Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 72)

60 ServerIron ADX NAT64 Configuration Guide

53-1002444-02

How ServerIron ADX ADX processes ACLs

DRAFT: BROCADE CONFIDENTIAL

For pass-through traffic, packets are processed in hardware.

For Layer 4 through Layer 7 traffic, packets are forwarded to the barrel processors (BPs) and

the BPs perform the ACL processing.

Beginning with release 12.3.01 and later

Beginning with release 12.3.01, IPv4 ACLs are processed as described in the following:

For deny actions:

All deny packets are dropped in hardware.

For permit actions:

For pass-through traffic, packets are processed in hardware.

For Layer 4 through 7 traffic, packets are processed in hardware and then forwarded to the

barrel processors (BPs). The BPs do not take any action on the ACLs.

Backwards compatibility option:

You can use the ip flow-based-acl-enable command to provide backwards compatibility for IPv4

ACL processing. If this command is configured, Layer 4 through 7 traffic, packets are

processed in hardware and then forwarded to the barrel processors (BPs) where the BPs also

process the ACLs. This command is configured as shown in the following.

ServerIronADX(config)# ip flow-based-acl-enable

Syntax: ip flow-based-acl-enable

Rule-based ACLs

Some Foundry devices process the traffic that ACLs filter in hardware. This document refers to this

type of ACLs as rule-based ACLs. These ACLs are programmed into hardware at startup or as a new

ACL is entered.

Rule-based ACLs program the ACL entries you assign to an interface into Content Addressable

Memory (CAM) space allocated for the port(s). Devices that use rule-based ACLs program the ACLs

into the CAM entries and use these entries to permit or deny packets in the hardware, without

sending the packets to the CPU for processing.

Rule-based ACLs are supported on physical interfaces VE interfaces and trunk groups.

Types of rule-based ACLs

Rule-based ACLs can be configured as standard or extended ACLs.

• A standard ACL permits or denies packets based on source IP address.

• An extended ACL permits or denies packets based on source and destination IP address and

also based on IP protocol information.

Both standard or extended ACLs can be numbered or named.

• Standard numbered ACLs have an ID of 1 through 99. Extended numbered ACLs are numbered

100 through 199.

• In this document, ACLs with a character string ID are called named ACLs. The IDs for both

standard and extended ACLs can be character strings.

1 2 ... 67 68 69 70 71 72 73 74 75 76 77 ... 148 149

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 72