL Configuration Fields
Field
Description
ACL Identifier
The menu contains the ID for each ACL that exists on the system. Before you
add or remove a rule, you must select the ID of the ACL from the menu. For
ACLs with alphanumeric names, click the Edit icon to change the ACL ID.
The ID of a Named IPv4 ACL must begin with a letter, and not a number. The
ACL identifier for IPv4 Standard and IPv4 Extended ACLs cannot be
changed.
Sequence Number
The number that indicates the position of a rule within the ACL. If the
sequence number is not specified during rule creation, the rule is
automatically assigned a sequence number after it is successfully added to
the ACL. The rules are displayed based on their position within the ACL, but
can also be renumbered. Packets are checked against the rule criteria in
order, from the lowest-numbered rule to the highest. When the packet
matches the criteria in a rule, it is handled according to the rule action and
attributes. If no rule matches a packet, the packet is discarded based on the
implicit deny all rule, which is the final rule in every ACL.
ACL Type
The type of ACL. The ACL type determines the criteria that can be used to
match packets. The type also determines which attributes can be applied to
matching traffic. IPv4 ACLs classify Layer 3 and Layer 4 IPv4 traffic, IPv6
ACLs classify Layer 3 and Layer 4 IPv6 traffic, and MAC ACLs classify Layer 2
traffic. The ACL types are as follows:
•
IPv4 Standard – Match criteria is based on the source address of IPv4
packets.
•
IPv4 Extended – Match criteria can be based on the source and
destination addresses, source and destination Layer 4 ports, and protocol
type of IPv4 packets.
•
IPv4 Named – Match criteria is the same as IPv4 Extended ACLs, but the
ACL ID can be an alphanumeric name instead of a number.
•
IPv6 Named – Match criteria can be based on information including the
source and destination IPv6 addresses, source and destination Layer 4
ports, and protocol type within IPv6 packets.
•
Extended MAC – Match criteria can be based on the source and
destination MAC addresses, 802.1p user priority, VLAN ID, and EtherType
value within Ethernet frames.
Status
Whether the ACL is active. If the ACL is a time-based ACL that includes a
time range, the ACL is active only during the periods specified within the
time range. If an ACL does not include a time range, the status is always
active.
Action
The action to take when a packet or frame matches the criteria in the rule:
•
Permit – The packet or frame is forwarded.
•
Deny – The packet or frame is dropped.
When configuring ACL rules in the Add Access Control List Rule window, the
selected action determines which fields can be configured. Not all fields are
available for both Permit and Deny actions.
Configuring Quality of Service
ExtremeSwitching 200 Series: Administration Guide
301
