Extreme Networks ExtremeWare XOS 11.1, Руководство пользователя

Страница: 183 / 496

ACL Policies
ExtremeWare XOS 11.1 Concepts Guide
183
ACL Policy File Syntax
An ACL policy file contains one or more rule entries. Each rule entry consists of:
●
a rule entry name, unique within the same ACL.
●
zero or more match conditions. If no match condition is specified, all packets are matched.
●
zero or one action. If no action is specified, the packet is permitted by default.
●
zero or more action modifiers.
Each rule entry in the file uses the following syntax:
entry <ACLrulename>{
if {
<match-conditions>;
} then {
<action>;
<action-modifiers>;
}
}
Here is an example of a rule entry:
entry udpacl {
if {
source-address 10.203.134.0/24;
destination-address 140.158.18.16/32;
protocol udp;
source-port 190;
destination-port 1200 - 1400;
} then {
permit;
}
}
ACL rule entries are evaluated in order, from the beginning of the file to the end, as follows:
●
If the packet matches all the match conditions, the action in the then statement is taken and the
evaluation process terminates.
●
If a rule entry does not contain any match condition, the packet is considered to match and the
action in the rule entry’s then statement is taken and the evaluation process terminates.
●
If the packet matches all the match conditions, and if there is no action specified in the then
statement, the action permit is taken by default.
●
If the packet does not match all the match conditions, the next rule entry in the ACL is evaluated.
●
This process continues until either the packet matches all the match conditions in one of the
subsequent rule entries or there are no more entries.
●
If a packet passes through all the rule entries in the ACL without matching any of them, it is
permitted.
Often an ACL will have a rule entry at the end of the ACL with no match conditions. This entry will
match any packets not otherwise processed, so that user can specify an action to overwrite the default
permit action.