To Next Page

To Previous Page

Configuring Access Control Lists 591

ACL Configuration Details

How Are ACLs Configured?

To configure ACLs, follow these steps:

Create a MAC ACL by specifying a name.

Create an IP ACL by specifying a number.

Add new rules to the ACL.

Configure the match criteria for the rules.

Apply the ACL to one or more interfaces.

Editing Access Lists

When editing access lists, new entries are added to the end of the list. There

is an implicit deny all statement at the end of every access-group that is not

shown and is not editable. To insert a rule in the middle of an ACL, you must

delete the list, and then add the rules again, in order, with the newly included

entry. One way to manage this process is to show the running config, copy the

access list to an editor, edit the list offline, delete the access list on the switch,

and then paste the updated access list back into the switch console.

Preventing False ACL Matches

Be sure to specify ACL access-list, permit, and deny rule criteria as fully as

possible to avoid false matches. This is especially important in networks with

protocols that have different frame or EtherType values. For example, L3

ACL rules that specify a TCP or UDP port value should also specify the TCP

or UDP protocol. MAC ACL rules that specify an EtherType value for the

frame should also specify a source or destination MAC address wherever

possible.

NOTE: When configuring access lists, complete checks are made only when the

access list is applied to an active interface. It is recommended that you configure

and test an access list on an active (up) interface prior to deploying it on links in

the production network. If an ACL is configured on an interface that is not up,

error messages regarding ACL resource allocation may be logged when the

interface is brought up.

Dell N3000 Series User Manual

Other manuals for Dell N3000 Series