60
Resources features
Resource features are common resources that can be used by multiple features. For example, you
can use an ACL both in a packet filter to filter traffic and in a QoS policy to match traffic.
The Web interface provides access to the resource creation page for features that might use the
resources. When you configure these features, you can create a resource without having to navigate
to the
Resources
menu. However, to modify or remove a resource, you must access the
Resources
menu.
ACL
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic
based on criteria such as source IP address, destination IP address, and port number.
ACLs are primarily used for packet filtering. You can use ACLs in QoS, security, routing, and other
feature modules for identifying traffic. The packet drop or forwarding decisions depend on the
modules that use ACLs.
ACL types and match criteria
shows the ACL types available on the switch and the fields that can be used to filter or
match traffic.
Table 15 ACL types and match criteria
Type ACL
number
IP
version
Match
criteria
Basic ACLs
2000 to 2999
IPv4
Source IPv4 address.
IPv6
Source IPv6 address.
Advanced ACLs
3000 to 3999
IPv4
•
Source IPv4 address.
•
Destination IPv4 address.
•
Packet
priority.
•
Protocol
number.
•
Other Layer 3 and Layer 4 header fields.
IPv6
•
Source IPv6 address.
•
Destination IPv6 address.
•
Packet
priority.
•
Protocol
number.
•
Other Layer 3 and Layer 4 header fields.
Ethernet frame
header ACLs
4000 to 4999
IPv4 and IPv6
Layer 2 header fields, including:
•
Source and destination MAC addresses.
•
802.1p
priority.
•
Link layer protocol type.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops
the match process and performs the action defined in the rule. If an ACL contains overlapping or
conflicting rules, the matching result and action to take depend on the rule order.
