Dasan V8102, Руководство пользователя

Страница: 237 / 910

User Manual
UMN:CLI
V8102
237
7.18 Access List
An IP access list (ACL) is a filter that enables you to restrict specific IP traffic. If you cre-
ate an ACL entry to filter multicast packets based on their destination IP address, the
V8102 can deny the packets matching to the destination IP address, a multicast address.
There are three types of IP ACLs you can configure:
•
Standard Access List
•
Extended Access List
•
Named Access List
Standard ACLs uses IP addresses (whether they are source address or not) for matching
conditions. On the other hand, Extended ACLs define detailed filters with source IP,
source mask, destination IP, and destination mask. More concrete filtering could be done
with the extended ACL. IP ACLs also can be named with any characters and the numbers
not defined in both standard and extended ACLs.
In most cases, you can simply define ACLs in Global Configuration mode. If you want to
apply them to any of L3 functions, you can perform it where the actual access control
should be made. For example, ACL could be applied to another command such as
ip
igmp access-group or ip pim rp-address . However, ARP has an exception. ARP has an
access list itself, and you cannot define an access list in the Global Configuration mode.
Processing ACLs
An ACL entry has several statements. That is, an ACL entry 1 can have multiple filtering
statements (conditions) as the following:
SWITCH(config)# access-list 1 deny 10.55.193.109
SWITCH(config)# access-list 1 permit 10.55.193.109 0.0.0.255
SWITCH(config)# access-list 1 deny any
Traffic that comes into the switch is compared to ACL entries based on the order that the
entries have been created in the switch. New entries are added to the end of the list. The
switch continues to look until it has a match. If no matches are found when the switch
reaches the end of the list, the traffic is permitted. Likewise, if a couple of statements exist
within one ACL entry and traffic comes in, the switch looks through the statements in the
order that they are created. If the traffic hits the first condition, the switch processes as
described in the first condition and next conditions are ignored.
SWITCH(config)# access-list 1 deny 10.55.193.109
SWITCH(config)# access-list 1 permit 10.55.193.109 0.0.0.255
SWITCH(config)# access-list 1 deny any
Wildcard Bits
Masks are used with IP addresses in IP ACLs to specify a range of IP addresses. Com-
pared to subnet mask, masks for IP ACLs are the reverse. The mask bits 0.0.0.255 in IP
ACL are same as 255.255.255.0 in subnet mask, for instance. This is called a wildcard
mask or an inverse mask, because 1 and 0 in the binary format means the opposite of
what they mean in a subnet mask; 0 meaning “check” and 1 meaning “ignore.”
IP Address Wildcard Bits Addresses that ACL controls
Scan through conditions
in the order of creation