Web Management Guide-R07
Table Of Contents
- How to Use This Guide
- Contents
- Figures
- Tables
- Getting Started
- Introduction
- Key Features
- Description of Software Features
- Configuration Backup and Restore
- Authentication
- Access Control Lists
- Port Configuration
- Rate Limiting
- Port Mirroring
- Port Trunking
- Storm Control
- Static MAC Addresses
- IP Address Filtering
- IEEE 802.1D Bridge
- Store-and-Forward Switching
- Spanning Tree Algorithm
- Virtual LANs
- IEEE 802.1Q Tunneling (QinQ)
- Traffic Prioritization
- Quality of Service
- IP Routing
- Address Resolution Protocol
- Multicast Filtering
- Link Layer Discovery Protocol
- System Defaults
- Introduction
- Web Configuration
- Using the Web Interface
- Basic Management Tasks
- Displaying System Information
- Displaying Hardware/Software Versions
- Configuring Support for Jumbo Frames
- Displaying Bridge Extension Capabilities
- Managing System Files
- Setting the System Clock
- Configuring the Console Port
- Configuring Telnet Settings
- Displaying CPU Utilization
- Configuring CPU Guard
- Displaying Memory Utilization
- Resetting the System
- Using Cloud Management
- Interface Configuration
- VLAN Configuration
- Address Table Settings
- Spanning Tree Algorithm
- Congestion Control
- Class of Service
- Quality of Service
- VoIP Traffic Configuration
- Security Measures
- AAA (Authentication, Authorization and Accounting)
- Configuring User Accounts
- Web Authentication
- Network Access (MAC Address Authentication)
- Configuring HTTPS
- Configuring the Secure Shell
- Access Control Lists
- Filtering IP Addresses for Management Access
- Configuring Port Security
- Configuring 802.1X Port Authentication
- DoS Protection
- DHCP Snooping
- IPv4 Source Guard
- ARP Inspection
- Basic Administration Protocols
- Configuring Event Logging
- Link Layer Discovery Protocol
- Power over Ethernet
- Simple Network Management Protocol
- Configuring Global Settings for SNMP
- Setting the Local Engine ID
- Specifying a Remote Engine ID
- Setting SNMPv3 Views
- Configuring SNMPv3 Groups
- Setting Community Access Strings
- Configuring Local SNMPv3 Users
- Configuring Remote SNMPv3 Users
- Specifying Trap Managers
- Creating SNMP Notification Logs
- Showing SNMP Statistics
- Remote Monitoring
- Switch Clustering
- Setting a Time Range
- LBD Configuration
- Smart Pair Configuration
- Multicast Filtering
- Overview
- Layer 2 IGMP (Snooping and Query for IPv4)
- Configuring IGMP Snooping and Query Parameters
- Specifying Static Interfaces for a Multicast Router
- Assigning Interfaces to Multicast Services
- Setting IGMP Snooping Status per Interface
- Filtering IGMP Query Packets and Multicast Data
- Displaying Multicast Groups Discovered by IGMP Snooping
- Displaying IGMP Snooping Statistics
- Filtering and Throttling IGMP Groups
- MLD Snooping (Snooping and Query for IPv6)
- Filtering and Throttling MLD Groups
- Filtering MLD Query Packets on an Interface
- IP Tools
- IP Configuration
- General IP Routing
- Unicast Routing
- Overview
- Configuring the Routing Information Protocol
- Configuring General Protocol Settings
- Clearing Entries from the Routing Table
- Specifying Network Interfaces
- Specifying Passive Interfaces
- Specifying Static Neighbors
- Configuring Route Redistribution
- Specifying an Administrative Distance
- Configuring Network Interfaces for RIP
- Displaying RIP Interface Settings
- Displaying Peer Router Information
- Resetting RIP Statistics
- IP Services
- Appendices
- Glossary
Chapter 12
| Security Measures
Access Control Lists
– 276 –
Access Control Lists
Access Control Lists (ACL) provide ingress packet filtering for IPv4/IPv6 frames
(based on address, protocol, Layer 4 protocol port number or TCP control code),
IPv6 frames (based on address, DSCP traffic class, ), or any frames (based on MAC
address or Ethernet type). To filter incoming packets, first create an access list, add
the required rules, and then bind the list to a specific port.
Configuring Access Control Lists –
An ACL is a sequential list of permit or deny conditions that apply to IP addresses,
MAC addresses, or other more specific criteria. This switch tests ingress packets
against the conditions in an ACL one by one. A packet will be accepted as soon as it
matches a permit rule, or dropped as soon as it matches a deny rule. If no rules
match, the packet is accepted.
Command Usage
The following restrictions apply to ACLs:
◆ ACLs only filter ingress packets or frames.
◆ The maximum number of ACLs is 256.
◆ The maximum number of rules per system is 512 rules.
◆ An ACL can have up to 128 rules.
◆ The number of ACLs that can be bound to the switch ports is limited to the
following:
■
128 MAC ACLs I
■
128 IP ACLs (including Standard and Extended ACLs)
■
64 IPv6 (Standard ACLs, and IPv6 Extended ACLs)
The maximum number of rules (Access Control Entries, or ACEs) stated is the
worst case scenario. In practice, the switch compresses the ACEs in TCAM (a
hardware table used to store ACEs), but the actual maximum number of ACEs
possible depends on too many factors to be precisely determined. It depends
on the amount of hardware resources reserved at runtime for this purpose.
Auto ACE Compression is a software feature used to compress all the ACEs of an
ACL to utilize hardware resources more efficiency. Without compression, one
ACE would occupy a fixed number of entries in TCAM. So if one ACL includes 25
ACEs, the ACL would need (25 * n) entries in TCAM, where “n” is the fixed
number of TCAM entries needed for one ACE. When compression is employed,
before writing the ACE into TCAM, the software compresses the ACEs to reduce
the number of required TCAM entries. For example, one ACL may include 128
ACEs which classify a continuous IP address range like 192.168.1.0~255. If
compression is disabled, the ACL would occupy (128*n) entries of TCAM, using
up nearly all of the hardware resources. When using compression, the 128 ACEs