Ruijie RG-S2900G-E Series, Configuration Manual

Page: 760 / 943

Configuration Guide Access Control List Configuration
other services like TELNET are disabled). Or, allow users to access services only during a given
period or only allow some hosts to access networks.
Figure 1 is a case. In the case, only host A is allowed to access Finance Network, while Host B is
disallowed to do so. See Figure 1.
Figure 1 Using Access List to Control Network Access
When to Configure Access Lists
Depending on your requirements, you can select the basic access list or dynamic access list. In
general, the basic access list can meet the security requirement.However, experienced hackers may
use some software spoof source address and cheat the devices so as to gain accesses. Before the
user can access the network, the dynamic access list requires the pass of authentication so that the
hackers are difficult to invade the network. So, in some sensitive areas the dynamic access list can be
used to ensure the network security.
Note
A inherent problem of all access lists is electric spoofing, the behavior
of providing spoof source addresses to deceive switches Even you
use the dynamic list, a spoofing problem occurs. During the valid
access period of an authenticated user, a hacker may use a
counterfeit user address and accesses the network. There are two
methods to resolve the problem. One method is to set free time for a
user to access the network as little as possible, making it hard for a
hacker to attack the network. Another method is to use the IPSEC
encryption protocol to encrypt network data, ensuring that all the data
entering switches are encrypted.
Access lists are usually configured in the following locations of network devices:

Devices between the inside network and outside network (such as the Internet)

Devices at the borders of two parts in a network

Devices on the access control port
The execution of the ACL statements must follow the order in the table strictly. Starting from the first
statement, once the header of a packet matches a conditional judge statement in the table, the
sequential statements are ignored.