Product guide

Access Control Lists (ACLs) for the Series 3400cl and Series 6400cl Switches
ACL Operation
Note The order in which an ACE occurs in an ACL is significant. For example, if an
ACL contains six ACEs, but the first ACE is a “permit IP any”, then the ACL
permits all IP traffic, and the remaining ACEs in the list do not apply, even if
they specify criteria that would make a match with any of the traffic permitted
by the first ACE.
For example, suppose you want to configure an ACL on the switch (with an
ID of “100”) to invoke these policies:
1. Permit all inbound traffic on port 12 sent from IP address 11.11.11.42.
2. Deny only the inbound Telnet traffic sent from IP address 11.11.11.101.
3. Permit only inbound Telnet traffic sent from IP address 11.11.11.33.
4. Deny all other inbound traffic on port 12.
The following ACL model, when assigned to inbound filtering on port 12,
supports the above case:
4
1
2
3
5
1. Permits IP traffic inbound from source address 11.11.11.42.
4. Permits Telnet traffic from source address 11.11.11.33. Packets
Packets matching this criterion are permitted and will not be
matching this criterion are permitted and are not compared to
compared to any later ACE in the list. Packets not matching this
any later criteria in the list. Packets not matching this criterion
criterion will be compared to the next entry in the list.
are compared to the next entry in the list.
2. Denies Telnet traffic from source address 11.11.11.101. Packets
5. This entry does not appear in an actual ACL, but is implicit as
matching this criterion are dropped and are not compared to
the last entry in every ACL. Any inbound packets on port 12 that
later criteria in the list. Packets not matching this criterion are
do not match any of the criteria in the ACL’s preceding entries
compared to the next entry in the list.
will be denied (dropped).
3. Permits any IP traffic from source address 11.11.11.101. Any
packets matching this criterion will be permitted and will not be
compared to any later criteria in the list. Because this entry
comes after the entry blocking Telnet traffic from this same
address, there will not be any Telnet packets to compare with
this entry; they have already been dropped as a result of
matching the preceding entry.
Figure 10-5. Example of How an ACL Filters Packets
10-16