Acl Evaluation Precedence - Extreme Networks ExtremeWare XOS Guide Manual

ACL Evaluation Precedence

This section discusses the precedence for evaluation among ACL rules.
Precedence within an ACL
An ACL is a policy file that contains one or more rules. In ExtremeWare XOS, each rule can be one of
following types:
L2 rule—a rule containing only Layer 2 (L2) matching conditions, such as Ethernet MAC address
●
and Ethernet type.
L3 rule—a rule containing only Layer 3 (L3) matching conditions, such as source or destination IP
●
address and protocol.
L4 rule—a rule containing both Layer 3 (L3) and Layer 4 (L4) matching conditions, such as TCP/
●
UDP port number.
NOTE
BlackDiamond 10K switch only—L2 matching conditions cannot be mixed with L3/L4 matching conditions in a rule,
otherwise, syntax checking will fail.
BlackDiamond 10K Only. When an ACL file contains both L2 and L3/L4 rules:
L3/L4 rules have higher precedence over L2 rules. L3/L4 rules are evaluated before any L2 rules.
●
The precedence among L3/L4 rules is determined by their relative position in the ACL file. Rules are
●
evaluated sequentially from top to bottom.
The precedence among L2 rules is determined by their position in the ACL file. Rules are evaluated
●
sequentially from top to bottom.
It is recommended that L2 and L3/L4 rules be grouped together for easy debugging.
●
Aspen 8810 Only. Rule precedence is solely determined by the rule's rlative order in the policy file. L2,
L3, and L4 rules are evaluated in the order found in the file.
Precedence among interface types
As an example of precedence among interface types, suppose a physical port 1:2 is member port of a
VLAN yellow. The ACL evaluation is performed in the following sequence:
If the ACL is configured on port 1:2, the port-based ACL is evaluated and the evaluation process
●
terminates.
If the ACL is configured on the VLAN yellow, the VLAN-based ACL is evaluated and the evaluation
●
process terminates.
If the wildcard ACL is configured, the wildcard ACL is evaluated and evaluation process terminates.
●
In summary, the port-based ACL has highest precedence, followed by the VLAN-based ACL and then
the wildcard ACL.
ExtremeWare XOS 11.1 Concepts Guide
ACL Policies
187