Table of Contents
Advertisement
Not all fields of an ACL rule need to be specified. If a particular field is not specified, it is
treated as a wildcard or don't-care condition. However, if a field is specified, that
particular field will be matched against the packet. Each protocol can have a number of
different fields to match. For example, a rule for TCP can use socket port numbers.
Since each field is position sensitive, it may be necessary to skip some fields in order to
specify a value for another field. To skip a field, use the keyword any. For example, the
following ACL rule denies SMTP traffic between any two hosts:
acl nosmtp deny tcp any any smtp smtp
Note that in the above example, the <tos> (Type of Service) field is not specified and is
treated as a wildcard. The any keyword is needed only to skip a wildcard field in order to
explicitly specify another field that is further down in the rule. If there are no other fields
to specify, the any keyword is not necessary. For example, the following ACL permits all
IP traffic to go through:
acl yesip permit ip
How ACL Rules are Evaluated
For an ACL with multiple rules, the ordering of the rules is important. When the IA
checks a packet against an ACL, it goes through each rule in the ACL sequentially. If a
packet matches a rule, it is forwarded or dropped based on the permit or deny keyword in
the rule. All subsequent rules are ignored. That is, a first-match algorithm is used. There is
no hidden or implied ordering of ACL rules, nor is there precedence attached to each
field. The IA simply goes down the list, one rule at a time, until there is a match.
Consequently, rules that are more specific (that is, with more selection criteria) should
always be listed ahead of rules that are less specific. For example, the following ACL
permits all TCP traffic except those from subnet 10.2.0.0/16:
acl 101 deny tcp 10.2.0.0/16 any any any
acl 101 permit tcp any any any any
When a TCP packet comes from subnet 10.2.0.0/16, it finds a match with the first rule.
This causes the packet to be dropped. A TCP packet coming from other subnets does not
match the first rule. Instead, it matches the second rule, which allows the packet to go
through.
Internet Appliance User Reference Manual
Chapter 13: Access Control List Configuration Guide
213
Advertisement
Table of Contents
