Port Acls - Extreme Networks Summit WM3000 Series Reference Manual

Each session has a default idle time-out interval. If no packets are received within this interval, the
session is terminated and a new session must be initiated. These intervals are fixed and cannot be
configured by the user.
The default idle time-out intervals for different sessions are:
ICMP and UDP sessions— 30 seconds
●
TCP sessions— 2 hours
●

Port ACLs

The controller supports Port ACLs on physical interfaces and inbound traffic only. The following Port
ACLs are supported:
Standard IP ACL— Uses a source IP address as matching criteria.
●
Extended IP ACL— Uses a source IP address, destination IP address and IP protocol type as basic
●
matching criteria. It can also include other parameters specific to a protocol type, like the source and
destination ports for TCP/UDP protocols.
MAC Extended ACL— Uses source and destination MAC addresses and VLAN ID. It optionally, also
●
uses Ethertype information.
Port ACLs are also stateful and are not applied on every packet controllered through the controller.
Whenever a packet is received inbound, it is examined against existing sessions to determine if it
belongs to an established session. ACLs are applied on the packet in the following manner:
1 If the packet matches an existing session, it is not matched against ACL rules and the session decides
where to send the packet.
2 If no existing sessions match the packet, it is matched against ACL rules to determine whether to
accept or reject it. If ACL rules accept the packet, a new session is created and all further packets
belonging to that session are allowed. If ACL rules reject the packet, no session is established.
A session is based on:
Source IP address
●
Destination IP address
●
Source Port
●
Destination Port
●
ICMP identifier
●
Incoming interface index
●
IP Protocol
●
Source MAC
●
Destination MAC
●
Ethertype
●
VLAN-ID
●
802.1p bits
●
When a Port ACL is applied to a trunk port, the ACL filters traffic on all VLANs present on the
trunk port. With Port ACLs, you can filter:
Summit WM3000 Series Controller System Reference Guide
321