3Com 4200G 12-Port, Руководство по настройке

Страница: 215 / 422

26
ACL C
ONFIGURATION
ACL Overview
An access control list (ACL) is used primarily to identify traffic flows. In order to filter
data packets, a series of match rules must be configured on the network device to
identify the packets to be filtered. After the specific packets are identified, and based
on the predefined policy, the network device can permit/prohibit the corresponding
packets to pass.
ACLs classify packets based on a series of match conditions, which can be the source
addresses, destination addresses and port numbers carried in the packets.
The packet match rules defined by ACLs can be referenced by other functions that
need to differentiate traffic flows, such as the definition of traffic classification rules in
QoS.
According to the application purpose, ACLs fall into the following four types:
■
Basic ACL: rules are made based on the L3 source IP addresses only.
■
Advanced ACL: rules are made based on the L3 and L4 information such as the
source and destination IP addresses of the data packets, the type of protocol over
IP, protocol-specific features, and so on.
■
Layer 2 ACL: rules are made based on the Layer 2 information such as the source
and destination MAC address information, VLAN priority, Layer 2 protocol, and so
on.
ACL Application on the
Switch
ACLs activated directly on the hardware
In the switch, an ACL can be directly activated on the switch hardware for packet
filtering and traffic classification in the data forwarding process. In this case, the
match order of multiple rules in an ACL is determined by the hardware of the switch,
and any user-defined match order, even if it is configured when the ACL is defined,
will not work.
ACLs are directly activated on the switch hardware in the following situations: the
switch references ACLs to implement the QoS functions, and the forwards data
through ACLs.
ACL referenced by the upper-level modules
The switch also uses ACLs to filter packets processed by software and implements
traffic classification. In this case, there are two types of match orders for the rules in
an ACL:
config (user-defined match order) and auto (the system performs automatic
ordering, namely according “depth-first” order). In this scenario, you can specify the
match order for multiple rules in an ACL. You cannot modify the match order for an
ACL once you have specified it. You can specify a new the match order only after all
the rules are deleted from the ACL.
ACLs are referenced by software to control login users.