Masks For Access Control Lists - Enterasys Matrix-V V2H124-24 Configuration Manual

rules match for a list of all permit rules, the packet is dropped; and if no rules match
for a list of all deny rules, the packet is accepted.
There are three filtering modes:
• Standard IP ACL mode (STD-ACL) filters packets based on the source IP address.
• Extended IP ACL mode (EXT-ACL) filters packets based on source or destination
IP address, as well as protocol type and protocol port number. If the TCP protocol
is specified, then you can also filter packets based on the TCP control code.
• MAC ACL mode (MAC-ACL) filters packets based on the source or destination
MAC address and the Ethernet frame type (RFC 1060).
The following restrictions apply to ACLs:
• This switch supports ACLs for both ingress and egress filtering. However, you can
only bind one IP ACL and one MAC ACL to any port for ingress filtering, and one
IP ACL and one MAC ACL to any port for egress filtering. In other words, only four
ACLs can be bound to an interface – Ingress IP ACL, Egress IP ACL, Ingress MAC
ACL and Egress MAC ACL.
• When an ACL is bound to an interface as an egress filter, all entries in the ACL
must be deny rules. Otherwise, the bind operation will fail.
• Each ACL can have up to 32 rules.
• The maximum number of ACLs is also 32.
• However, due to resource restrictions, the average number of rules bound the
ports should not exceed 20.
• You must configure a mask for an ACL rule before you can bind it to a port or set
the queue or frame priorities associated with the rule.
• The switch does not support the explicit "deny any any" rule for the egress IP ACL
or the egress MAC ACLs. If these rules are included in ACL, and you attempt to
bind the ACL to an interface for egress checking, the bind operation will fail.
• Egress MAC ACLs only work for destination-mac-known packets, not for multicast,
broadcast, or destination-mac-unknown packets.
The order in which active ACLs are checked is as follows:
1. User-defined rules in the Egress MAC ACL for egress ports.
2. User-defined rules in the Egress IP ACL for egress ports.
3. User-defined rules in the Ingress MAC ACL for ingress ports.
4. User-defined rules in the Ingress IP ACL for ingress ports.
5. Explicit default rule (permit any any) in the ingress IP ACL for ingress ports.
6. Explicit default rule (permit any any) in the ingress MAC ACL for ingress ports.
7. If no explicit rule is matched, the implicit default is permit all.

Masks for Access Control Lists

You must specify optional masks that control the order in which ACL rules are
checked. The switch includes two system default masks that pass/filter packets
matching the permit/deny the rules specified in an ingress ACL. You can also
configure up to seven user-defined masks for an ACL. A mask must be bound
exclusively to one of the basic ACL types (i.e., Ingress IP ACL, Egress IP ACL,
Access Control List Commands
4
4-111