![background image](http://html.mh-extra.com/html/foundry-networks/switch-and-router/switch-and-router_installation-and-configuration-manual_2324275410.webp)
Foundry Switch and Router Installation and Configuration Guide
13 - 22
December 2000
NOTE:
Do not place other commands in the file. The Foundry device reads only the ACL information in the file
and ignores other commands, including
ip access-group
commands. To assign ACLs to interfaces, use the CLI.
Applying an ACL to a Subset of Ports on a Virtual Interface
You can apply an ACL to a virtual routing interface. The virtual interface is used for routing between VLANs and
contains all the ports within the VLAN. If the ACL is for the inbound traffic direction, you also can specify a subset
of ports within the VLAN containing a specified virtual interface when assigning an ACL to that virtual interface.
Use this feature when you do not want the ACLs to apply to all the ports in the virtual interface’s VLAN or when
you want to streamline ACL performance for the VLAN.
NOTE:
This feature applies only to a virtual interface’s inbound direction. You cannot use this feature to specify
a subset of ports for a virtual interface’s outbound direction.
To apply an ACL to a subset of ports within a virtual interface, enter commands such as the following:
BigIron(config)# vlan 10 name IP-subnet-vlan
BigIron(config-vlan-10)# untag ethernet 1/1 to 2/12
BigIron(config-vlan-10)# router-interface ve 1
BigIron(config-vlan-10)# exit
BigIron(config)# access-list 1 deny host 209.157.22.26 log
BigIron(config)# access-list 1 deny 209.157.29.12 log
BigIron(config)# access-list 1 deny host IPHost1 log
BigIron(config)# access-list 1 permit any
BigIron(config)# interface ve 1
BigIron(config-vif-1)# ip access-group 1 in ethernet 1/1 ethernet 1/3 ethernet 2/1
to 2/4
The commands in this example configure port-based VLAN 10, add ports 1/1 – 2/12 to the VLAN, and add virtual
routing interface 1 to the VLAN. The commands following the VLAN configuration commands configure ACL 1.
Finally, the last two commands apply ACL 1 to a subset of the ports associated with virtual interface 1.
Syntax:
[no] ip access-group <num> in ethernet <portnum> [<portnum>...] to <portnum>
Enabling Strict TCP or UDP Mode
By default, when you use ACLs to filter TCP or UDP traffic, the Foundry device does not compare all TCP or UDP
packets against the ACLs.
•
TCP – By default, the device compares TCP control packets against the ACLs, but not data packets. Control
packets include packet types such as SYN (Synchronization) packets, FIN (Finish) packets, and RST (Reset)
packets
•
UDP – By default, the device compares the source and destination information against entries in the session
table. The session table contains forwarding entries based on Layer 3 and Layer 4 information.
•
If the session table contains a matching entry, the device forwards the packet, assuming that the first
packet the device received that contains the same address information was permitted by the ACLs.
•
If the session table does not contain a matching entry, the device sends the packet to the CPU, where
the software compares the packet against the ACLs. If the ACLs permit the packet (explicitly by a permit
ACL entry or implicitly by the absence of a deny ACL entry), the CPU creates a session table entry for
the packet’s forwarding information and forwards the packet.
For tighter access or forwarding control, you can enable the device to perform strict TCP or UDP ACL processing.
Strict ACL processing causes every TCP or UDP packet to go to the CPU for examination. The following sections
describe the strict modes in more detail.
Summary of Contents for Switch and Router
Page 2: ...December 2000 Copyright 2000 by Foundry Networks Inc ...
Page 26: ...Foundry Switch and Router Installation and Configuration Guide xxvi December 2000 ...
Page 64: ...Foundry Switch and Router Installation and Configuration Guide 2 34 December 2000 ...
Page 162: ...Foundry Switch and Router Installation and Configuration Guide 5 38 December 2000 ...
Page 196: ...Foundry Switch and Router Installation and Configuration Guide 6 34 December 2000 ...
Page 208: ...Foundry Switch and Router Installation and Configuration Guide 7 12 December 2000 ...
Page 236: ...Foundry Switch and Router Installation and Configuration Guide 8 28 December 2000 ...
Page 258: ...Foundry Switch and Router Installation and Configuration Guide 9 22 December 2000 ...
Page 420: ...Foundry Switch and Router Installation and Configuration Guide 13 32 December 2000 ...
Page 442: ...Foundry Switch and Router Installation and Configuration Guide 14 22 December 2000 ...
Page 554: ...Foundry Switch and Router Installation and Configuration Guide 15 112 December 2000 ...
Page 574: ...Foundry Switch and Router Installation and Configuration Guide 16 20 December 2000 ...
Page 626: ...Foundry Switch and Router Installation and Configuration Guide 17 52 December 2000 ...
Page 682: ...Foundry Switch and Router Installation and Configuration Guide 18 56 December 2000 ...
Page 826: ...Foundry Switch and Router Installation and Configuration Guide 20 20 December 2000 ...
Page 994: ...Foundry Switch and Router Installation and Configuration Guide 26 10 December 2000 ...
Page 1004: ...Foundry Switch and Router Installation and Configuration Guide B 6 December 2000 ...
Page 1044: ...Foundry Switch and Router Installation and Configuration Guide C 40 December 2000 ...
Page 1048: ...Foundry Switch and Router Installation and Configuration Guide D 4 December 2000 ...
Page 1070: ...Foundry Switch and Router Installation and Configuration Guide Index 18 December 2000 ...