Specifications

IP Access Control Lists
ExtremeWare XOS 11.0 Concepts Guide 153
ACL Evaluation Precedence
This section discusses the precedence for evaluation among ACL rules.
Precedence within an ACL. An ACL is a policy file that contains one or more rules. In ExtremeWare
XOS, each rule can be one of following types:
• L2 rule—a rule containing only Layer 2 (L2) matching conditions, such as Ethernet MAC address
and Ethernet type.
• L3 rule—a rule containing only Layer 3 (L3) matching conditions, such as source or destination IP
address and protocol.
• L4 rule—a rule containing both Layer 3 (L3) and Layer 4 (L4) matching conditions, such as
TCP/UDP port number.
NOTE
L2 matching conditions cannot be mixed with L3/L4 matching conditions in a rule, otherwise, syntax
checking will fail.
When an ACL file contains both L2 and L3/L4 rules:
• L3/L4 rules have higher precedence over L2 rules. L3/L4 rules are evaluated before any L2 rules.
• The precedence among L3/L4 rules is determined by their relative position in the ACL file. Rules are
evaluated sequentially from top to bottom.
• The precedence among L2 rules is determined by their position in the ACL file. Rules are evaluated
sequentially from top to bottom.
• It is recommended that L2 and L3/L4 rules be grouped together for easy debugging.
Precedence among interface types. As an example of precedence among interface types, suppose a
physical port 1:2 is member port of a VLAN yellow. The ACL evaluation is performed in the following
sequence:
• If the ACL is configured on port 1:2, the port-based ACL is evaluated and the evaluation process
terminates.
• If the ACL is configured on the VLAN yellow, the VLAN-based ACL is evaluated and the evaluation
process terminates.
• If the wildcard ACL is configured, the wildcard ACL is evaluated and evaluation process terminates.
In summary, the port-based ACL has highest precedence, followed by the VLAN-based ACL and then
the wildcard ACL.
Fragmented packet handling
The following rules are used to evaluate fragmented packets or rules that use the fragments or
first-fragments keywords:
Two keywords are used to support fragmentation in ACLs:
• fragments—FO field > 0 (FO means the fragment offset field in the IP header.)
• first-fragments—FO == 0.