Effective Period Of An Acl - 3Com Baseline 2928 PWR Plus User Manual

Table 1-2 Depth-first match for IPv4 ACLs
IPv4 ACL category
Basic IPv4 ACL
Advanced IPv4 ACL
Ethernet frame header
ACL
The comparison of a packet against ACL rules stops immediately after a match is found. The packet is
then processed as per the rule.
Fragments Filtering with IPv4 ACLs
Traditional packet filtering performs match operation on only the first fragments. All non-first fragments
are permitted. This results in security risks, because attackers may exploit this vulnerability to fabricate
non-first fragments to attack your network.
As for the configuration of a rule of an IPv4 ACL, you can specify that the rule applies to non-first
fragment packets only, and does not apply to non-fragment packets or the first fragment packets. ACL
rules that do not contain this keyword is applicable to both non-fragment packets and fragment packets.

Effective Period of an ACL

You can control when a rule can take effect by referencing a time range in the rule.
A referenced time range can be one that has not been created yet. The rule, however, can take effect
only after the time range is defined and becomes active.
Depth-first match procedure
1) Sort rules by source IP address wildcard mask and compare
packets against the rule configured with more zeros in the source
IP address wildcard mask.
2) In case of a tie, compare packets against the rule configured first.
1) Sort rules by the protocol carried over IP. A rule with no limit to the
protocol type (that is, configured with the ip keyword) has the
lowest precedence. Rules each of which has a single specified
protocol type are of the same precedence level.
2) If the protocol types have the same precedence, look at the source
IP address wildcard mask. Then, compare packets against the
rule configured with more zeros in the source IP address wildcard
mask.
3) If the numbers of zeros in the source IP address wildcard masks
are the same, look at their destination IP address wildcard masks.
Then, compare packets against the rule configured with more
zeros in the destination IP address wildcard mask.
4) If the numbers of zeros in the destination IP address wildcard
masks are the same, look at the Layer 4 port number ranges,
namely the TCP/UDP port number ranges. Then compare packets
against the rule configured with the smaller port number range.
5) If the port number ranges are the same, compare packets against
the rule configured first.
1) Sort rules by source MAC address mask first and compare
packets against the rule configured with more ones in the source
MAC address mask.
2) If two rules are present with the same number of ones in their
source MAC address masks, look at the destination MAC address
masks. Then, compare packets against the rule configured with
more ones in the destination MAC address mask.
3) If the numbers of ones in the destination MAC address masks are
the same, compare packets against the one configured first.
1-2