C H A P T E R 42 Configuring Ipv4 And Ipv6 Access Control Lists; Ipv4-Acl And Ipv6-Acl Configuration Guidelines; About Filter Contents; Protocol Information - Cisco AP775A - Nexus Converged Network Switch 5010 Configuration Manual

IPv4-ACL and IPv6-ACL Configuration Guidelines

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
IPv4-ACL and IPv6-ACL Configuration Guidelines
Follow these guidelines when configuring IPv4-ACLs or IPv6-ACLs in any switch or director in the
Cisco MDS 9000 Family:
•
Tip
Caution
•
•

About Filter Contents

An IP filter contains rules for matching an IP packet based on the protocol, address, port, ICMP type,
and type of service (TS).
This section includes the following topics:
•
•
•
•
•

Protocol Information

The protocol information is required in each filter. It identifies the name or number of an IP protocol.
You can specify the IP protocol in one of two ways:
•
•
Cisco MDS 9000 Family Fabric Manager Configuration Guide
42-2
You can apply IPv4-ACLs or IPv6-ACLs to VSAN interfaces, the management interface, Gigabit
Ethernet interfaces on IPS modules and MPS-14/2 modules, and Ethernet PortChannel interfaces.
If IPv4-ACLs or IPv6-ACLs are already configured in a Gigabit Ethernet interface, you cannot
add this interface to an Ethernet PortChannel group. See the
Guidelines" section on page 53-6
Do not apply IPv4-ACLs or IPv6-ACLs to only one member of a PortChannel group. Apply
IPv4-ACLs or IPv6-ACLs to the entire channel group.
Configure the order of conditions accurately. As the IPv4-ACL or the IPv6-ACL filters are
sequentially applied to the IP flows, only the first match determines the action taken. Subsequent
matches are not considered. Be sure to configure the most important condition first. If no conditions
match, the software drops the packet.
Configure explicit deny on the IP Storage Gigabit Ethernet ports to apply IP ACLs because implicit
deny does not take effect on these ports.
Protocol Information, page 42-2
Address Information, page 42-3
Port Information, page 42-3
ICMP Information, page 42-4
ToS Information, page 42-5
Specify an integer ranging from 0 to 255. This number represents the IP protocol.
Specify the name of a protocol including, but not restricted to, Internet Protocol (IP), Transmission
Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol
(ICMP).
Chapter 42 Configuring IPv4 and IPv6 Access Control Lists
for guidelines on configuring IPv4-ACLs.
OL-17256-03, Cisco MDS NX-OS Release 4.x
"Gigabit Ethernet IPv4-ACL