Acl C Onfiguration - 3Com SuperStack 4 Configuration Manual

8
Brief Introduction to
ACL
ACL C
ONFIGURATION
This chapter covers the following topics:
Brief Introduction to ACL
■
QoS Configuration
■
QoS Profile Configuration
■
ACL Control Configuration
■
A series of matching rules are required for the network devices to identify the
packets to be filtered. After identifying the packets, the Switch can permit or deny
them to pass through according to the defined policy. Access Control List (ACL) is
used to implement such functions.
ACL classifies the data packets with a series of matching rules, including source
address, destination address and port number, and so on. The Switch verifies the
data packets with the rules in ACL and determines to forward or discard them.
The data packet matching rules defined by ACL can also be called in some other
cases requiring traffic classification, such as defining traffic classification for QoS.
An access control rule includes several statements. Different statements specify
different ranges of packets. When matching a data packet with the access control
rule, the issue of match order arises.
The case of filter or classify the data transmitted by the hardware
ACL can be used to filter or classify the data transmitted by the hardware of the
Switch. In this case, the match order of the ACL's sub-rules is determined by the
Switch hardware. The match order defined by the user will not be effective.
Table 222 Hardware Match Order of ACL's sub-rule
Switch
Switch 5500G-EI
The case includes: ACL cited by QoS function, ACL used for filter the packet
transmitted by the hardware and so on.
The case of filter or classify the data transmitted by the software
ACL can be used to filter or classify the data treated by the software of the Switch.
In this case, the match order of ACL's sub-rules can be determined by the user.
There are two match-orders:
order when matching the rule) and
automatically when matching the rule, i.e. in depth-first order). Once the user
Harware match order of ACL's sub-rule
An ACL is configured with multiple sub-rules. The
latest sub-rule will be matched first.
(by following the user-defined configuration
config
(according to the system sorting
auto