3Com 400 Family, Руководство по настройке

Страница: 133 / 344

8
ACL C
ONFIGURATION
This chapter covers the following topics:
■
Brief Introduction to ACL
■
QoS Configuration
■
ACL Control Configuration
Brief Introduction to
ACL
A series of matching rules are required for the network devices to identify the
packets to be filtered.
After identifying the packets, the Switch can permit or deny
them to pass through according to the defined policy. Access Control List (ACL) is
used to implement such functions.
ACL classifies the data packets with a series of matching rules, including source
address, destination address and port number, and so on.
The Switch verifies the
data packets with the rules in ACL and determines to forward or discard them.
The data packet matching rules defined by ACL can also be called in some other
cases requiring traffic classification, such as defining traffic classification for QoS.
An access control rule includes several statements. Different statements specify
different ranges of packets. When matching a data packet with the access control
rule, the issue of match order arises.
Filtering or Classifying Data Transmitted by the Hardware
ACL can be used to filter or classify the data transmitted by the hardware of the
Switch. In this case, the match order of the ACL’s sub-rules is determined by the
Switch hardware. The match order defined by the user will not be effective.
The case includes: ACL cited by QoS function, ACL used for filter the packet
transmitted by the hardware and so on.
Filtering or Classifying Data Transmitted by the Software
ACL can be used to filter or classify the data treated by the software of the Switch.
In this case, the match order of ACL’s sub-rules can be determined by the user.
There are two match-orders:
config
(by following the user-defined configuration
order when matching the rule) and
auto
(according to the system sorting
automatically when matching the rule, that is, in depth-first order). Once the user
specifies the match-order of an access control rule, it cannot be modified later,
unless all the content is deleted and the match-order specified again.
The case includes: ACL cited by route policy function, ACL used for control logon
user, and so on.