Service Manual

8
Access Control Lists (ACLs)
This chapter describes access control lists (ACLs), prex lists, and route-maps.
At their simplest, access control lists (ACLs), prex lists, and route-maps permit or deny trac based on MAC and/or IP addresses.
This chapter describes implementing IP ACLs, IP prex lists and route-maps. For MAC ACLS, refer to
Layer 2.
An ACL is essentially a lter containing some criteria to match (examine IP, transmission control protocol [TCP], or user datagram
protocol [UDP] packets) and an action to take (permit or deny). ACLs are processed in sequence so that if a packet does not match
the criterion in the rst lter, the second lter (if congured) is applied. When a packet matches a lter, the switch drops or forwards
the packet based on the lter’s specied action. If the packet does not match any of the lters in the ACL, the packet is dropped
(implicit deny).
The number of ACLs supported on a system depends on your content addressable memory (CAM) size. For more information, refer
to User Congurable CAM Allocation and CAM Optimization. For complete CAM proling information, refer to Content Addressable
Memory (CAM).
IP Access Control Lists (ACLs)
In Dell Networking switch/routers, you can create two dierent types of IP ACLs: standard or extended.
A standard ACL lters packets based on the source IP packet. An extended ACL lters trac based on the following criteria:
• IP protocol number
• Source IP address
• Destination IP address
• Source TCP port number
• Destination TCP port number
• Source UDP port number
• Destination UDP port number
For more information about ACL options, refer to the Dell Networking OS Command Reference Guide.
For extended ACL, TCP, and UDP lters, you can match criteria on specic or ranges of TCP or UDP ports. For extended ACL TCP
lters, you can also match criteria on established TCP sessions.
When creating an access list, the sequence of the lters is important. You have a choice of assigning sequence numbers to the lters
as you enter them, or the Dell Networking Operating System (OS) assigns numbers in the order the lters are created. The sequence
numbers are listed in the display output of the show config and show ip accounting access-list commands.
Ingress and egress Hot Lock ACLs allow you to append or delete new rules into an existing ACL (already written into CAM) without
disrupting trac ow. Existing entries in the CAM are shued to accommodate the new entries. Hot lock ACLs are enabled by
default and support both standard and extended ACLs and on all platforms.
NOTE: Hot lock ACLs are supported for Ingress ACLs only.
Access Control Lists (ACLs)
107