Edge-Core ES4626F, Руководство по управлению, Страница: 165 / 792

7-1
Chapter 7: Access Control Lists
Access Control Lists (ACL) provide packet filtering for IPv4 frames (based on
address, protocol, Layer 4 protocol port number or TCP control code), IPv6 frames
(based on address, next header type, or flow label), or any frames (based on MAC
address or Ethernet type). To filter incoming packets, first create an access list, add
the required rules, and then bind the list to a specific port.
Configuring Access Control Lists
An ACL is a sequential list of permit or deny conditions that apply to IP addresses,
MAC addresses, or other more specific criteria. This switch tests ingress packets
against the conditions in an ACL one by one. A packet will be accepted as soon as it
matches a permit rule, or dropped as soon as it matches a deny rule. If no rules
match, the packet is accepted.
Command Usage
The following restrictions apply to ACLs:
• Each ACL can have up to 32 rules.
• The maximum number of ACLs is also 32.
• The maximum number of rules that can be bound to the ports is 96 for each of the
following list types: MAC ACLs, IP ACLs (including Standard and Extended ACLs),
IPv6 Standard ACLs, and IPv6 Extended ACLs. For the ES4626F, all ports share
this quota. For the ES4650F, ports 1-24 share a quota of 96 rules, and ports 25-50
share another quota of 96 rules (since there are two switch chips in this system).
The order in which active ACLs are checked is as follows:
1. User-defined rules in IP and MAC ACLs for ingress ports are checked in parallel.
2. Rules within an ACL are checked in the configured order, from top to bottom.
3. If the result of checking an IP ACL is to permit a packet, but the result of a MAC
ACL on the same packet is to deny it, the packet will be denied (because the
decision to deny a packet has a higher priority for security reasons). A packet will
also be denied if the IP ACL denies it and the MAC ACL accepts it.
Setting the ACL Name and Type
Use the ACL Configuration page to designate the name and type of an ACL.
Command Attributes
• Name – Name of the ACL. (Maximum length: 16 characters)
• Type – There are three filtering modes:
- IP Standard : IPv4 ACL mode that filters packets based on the source IPv4
address.
- IP Extended : IPv4 ACL mode that filters packets based on source or
destination IPv4 address, as well as protocol type and protocol port number.