ADTRAN AOS Version R10.1.0 Command Reference Manual page 3115

Command Reference Guide
log
Default Values
By default, all AOS security features are disabled, and there are no configured hardware ACLs.
Command History
Release 17.6
Functional Notes
Hardware ACLs are used as frame selectors by the hardware access maps; by themselves they do
nothing. Hardware ACLs are composed of an ordered list of entries with an implicit deny any at the end of
each list. A hardware ACL with no entries includes an implicit permit any. An ACL entry contains two parts:
an action (permit or deny) and a frame pattern. A permit ACL matches frames (meeting the specified
pattern) and allows them to enter the network. A deny ACL advances AOS to the next ACL entry.
ACL criteria are compared to the incoming frame in the order in which they were entered or from the top of
the list down. Generally, the most specific entries should be at the top and the more general at the bottom.
Changing hardware ACL or hardware access map configuration or application causes
new information to be reinstalled on the hardware. It is possible to run out of hardware
resources depending on how many resources are needed to apply the desired change. If
there are not enough hardware resources to install the new criteria in the hardware, an
error message is displayed. You can view the amount of hardware resources available
using the command
Usage Examples
The following example creates an IP hardware ACL Trusted to permit packets from any source destined
for IP address 192.168.20.0:
(config)#ip hw-access-list extended Trusted
(config-ext-ip-hw-nacl)#permit ip any host 192.168.20.0
The following example creates an entry in the Trusted IP hardware ACL that permits any UDP packets to
be forwarded to the UDP ports that range between 1080 and 1150:
(config)#ip hw-access-list extended Trusted
(config-ext-nacl)#permit udp any any range 1080 1150
60000CRG0-35E
range <min> <max>
Optional. Enables logging of any packets that match the hardware ACL
entry.
Command was introduced.
show hw-filter-resource on page
Copyright © 2012 ADTRAN, Inc.
Hardware ACLs and Hardware Access Maps
Matches only packets that contain a port
number in the specified range. Range is 0 to
65535.
518.
3115