3Com 10014298 manual ACL Overview, Filtering or Classifying, Hardware

7

QOS/ OPERATION

	■	ACL Overview
	■	Configuring ACLs
	■ Displaying and Debugging an ACL
	■	Configuring QoS
	■	Configuring ACL Control
ACL Overview	The Access Control List (ACL) classifies the data packets with a series of matching
	rules, including source address, destination address and port number. The switch
	verifies the data packets with the rules in the ACL and decides to forward,
	prioritize, or discard them.
	A series of matching rules are required for the network devices to identify the
	packets. After identifying the packets, the switch can permit or deny them to pass
	through according to the defined policy. The ACL is used to implement these
	functions.
	The data packet matching rules, that are defined by ACL, can also be used in other
	cases requiring traffic classification, such as defining traffic classification for QoS.
	An access control rule includes several statements. Different statements specify
	different ranges of packets. When matching a data packet with the access control
	rule, the issue of match-order arises.
	Configuring ACL Overview is described in the following sections:
	■ Filtering or Classifying Data Transmitted by the Hardware
	■ Filtering or Classifying Data Transmitted by the Software
	■ ACL Support on the Switch 7750
Filtering or Classifying	An ACL can be used to filter or classify the data transmitted by the hardware of
Data Transmitted by the	the switch. In this case, the match order of the ACL’s sub-rules is determined by
Hardware	the switch hardware and this match order takes precedence over the match order
	defined by the user.

An ACL is configured with multiple sub-rules. The sub-rule with the more accurate range is matched first. If some rules define the same range, the latest sub-rule will be matched first. For example, ACL 2000 has rule 0 and rule 1, the definition of rule 0 is “rule 0 permit ip source 1.1.1.1 0.0.255.255 destination 2.2.2.2 0.0.255.255”, the definition of rule 1 is “rule 1 permit ip source 1.1.1.1 0.0.0.255 destination 2.2.2.20.0.0.255”, rule 1 is more accurate, it will be matched first.