Access Control Lists - Alcatel OS-LS-6224 User Manual

3
Configuring the Switch
• QoS refers to Layer 2 traffic and above. QoS handles per-flow settings, even within
a single traffic class.
The QoS facility involves the following elements:
• Access Control Lists (ACLs) — Used to decide which traffic is allowed to enter
the system, and which is to be dropped. Only traffic that meets this criteria are
subject to CoS or QoS settings. ACLs are used in QoS and network security.
• Traffic Classification — Classifies each incoming packet as belonging to a given
traffic class, based on the packet contents and/or the context.
• Assignment to Hardware Queues — Assigns incoming packets to forwarding
queues. Packets are sent to a particular queue for handling as a function of the
traffic class to which they belong, as defined by the classification mechanism.
• Traffic Class-Handling Attributes — Applies QoS/CoS mechanisms to different
classes, including:
• Bandwidth Management
• Shaping/ Rate Limiting
• Policing

Access Control Lists

the first element of the QoS facility is the Access Control Lists (ACLs) which inspects
incoming packets and classify them into logical groups, based on various criteria.
ACL groups have specific actions that are carried out on every packet that is
classified to the group. ACLs enable actions which include:
• Forward
• Deny
• Deny and disable port
ACLs are used for the following main purposes:
• As a security mechanism, either permitting or denying entry to packets in a group.
This mechanism is described in the section on Network Security.
• As a mechanism to classify packets into traffic classes for which various CoS/QoS
handling actions are executed.
ACLs contain multiple classification rules and actions. An Access Control Element
(ACE) is composed of a single classification rule and its action. A single ACL may
contain one or more ACEs.
The order of the ACEs within an ACL is important, as they are applied in a first-fit
manner. The ACEs are processed sequentially, starting with the first ACE. When a
packet is matched to an ACE classification, the ACE action is performed and the
ACL processing terminates. If more than one ACL is to be processed, the default
drop action is applied only after processing all the ACLs. The default drop action
requires the user to explicitly allow all the traffic that is permitted, including
management traffic, such as telnet, HTTP, or SNMP that is directed to the router
itself.
Two types of ACLs are defined:
232