Creating And Committing A Security Acl; Setting A Source Ip Acl - 3Com 3CRWX120695A, 3CRWX440095A Configuration Manual

Creating and
Committing a
Security ACL
Setting a Source IP
ACL
The order in which ACEs are listed in an ACL is important. MSS applies
ACEs that are higher in the list before ACEs lower in the list. (See
"Modifying a Security ACL" on page 246.) An implicit "deny all" rule is
always processed as the last ACE of an ACL. If a packet matches no ACE
in the entire mapped ACL, the packet is rejected. If the ACL does not
contain at least one ACE that permits access, no traffic is allowed.
Plan your security ACL maps to ports, VLANs, virtual ports, and
Distributed MAPs so that only one security ACL filters a given flow of
packets. If more than one security ACL filters the same traffic, MSS
applies only the first ACL match and ignores any other matches. Security
ACLs that are mapped to users have precedence over ACLs mapped to
ports, VLANs, virtual ports, or Distributed MAPs.
You cannot perform ACL functions that include permitting, denying, or
marking with a Class of Service (CoS) level on packets with a multicast or
broadcast destination address.
The security ACLs you create can filter packets by source address, IP
protocol, port type, and other characteristics. When you configure an
ACE for a security ACL, MSS stores the ACE in the edit buffer until you
commit the ACL to be saved to the permanent configuration. You must
commit a security ACL before you can apply it to an authenticated user's
session or map it to a port, VLAN, virtual port, or Distributed MAP. Every
security ACL must have a name.
You can create an ACE that filters packets based on the source IP address
and optionally applies CoS packet handling. (For CoS details, see "Class
of Service" on page 235.) You can also determine where the ACE is
placed in the security ACL by using the before editbuffer-index or
modify editbuffer-index variables with an index number. You can use
the hits counter to track how many packets the ACL filters.
The simplest security ACL permits or denies packets from a source IP
address:
set security acl ip acl-name {permit [cos cos] | deny}
source-ip-addr mask [before editbuffer-index | modify
editbuffer-index] [hits]

Creating and Committing a Security ACL

233