Lenovo Flex System Fabric CN4093, Application Manual

Page: 124 / 634

124
CN4093 Application Guide for N/OS 8.4
Summary of ACL Actions
Once classified using ACLs, the identified packet flows can be processed
differently. For each ACL, an action can be assigned. The action determines how the
switch treats packets that match the classifiers assigned to the ACL. CN4093 ACL
actions include the following:
 Pass or Drop the packet
 Re ‐ mark the packet with a new DiffServ Code Point (DSCP)
 Re ‐ mark the 802.1p field
 Set the COS queue
Assigning Individual ACLs to a Port
Once you configure an ACL, you must assign the ACL to the appropriate ports.
Each port can accept multiple ACLs, and each ACL can be applied for multiple
ports. ACLs can be assigned individually, or in groups.
To assign an individual ACL to a port, use the following IP interface commands:
When multiple ACLs are assigned to a port, higher ‐ priority ACLs are considered
first, and their action takes precedence over lower ‐ priority ACLs. ACL order of
precedence is discussed in the next section.
To create and assign ACLs in groups, see “ACL Groups” on page 125 .
ACL Order of Precedence
When multiple ACLs are assigned to a port, they are evaluated in numeric
sequence, based on the ACL number. Lower ‐ numbered ACLs take precedence
over higher ‐ numbered ACLs. For example, ACL 1 (if assigned to the port) is
evaluated first and has top priority.
If multiple ACLs match the port traffic, only the action of the one with the lowest
ACL number is applied. The others are ignored.
The ACL number is the sole factor in determining ACL order of precedence. The
order in which ACLs are applied to a port does not affect the order of precedence,
nor does the ACL Group number (see “ACL Groups” on page 125 ), the order in
which an ACL is assigned to an ACL Group, or the order in which the ACL Group
is assigned to a port.
If no assigned ACL matches the port traffic, no ACL action is applied.
CN 4093(config)# interface port
<port>
CN 4093(config-if)# access-control list
<IPv4 ACL number>
CN 4093(config-ip)# access-control list6
<IPv6 ACL number>