Alcatel-Lucent 6600 ACL Configuration Overview, Setting the Global Disposition

ACL Configuration Overview Configuring ACLs
page 25-8 OmniSwitch 6600 Family Network Configuration Guide April 2006
ACL Configuration Overview
This section describes the QoS CLI commands used specifically to configure ACLs. ACLs are basically a
type of QoS policy, and the commands used to configure ACLs are a subset of the switch’s QoS
commands. For information about basic configuration of QoS policies, see Chapter24, “Configuring
QoS.”
To configure an ACL, the following general steps are required:
1Set the global disposition. This step is described in “Setting the Global Disposition” on page25-8.
2Create a condition for the traffic to be filtered. This step is described in “Creating Condition Groups
For ACLs” on page 25-10 and “Creating Policy Conditions For ACLs” on page25-10.
3Create an action to accept or deny the traffic. This step is described in “Creating Policy Actions For
ACLs” on page25-11.
4Create a policy rule that combines the condition and the action. This step is described in “Creating
Policy Rules for ACLs” on page25-11.
For a quick tutorial on how to configure ACLs, see “Quick Steps for Creating ACLs” on page 25-3.
Setting the Global Disposition
By default, flows that do not match any policies are accepted on the switch. You may configure the switch
to deny any flow that does not match a policy.
Note. Note that the global disposition setting applies to all policy rules on the switch, not just those that
are configured for ACLs.
The global commands include:
qos default bridged disposition
qos default routed disposition
To change the global default dispositions, use these commands with the desired disposition value (accept,
drop, or deny).
For Layer 3 ACLs, it is recommended that the global dispositions be set to deny. For example, the follow-
ing command drops any routed traffic coming into the switch that does not match a policy:
-> qos default routed disposition deny
Policies may then be set up to allow routed traffic through the switch.
Note that in the current release of Alcatel’s QoS software, the drop and deny keywords produce the same
result (flows are silently dropped; no ICMP message is sent).
For more information about the global disposition commands, see Chapter 24, “Configuring QoS,” and the
OmniSwitch CLI Reference Guide.