![background image](http://html.mh-extra.com/html/foundry-networks/switch-and-router/switch-and-router_installation-and-configuration-manual_2324275390.webp)
Foundry Switch and Router Installation and Configuration Guide
13 - 2
December 2000
•
“Displaying the Log Entries” on page 13-24
•
“Policy-Based Routing (PBR)” on page 13-25
•
“Using ACLs to Restrict Remote Access” on page 3-4
Usage Guidelines for Access Control Lists (ACLs)
This section provides some guidelines for implementing ACLs to ensure wire-speed ACL performance.
For optimal ACL performance, use the following guidelines:
•
Apply ACLs to inbound traffic rather than outbound traffic.
•
Use the default filtering behavior as much as possible. For example, if you are concerned with filtering only a
few specific addresses, create deny entries for those addresses, then create a single entry to permit all other
traffic. For tighter control, create explicit permit entries and use the default deny action for all other
addresses.
•
Use deny ACLs sparingly. When a deny ACL is applied to an interface, the software sends all packets sent or
received on the interface (depending on the traffic direction of the ACL) to the CPU for examination.
•
Adjust system resources if needed:
•
If IP traffic is going to be high, increase the size of the IP forwarding cache to allow more routes. To do
so, use the
system-max ip-cache
<num> command at the global CONFIG level of the CLI.
•
If much of the IP traffic you are filtering is UDP traffic, increase the size of the session table to allow more
ACL sessions. To do so, use the
system-max session-limit
<num> command at the global CONFIG
level of the CLI.
Avoid the following implementations when possible:
•
Do not apply ACLs to outbound traffic. The system creates separate inbound ACLs to ensure that an
outbound ACL is honored for traffic that normally would be forwarded to other ports.
•
Do not enable the strict TCP ACL mode unless you need it for tighter security.
•
Avoid ICMP-based ACLs where possible. If you are interested in providing protection against ICMP Denial of
Service (DoS) attacks, use Foundry’s DoS protection features. See “Protecting Against Denial of Service
Attacks” on page A-1.
If the IP traffic in your network is characterized by a high volume of short sessions, this also can affect ACL
performance, since this traffic initially must go to the CPU. All ICMP ACLs go to the CPU, as do all TCP SYN,
SYN ACK, FIN, and RST packets and the first UDP packet of a session.
ACL Support on the Foundry Products
Foundry ACLs have two basic types of uses:
•
Filtering forwarded traffic through the device
•
Controlling management access to the device itself
In general, Layer 3 Switches (including the NetIron Internet Backbone router) support both types of ACLs. Layer
2 Switches support ACLs only for access control. However, you can filter IP traffic on a Layer 2 Switch that has
been upgraded to Layer 3 routing code by configuring IP access policies.
The following table lists the ACL functions supported on each Foundry Layer 3 Switch and Layer 2 Switch.
Product
Packet Forwarding ACLs
Supported
Management Access ACLs
Supported
NetIron Internet Backbone router
X
X
Summary of Contents for Switch and Router
Page 2: ...December 2000 Copyright 2000 by Foundry Networks Inc ...
Page 26: ...Foundry Switch and Router Installation and Configuration Guide xxvi December 2000 ...
Page 64: ...Foundry Switch and Router Installation and Configuration Guide 2 34 December 2000 ...
Page 162: ...Foundry Switch and Router Installation and Configuration Guide 5 38 December 2000 ...
Page 196: ...Foundry Switch and Router Installation and Configuration Guide 6 34 December 2000 ...
Page 208: ...Foundry Switch and Router Installation and Configuration Guide 7 12 December 2000 ...
Page 236: ...Foundry Switch and Router Installation and Configuration Guide 8 28 December 2000 ...
Page 258: ...Foundry Switch and Router Installation and Configuration Guide 9 22 December 2000 ...
Page 420: ...Foundry Switch and Router Installation and Configuration Guide 13 32 December 2000 ...
Page 442: ...Foundry Switch and Router Installation and Configuration Guide 14 22 December 2000 ...
Page 554: ...Foundry Switch and Router Installation and Configuration Guide 15 112 December 2000 ...
Page 574: ...Foundry Switch and Router Installation and Configuration Guide 16 20 December 2000 ...
Page 626: ...Foundry Switch and Router Installation and Configuration Guide 17 52 December 2000 ...
Page 682: ...Foundry Switch and Router Installation and Configuration Guide 18 56 December 2000 ...
Page 826: ...Foundry Switch and Router Installation and Configuration Guide 20 20 December 2000 ...
Page 994: ...Foundry Switch and Router Installation and Configuration Guide 26 10 December 2000 ...
Page 1004: ...Foundry Switch and Router Installation and Configuration Guide B 6 December 2000 ...
Page 1044: ...Foundry Switch and Router Installation and Configuration Guide C 40 December 2000 ...
Page 1048: ...Foundry Switch and Router Installation and Configuration Guide D 4 December 2000 ...
Page 1070: ...Foundry Switch and Router Installation and Configuration Guide Index 18 December 2000 ...