Extreme Networks ExtremeWare XOS Command Dokumentacja Pobierz pdf (Strona 153)

IP Access Control Lists

ExtremeWare XOS 11.0 Concepts Guide 153

ACL Evaluation Precedence

This section discusses the precedence for evaluation among ACL rules.

Precedence within an ACL. An ACL is a policy file that contains one or more rules. In ExtremeWare

XOS, each rule can be one of following types:

• L2 rule—a rule containing only Layer 2 (L2) matching conditions, such as Ethernet MAC address

and Ethernet type.

• L3 rule—a rule containing only Layer 3 (L3) matching conditions, such as source or destination IP

address and protocol.

• L4 rule—a rule containing both Layer 3 (L3) and Layer 4 (L4) matching conditions, such as

TCP/UDP port number.

NOTE

L2 matching conditions cannot be mixed with L3/L4 matching conditions in a rule, otherwise, syntax

checking will fail.

When an ACL file contains both L2 and L3/L4 rules:

• L3/L4 rules have higher precedence over L2 rules. L3/L4 rules are evaluated before any L2 rules.

• The precedence among L3/L4 rules is determined by their relative position in the ACL file. Rules are

evaluated sequentially from top to bottom.

• The precedence among L2 rules is determined by their position in the ACL file. Rules are evaluated

sequentially from top to bottom.

• It is recommended that L2 and L3/L4 rules be grouped together for easy debugging.

Precedence among interface types. As an example of precedence among interface types, suppose a

physical port 1:2 is member port of a VLAN yellow. The ACL evaluation is performed in the following

sequence:

• If the ACL is configured on port 1:2, the port-based ACL is evaluated and the evaluation process

terminates.

• If the ACL is configured on the VLAN yellow, the VLAN-based ACL is evaluated and the evaluation

process terminates.

• If the wildcard ACL is configured, the wildcard ACL is evaluated and evaluation process terminates.

In summary, the port-based ACL has highest precedence, followed by the VLAN-based ACL and then

the wildcard ACL.

Fragmented packet handling

The following rules are used to evaluate fragmented packets or rules that use the fragments or

first-fragments keywords:

Two keywords are used to support fragmentation in ACLs:

• fragments—FO field > 0 (FO means the fragment offset field in the IP header.)

• first-fragments—FO == 0.

1 2 ... 148 149 150 151 152 153 154 155 156 157 158 ... 369 370

Brak uwag

Extreme Networks ExtremeWare XOS Command Dokumentacja Strona 153