SNR S2940-8G-v2, Configuration Manual

Page: 299 / 420

SNR S2940-8G-v2 Switch Configuration Guide
Self-defined ACL Configuration
Chapter 44
Self-defined ACL Configuration
44.1 Introduction to Self-defined ACL
ACL (Access Control Lists) is a packet filtering mechanism implemented by switch, providing net-
work access control by granting or denying access the switches, effectively safeguarding the secu-
rity of networks. The user can set a set of rules according to some information specific to packets,
each rule describes the action for a packet with certain information matched: “permit” or “deny”.
The user can apply such rules to the incoming direction of switch ports, so that data streams of
specified ports must comply with the ACL rules assigned..
Self-defined ACL means that users can configure several self-defined windows as the matching
field when users configure ACL. Self-defined windows do not specify which field definitely, but
specify the offset in a packet and ignore the meaning of field. It matches the data at offset position
which begins to fix the byte length according to the value and mask configuration.
44.1.1 Standard Self-defined ACL Template
Standard self-defined ACL can configure 11 windows and each of them can specify a start offset
position: L2 end of tag / start of L3 header / start of L4 header. Each window can specify offset,
its value from 0 to 31, unit is 2Bytes, namely, 0 means 0Bytes offset and 1 means 2Bytes offset.
Besides, offset is according to the start offset position.
A standard self-defined ACL template should be configured for the offset configuration of every
window before configuring the standard self-defined ACL list. This template is global and takes
effect to all standard self-defined ACL list. Standard self-defined ACL template can configure the
start offset position and offset for 11 windows at most. The window which is not configured is
not available, that means it cannot transmit configuration successfully if the standard self-defined
ACL use this window. When a window in the template is configured, it cannot be modified if the
standard self-defined ACL rule is configured with this window. But the standard self-defined ACL
rule is not configured, the window can be reconfigured, modified or deleted.
44.1.2 Extended Self-defined ACL Template
Extended self-defined ACL template can configure 2 swindows and 8 lwindows. Every swindow
can specify a start offset position: Start of L2 header / L2 end of tag / start of L3 header / start of
L4 header; every lwindow can specify a start offset position: L2 end of tag / start of L3 header /
299