Chapter7
ACLConfiguration
TableofContents
ACLOverview...................................................................59
Conîš¿guringACL................................................................60
ACLConîš¿gurationExample.................................................66
ACLMaintenanceandDiagnosis...........................................68
ACLOverview
Packetîš¿lteringcanhelplimitnetworktrafîš¿candrestrictnetwork
usebycertainusersordevices.ACL’scanltertrafcasitpasses
througharouterandpermitordenypacketsatspeciîš¿edinter-
faces.
AnACLisasequentialcollectionofpermitanddenyconditions
thatapplytopackets.Whenapacketisreceivedonaninterface,
theswitchcomparestheîš¿eldsinthepacketagainstanyapplied
ACL’stoverifythatthepackethastherequiredpermissionstobe
forwarded,basedonthecriteriaspeciîš¿edintheaccesslists.It
testspacketsagainsttheconditionsinanaccesslistonebyone.
Theîš¿rstmatchdetermineswhethertheswitchacceptsorrejects
thepacketsbecausetheswitchstopstestingconditionsafterthe
îš¿rstmatch.Theorderofconditionsinthelistiscritical.Ifno
conditionsmatch,theswitchrejectsthepackets.Ifthereareno
restrictions,theswitchforwardsthepacket;otherwise,theswitch
dropsthepacket.
Packetmatchingrulesdeîš¿nedbytheACLarealsousedinother
conditionswheredistinguishingtrafîš¿cisneeded.Forinstance,the
matchingrulescandeîš¿nethetrafîš¿cclassiîš¿cationruleintheQoS.
ZXR105900/5200providesthefollowingsixtypesofACLs:
�StandardACL:OnlymatchthesourceIPaddress.
�ExtendedACL:Matchthefollowingitems:SourceIPaddress,
destinationIPaddress,IPprotocoltype,TCPsourceportnum-
ber ,TCPdestinationportnumber ,UDPsourceportnumber ,
UDPdestinationportnumber ,ICMPtype,ICMPCode,DiffServ
CodePoint(DSCP),ToSandPrecedence.
�L2ACL:MatchsourceMACaddress,destinationMACaddress,
sourceVLANID,L2Ethernetprotocoltypeand802.1ppriority
value.
�HybridACL:MatchsourceMACaddress,destinationMACad-
dress,sourceVLANID,sourceIPaddress,destinationIPad-
Conîš¿dentialandProprietaryInformationofZTECORPORATION59
To Next Page
Loading...
Need help?
General