The effects of the action keywords in ACLs

Creating MAC address hardware ACLs

MAC address hardware ACLs filter packets on the basis of their source or destination MAC address.

The command syntax is:

awplus(config)#access-list <4000-4699> <action> <source-mac-address>

<destination-mac-address>

The source and destination MAC addresses can be any of the following:

za range of MAC addresses. To specify this, enter a MAC address and the mask. Specify the mask as a wildcard mask:

awplus(config)#access-list 4000 permit 1234.1234.1234 0000.0000.000f

...

(this example selects MAC addresses from 1234.1234.1230 to 1234.1234.123f)

za single MAC address. To specify this, enter the MAC address and a mask of 0000.0000.0000:

awplus(config)#access-list 4000 permit 1234.1234.1234 0000.0000.0000

...

zall MAC addresses. To specify this, enter the keyword any:

awplus(config)#access-list 4000 permit any ...

The effects of the action keywords in ACLs

Let us consider the effect of each the possible action keywords.

Action

What it does

When do you need this action?

deny

Drops the traffic.

Use this when the filtering policy is to disallow certain

 

 

traffic flows.

 

 

 

permit

Forwards the traffic normally.

Use this when you want to:

 

 

z discard a wide range of traffic, but still forward some

 

 

small subset of traffic within that range.

 

 

z use the ACL in a QoS class-map to select traffic for the

 

 

switch to apply QoS settings to (like queue shaping).

 

 

 

copy-to-cpu

Forwards the traffic normally, and

Use this when you want software monitoring of a certain

 

also sends a copy of each packet to

packet flow. If you want to log, or count, or output debug

 

the CPU.

pertaining to a certain stream, then create an ACL that

 

 

matches the packets in the stream, and specify the copy-

 

 

to-cpu action.

send-to-cpu

Drops the traffic, but also sends a

 

copy of each packet to the CPU.

Use this when you want software monitoring of a certain packet flow that is being dropped. If you want to log, count, or output debug pertaining to a certain disallowed stream, then create an ACL that matches the packets in the stream, and specify the send-to-cpu action.

copy-to-mirror

Forwards the traffic normally, and

 

also sends a copy of each packet to

 

the mirror port.

Use this when you want to mirror only a certain stream, instead of mirroring all traffic on a port.

Page 6 AlliedWare Plus™ OS How To Note

Page 5 Page 7
Page 6
Image 6
Allied Telesis x908, X900-12XT/S manual Effects of the action keywords in ACLs, Creating MAC address hardware ACLs
Page 5 Page 7

X900-12XT/S, x908 specifications

The Allied Telesis x908 and the SwitchBlade x900 series of network switches are cutting-edge solutions designed to address the demands of modern networking environments. These switches are known for their high performance, reliability, and robust feature sets, making them ideal for enterprise and service provider networks.

The Allied Telesis x908 series consists of modular and chassis-based systems that can accommodate a variety of network configurations. One of the main features of the x908 series is its ability to offer high scalability with support for a large number of ports. This makes it suitable for data centers and large enterprise networks where space and bandwidth optimization are critical.

In addition to scalability, the x908 series supports advanced Layer 2 and Layer 3 switching capabilities. This allows for efficient traffic management and routing, ensuring that data is delivered swiftly and reliably. The x908 also incorporates intelligent features such as Quality of Service (QoS), which prioritizes critical network traffic, ensuring that time-sensitive data—like voice and video—maintains its quality during transmission.

The SwitchBlade x900 series takes this functionality further with its innovative modular architecture. This allows organizations to configure their networks to meet specific needs by choosing from a variety of interface cards and service modules. The SwitchBlade x900 also supports advanced security features such as Access Control Lists (ACLs) and VLAN segmentation, which provide enhanced protection against unauthorized access and network threats.

Another hallmark of the x908 and SwitchBlade series is their support for high-speed Ethernet technologies, including 10G and 40G Ethernet. This enables organizations to keep pace with the increasing bandwidth demands of applications and services, particularly in cloud computing and data-intensive workloads.

Both the x908 and the SwitchBlade x900 series are designed with energy efficiency in mind, featuring power-saving technologies that reduce overall operational costs. Coupled with Allied Telesis' management tools, which provide detailed analytics and monitoring, network administrators can optimize performance and energy consumption simultaneously.

In summary, the Allied Telesis x908 and SwitchBlade x900 series offer a comprehensive suite of features, high performance, scalability, and advanced networking technologies. They represent a strategic investment for organizations looking to build resilient, efficient, and future-proof network infrastructures.
Top Page Image Contents