Chapter 8 Configuring Acls Using The Cee Cli; In This Chapter; Acl Overview - Brocade Communications Systems 1606 Administrator's Manual

Configuring ACLs using the CEE CLI

In this chapter

ACL overview

NOTE
In the Brocade Fabric OS v6.4.0 release, only Layer 2 MAC access control lists (ACLs) are supported.
ACLs filter traffic for the Brocade FCoE hardware and permit or deny incoming frames from passing
through interfaces that have the ACLs applied to them. You can apply ACLs on VLANs and on Layer
2 interfaces. Each ACL is a unique collection of permit and deny statements (rules) that apply to
frames. When a frame is received on an interface, the switch compares the fields in the frame
against any ACLs applied to the interface to verify that the frame has the required permissions to
be forwarded. The switch compares the frame, sequentially, against each rule in the ACL and either
forwards the frame or drops the frame.
The switch examines ACLs associated with options configured on a given interface. As frames enter
the switch on an interface, ACLs associated with all inbound options configured on that interface
are examined. With MAC ACLs you can identify and filter traffic based on the MAC address, and
EtherType.
The primary benefits of ACLs are as follows:
•
•
•
•
There are two types of MAC ACLs:
•
•
MAC ACLs are supported on the following interface types:
•
•
Converged Enhanced Ethernet Administrator's Guide
53-1001761-01
DRAFT: BROCADE CONFIDENTIAL
•
ACL overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
•
Default ACL configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
•
ACL configuration guidelines and restrictions . . . . . . . . . . . . . . . . . . . . . . . . 86
•
ACL configuration and management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Provide a measure of security.
Save network resources by reducing traffic.
Block unwanted traffic or users.
Reduce the chance of denial of service (DOS) attacks.
Standard ACLs—Permit and deny traffic according to the source MAC address in the incoming
frame. Use standard MAC ACLs if you only need to filter traffic based on source addresses.
Extended ACLs—Permit and deny traffic according to the source and destination MAC
addresses in the incoming frame, as well as EtherType.
Physical interfaces
Logical interfaces (LAGs)
Chapter
8
85