3Com 5500G, 4210, 4200G manual Arp

Configuring User-Defined ACLs 213

■With the Switch 5500/5500G, for a user-defined ACL to be assigned successfully, the maximum length of a user-defined rule string is 32 bytes. The string may or may not contain spaces, and can occupy up to eight mask offset units. Besides, any two offset units cannot belong to the same offset group.

Table 2 Offset units of a user-defined rule string

Offset unit

Offset1	Offset2	Offset3	Offset4	Offset5	Offset6	Offset7	Offset8
0 to 3	4 to 7	8 to 11	12 to 15	16 to 19	20 to 23	24 to 27	28 to 31
2 to 5	6 to 9	10 to 13	14 to 17	18 to 21	22 to 25	26 to 29	30 to 33
6 to 9	10 to 13	14 to 17	18 to 21	22 to 25	26 to 29	30 to 33	34 to 37
12 to 15	16 to 19	20 to 23	24 to 27	28 to 31	32 to 35	36 to 39	40 to 43
20 to 23	24 to 27	28 to 31	32 to 35	36 to 39	40 to 43	44 to 47	48 to 51
30 to 33	34 to 37	38 to 41	42 to 45	46 to 49	50 to 53	54 to 57	58 to 61
42 to 45	46 to 49	50 to 53	54 to 57	58 to 61	62 to 65	66 to 69	70 to 73
56 to 59	60 to 63	64 to 67	68 to 71	72 to 75	76 to 79	0 to 3	4 to 7

■For example, assuming that you configure ACL 5000, specifying a 32-byte rule string, a rule mask of all Fs, and an offset of 4 and then apply the ACL to Ethernet 1/0/1. In this case, the 32-byte rule string occupies eight offset units: 4 to 7 (Offset2), 8 to 11 (Offset3), 12 to 15 (Offset4), 16 to 19 (Offset5), 20 to 23 (Offset1), 24 to 27 (Offset7), 28 to 31 (Offset8), and 32 to 35 (Offset6), as shown in Table 2. The rule can be assigned successfully.

■If you configure ACL 5001, specifying a 32-byte rule string, a rule mask of all Fs, and an offset of 24 and then apply the ACL to Ethernet 1/0/1: In this case, the 32-byte rule string does not comply with the rule that a user-defined rule string can contain up to eight mask offset units and any two offset units cannot belong to the same offset. The ACL cannot be assigned.

The common protocol types and their offsets are listed in the following table.

		Offset for	Offset for
		Switch 5500s	Switch 5500s
		with VLAN-VPN	with VLAN-VPN	Offset for
	Protocol number	function	function	Switch
Protocol type	(hexadecimal)	disabled	enabled	5500Gs
ARP	0x0806	16	20	20
RARP	0x8035	16	20	20
IP	0x0800	16	20	20
IPX	0x8137	16	20	20
AppleTalk	0x809B	16	20	20
ICMP	0x01	27	31	31
IGMP	0x02	27	31	31
TCP	0x06	27	31	31
UDP	0x17	27	31	31