Acl Configuration; Acl Overview - Zte ZXR10 5900 Series User Manual

7
C h a p t e r

ACL Configuration

Table of Contents

ACL Overview ...................................................................59

Configuring ACL ................................................................60
ACL Configuration Example .................................................66
ACL Maintenance and Diagnosis...........................................68
ACL Overview
Packet filtering can help limit network traffic and restrict network
use by certain users or devices. ACL's can filter traffic as it passes
through a router and permit or deny packets at specified inter-
faces.
An ACL is a sequential collection of permit and deny conditions
that apply to packets. When a packet is received on an interface,
the switch compares the fields in the packet against any applied
ACL's to verify that the packet has the required permissions to be
forwarded, based on the criteria specified in the access lists. It
tests packets against the conditions in an access list one by one.
The first match determines whether the switch accepts or rejects
the packets because the switch stops testing conditions after the
first match. The order of conditions in the list is critical. If no
conditions match, the switch rejects the packets. If there are no
restrictions, the switch forwards the packet; otherwise, the switch
drops the packet.
Packet matching rules defined by the ACL are also used in other
conditions where distinguishing traffic is needed. For instance, the
matching rules can define the traffic classification rule in the QoS.
ZXR10 5900/5200 provides the following six types of ACLs:
� Standard ACL: Only match the source IP address.
�
Extended ACL: Match the following items: Source IP address,
destination IP address, IP protocol type, TCP source port num-
ber, TCP destination port number, UDP source port number,
UDP destination port number, ICMP type, ICMP Code, DiffServ
Code Point (DSCP), ToS and Precedence.
� L2 ACL: Match source MAC address, destination MAC address,
source VLAN ID, L2 Ethernet protocol type and 802.1p priority
value.
� Hybrid ACL: Match source MAC address, destination MAC ad-
dress, source VLAN ID, source IP address, destination IP ad-
Confidential and Proprietary Information of ZTE CORPORATION 59