Korenix Technology Co., Ltd.
Industrial
Layer 3 Managed Ethernet Switch
_____________________________________________________________________________
Industrial Layer 3 Managed Ethernet SwitchUser Manual
Page: 1074/1246
Configurable Data
Rule ID
- Enter a whole number in the range of 1 to 255 that will be used to identify the rule. An IP
ACL may have up to 255 rules.
Action
- Specify what action should be taken if a packet matches the rule's criteria. The choices are
permit or deny.
Logging
- When set to 'True', logging is enabled for this ACL rule (subject to resource availability in
the device). If the Access List Trap Flag is also enabled, this will cause periodic traps to be
generated indicating the number of times this rule was 'hit' during the current report interval. A fixed 5
minute report interval is used for the entire system. A trap is not issued if the ACL rule hit count is
zero for the current interval. This field is visible for a 'Deny' Action.
Time Range Name
- Select the time range name to be associated with the IP ACL rule. On selecting
the option 'other' from the list, a non-existing time range name can be specified in the "Time Range
Name (other)" field.
Assign Queue ID
- Specifies the hardware egress queue identifier used to handle all packets
matching this IP ACL rule. Valid range of Queue Ids is (0 to 7). This field is visible when 'Permit' is
chosen as 'Action'.
Mirror Interface
- Specifies the specific egress interface where the matching traffic stream is copied
in addition to being forwarded normally by the device. This field cannot be set if a Redirect Interface
is already configured for the ACL rule. This field is visible for a 'Permit' Action.
Redirect Interface
- Specifies the specific egress interface where the matching traffic stream is
forced, bypassing any forwarding decision normally performed by the device. This field is visible
when 'Permit' is chosen as 'Action'.
Match Every
- Select true or false from the pulldown menu. True signifies that all packets will match
the selected IP ACL and Rule and will be either permitted or denied. In this case, since all packets
match the rule, the option of configuring other match criteria will not be offered. To configure specific
match criteria for the rule, remove the rule and re-create it, or re-configure 'Match Every' to 'False' for
the other match criteria to be visible.
Protocol Keyword
- Specify that a packet's IP protocol is a match condition for the selected IP ACL
rule. The possible values are ICMP, IGMP, IP, TCP, and UDP. Either the 'Protocol Keyword' field or
the 'Protocol Number' field can be used to specify an IP protocol value as a match criterion.
Protocol Number
- Specify that a packet's IP protocol is a match condition for the selected IP ACL
rule and identify the protocol by number. The protocol number is a standard value assigned by IANA
and is interpreted as an integer from 1 to 255. Either the 'Protocol Number' field or the 'Protocol
Keyword' field can be used to specify an IP protocol value as a match criterion.
Source IP Address
- Enter an IP address using dotted-decimal notation to be compared to a
packet's source IP Address as a match criteria for the selected IP ACL rule.
Source Wildcard Mask
- Specify the IP Mask in dotted-decimal notation to be used with the Source
IP Address value.
Source L4 Port Keyword
- Specify a packet's source layer 4 port as a match condition for the
selected extended IP ACL rule. This is an optional configuration. The possible values are DOMAIN,
ECHO, FTP, FTPDATA, HTTP, SMTP, SNMP, TELNET, TFTP, and WWW. Each of these values
translates into its equivalent port number, which is used as both the start and end of the port range.
Source L4 Port Number
- Specify a packet's source layer 4 port as a match condition for the
selected extended IP ACL rule. This is an optional configuration.
Destination IP Address
- Enter an IP address using dotted-decimal notation to be compared
to a packet's destination IP Address as a match criteria for the selected extended IP ACL rule.
Destination IP Mask
- Specify the IP Mask in dotted-decimal notation to be used with the
