Ruckus Wireless ZoneSwitch 4124, User Manual

Page: 30 / 410

16
Introducing Ruckus Wireless ZoneSwitch
Layer 2 Functional Specifications
9. ACL
The ACL (access control list) provides packet filtering features for all
packets that filter on source MAC addresses, destination MAC
addresses, source IP addresses, destination IP addresses, protocol,
source TCP/UDP port numbers, and destination TCP/UDP port
numbers. To filter incoming packets, create access lists, add rules
to the list, then bind the access lists to physical ports.
The ACL is a sequential list which contains "permit" or "deny" rules.
The switch checks incoming packets against the rules in the ACL
one-by-one. If the packet meets the "permit" rule, it is forwarded.
If the packet meets the "deny" rule, it is dropped. If the packet
doesn't meet any rules, it is forwarded. The default behavior of all
data packets is forward. Users should add a "deny any" rule to filter
out packets at the end of the list.
The system supports maximum 128 rules.
The maximum number of rules per list is 32.
ACL is bound to a physical port.
A port may bind at most one inbound access list.
ACL and Diffserv cannot be enabled at the same time.
NOTE: Diffserv must be disabled before you can successfully enable ACL.
ACL rules can specify the below items.
(1) "permit" or "deny"
(2) Source MAC address
(3) Destination MAC address
(4) Source IP address and subnet mask
(5) Destination IP address and subnet mask
(6) Protocol number (TCP, UDP, ICMP, etc.)
(7) Source TCP/UDP port number
(8) Destination TCP/UDP port number