Dell S6000-ON, Руководство по настройке

Страница: 96 / 1080

6
Access Control Lists (ACLs)
This chapter describes access control lists (ACLs), prefix lists, and route-maps.
At their simplest, access control lists (ACLs), prefix lists, and route-maps permit or deny traffic based on
MAC and/or IP addresses. This chapter describes implementing IP ACLs, IP prefix lists and route-maps.
For MAC ACLS, refer to
Layer 2 .
An ACL is essentially a filter containing some criteria to match (examine IP, transmission control protocol
[TCP], or user datagram protocol [UDP] packets) and an action to take (permit or deny). ACLs are
processed in sequence so that if a packet does not match the criterion in the first filter, the second filter
(if configured) is applied. When a packet matches a filter, the switch drops or forwards the packet based
on the filter’s specified action. If the packet does not match any of the filters in the ACL, the packet is
dropped (implicit deny).
The number of ACLs supported on a system depends on your content addressable memory (CAM) size.
For more information, refer to
User Configurable CAM Allocation and CAM Optimization . For complete
CAM profiling information, refer to Content Addressable Memory (CAM) .
NOTE: You can apply Layer 3 VRF-aware ACLs only at the ingress level.
• VRF Instances
• Interfaces
• V4 ACL CAM
• VRF V4 ACL CAM
• L2 ACL CAM
• Port/VLAN based PERMIT/DENY Rules
• Port/VLAN based IMPLICIT DENY Rules
• VRF based PERMIT/DENY Rules
• VRF based IMPLICIT DENY Rules
NOTE: You can configure VRF-aware ACLs on interfaces either using a range of VLANs or a range of
VRFs but not both.
IP Access Control Lists (ACLs)
In Dell Networking switch/routers, you can create two different types of IP ACLs: standard or extended.
A standard ACL filters packets based on the source IP packet. An extended ACL filters traffic based on the
following criteria:
• IP protocol number
• Source IP address
96
Access Control Lists (ACLs)