Table of Contents
Advertisement
3Com Router 3000 Ethernet Family
Configuration Guide
Chapter 5 ACL Configuration
5.1 Introduction to ACL
5.1.1 ACL Overview
In order to filter data packets, a series of rules need to be configured on the router to
decide which data packets can pass. These rules are defined by ACL (Access Control
List), which are a series of sequential rules consisting of permit | deny statements. The
rules are described by source address, destination address and port number of data
packets. ACL classifies data packets through these router interface applied rules, by
which the router decides which packets can be received and which should be rejected.
5.1.2 Classification of ACL
According to application purpose, ACL falls into four groups:
Basic ACL
Advanced ACL
Interface-based ACL
MAC-based ACL
The application purpose of ACL is specified by the range of the number.
Interface-based ACL ranges from 1000 to 1999; basic ACL ranges from 2000 to 2999;
advanced ACL ranges from 3000 to 3999; and MAC-based ACL ranges from 4000 to
4999.
5.1.3 Match order of ACL
An access control rule may consist of several permit | deny statements, each
statement specifying different packet ranges. In this case, match order problem exists
on matching a packet and access control rule.
There are two kinds of match orders:
Configuration sequence: match ACL rules according to their configuration order.
Automatic sequencing: follow the principle of "depth priority".
"Depth priority" rule puts the statement that specifies the smallest packet range into first
place. This can be realized by comparing address wildcard. The smaller the wildcard is,
the smaller the specified host range. For example, 129.102.1.1 0.0.0.0 specifies a host:
129.102.1.1, while 129.102.1.1 0.0.255.255 specifies a network segment: from
129.102.1.1 to 129.102.255.255. Obviously, the former is put first in access control rule.
The detailed standard is: for statements of basic access control rule, directly compare
their source address wildcards. If the same wildcard is shared, arrange them according
3Com Corporation
5-1
Chapter 5 ACL Configuration
Advertisement
Chapters
Table of Contents
Troubleshooting
