Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 74)

62 ServerIron ADX NAT64 Configuration Guide

53-1002444-02

How ServerIron ADX ADX processes ACLs

DRAFT: BROCADE CONFIDENTIAL

• If both the fragment’s source and destination addresses do not exactly match an ACL

entry, the device skips the ACL entry and compares the packet to the next ACL entry.

This is true even if either the source or destination address (but not both) does exactly

match an ACL entry.

• If the source and destination addresses do not exactly match any ACL entry on the

applicable interface, the device drops the fragment.

NOTE

By default, 10 Gigabit Ethernet modules also forward the first fragment instead of using the

ACLs to permit or deny the fragment.

You can modify the handling of denied fragments. In addition, you can throttle the fragment rate on

an interface that used rule-based ACLs. Refer to “Dropping all fragments that exactly match a

flow-based ACL” on page 85 and “Enabling ACL filtering of fragmented packets” on page 86.

Default ACL action

The default action when no ACLs are configured on a device is to permit all traffic. However, once

you configure an ACL and apply it to a port, the default action for that port is to deny all traffic that

is not explicitly permitted on the port:

• If you want to tightly control access, configure ACLs consisting of permit entries for the access

you want to permit. The ACLs implicitly deny all other access.

• If you want to secure access in environments with many users, you might want to configure

ACLs that consist of explicit deny entries, then add an entry to permit all access to the end of

each ACL. The software permits packets that are not denied by the deny entries.

ACL IDs and entries

ACLs consist of ACL IDs and ACL entries:

• ACL ID: An ACL ID is a number from 1 through 99 (for a standard ACL) or 100 through 199 (for

an extended ACL) or a character string. The ACL ID identifies a collection of individual ACL

entries. When you apply ACL entries to an interface, you do so by applying the ACL ID that

contains the ACL entries to the interface, instead of applying the individual entries to the

interface. This makes applying large groups of access filters (ACL entries) to interfaces simple.

NOTE

This is different from IP access policies. If you use IP access policies, you apply the individual

policies to interfaces.

• ACL entry: An ACL entry are the filter commands associated with an ACL ID. These are also

called statements. The maximum number of ACL entries you can configure is a system-wide

parameter and depends on the device you are configuring. You can configure up to the

maximum number of entries in any combination in different ACLs. The total number of entries

in all ACLs cannot exceed the system maximum.

Layer 3 switch code on devices can support up to 8192 ACL entries.

1 2 ... 69 70 71 72 73 74 75 76 77 78 79 ... 148 149

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 74