Router Acls - Motorola WS5100 Series Migration Giude

10-2 WS5100 Series Switch Migration Guide
Destination MAC, Ethertype, VLAN-ID, 802.1p bits (OR) Layer 3 parameters like– Source IP, Destination
IP, Protocol, Port Number.
NOTE: WS5100 Switch does not support applying ACLs in the outbound direction for both
Layer 2 and Layer 3 interfaces.
• Wireless LAN ACLs – A Wireless LAN ACL is designed to filter/mark packets based on the wireless LAN
from which they arrived rather than filtering the packets arrived on L2 ports. WLAN ACLs can be attached,
both, in inbound and outbound directions.

10.1.1.1 Router ACLs

Router ACLs are applied to Layer 3 or VLAN interfaces. If an ACL is already applied in a particular direction
on an interface, applying a new one will replace the existing ACL. Router ACLs are applicable only if the
switch acts as a gateway.
WS5100 Switch supports two types of Router ACLs based on the matching criteria. They are:
• Standard IP ACL — It uses Source IP address as matching criteria.
• Extended IP ACL — It uses Source IP address, Destination IP address and IP protocol type as basic
matching criteria. It can also include other parameters specific to a protocol type, like–Source and
Destination port for TCP/UDP protocols.
Router ACLs are stateful and are not applied on every packet that gets routed through the box. Whenever a
packet is received from a Layer 3 interface, it is examined against all the existing sessions to determine if it
belongs to an already established session. ACLs are applied on the packet in the following manner.
1. If the packet matches an existing session, it is
where to send the packet.
2. If no existing sessions match the packet, it is matched against ACL rules to decide whether to accept it
or reject it.
If ACL rules accept the packet, a new session is created and all further packets belonging to that session
are allowed. If ACL rules reject the packet, no session is established.
A session is computed based on the following parameters
• Source IP address
• Destination IP address
• Source Port
• Destination Port
• ICMP identifier
• Incoming interface index
• IP Protocol
Each session also has a default idle time-out interval. If no packets matching the session are received within
this interval, the session is destroyed and a new session is created again. These intervals are fixed and can
not be configured by the user.
The default idle time-out intervals for different sessions are:
• ICMP and UDP sessions— 30 seconds
• TCP sessions— 2 hours
not matched against ACL rules and the session decides