Intel 480T, User Manual

Page: 256 / 367

254
C H A P T E R 1 4 Access Policies
Access lists are typically applied to traffic that crosses layer 3 router
boundaries, but it is possible to use access lists within a layer 2
VLAN. The 480T switch is capable of performing this function with
no additional configuration.
Routing Access Policies
Routing access policies are used to control the advertisement or
recognition or routing protocols, such as RIP or OSPF. Routing
access policies can be used to ‘hide’ entire networks, or to trust only
specific sources for routes or ranges of routes. The capabilities of
routing access policies are specific to the type of routing protocol
involved, but are sometimes more efficient and easier to implement
than access lists.
Using IP Access Lists
Each entry that makes up the IP access list of the switch contains a
unique name. You can also apply a unique precedence number, as
well. The precedence number determines the order in which each
criteria rule is examined by the switch. Once a matching entry in the
access list is found, the packet is acted upon and either forwarded or
dropped. Entries with precedence are determined highest first to
lowest.
Four types of criteria can be used within a single access list entry:
• IP source and destination address and mask
• TCP or UDP port ranges
• Physical source port (optional)
• Precedence number (optional)
For each access list entry, you can either permit the packet to be
forwarded, or deny the packet (in which case, it is dropped). When
you create a permit access list condition, you can optionally specify
a QoS profile. As explained in Chapter 8, the QoS profile informs
the switch of the bandwidth management and priority to use when
transmitting the packet.
To begin making entries in constructing an access list, we should
specify a default rule. A
default rule is a rule that contains wildcards
for destination and source IP address, with no Layer 4 information.
A default rule can determine if the behavior of the access list is an