Chapter 7: Access Control Lists
Access Control Lists (ACL) provide packet filtering for IPv4 frames (based on
address, protocol, Layer 4 protocol port number or TCP control code), IPv6 frames
(based on address, next header ty pe, or flow l abel), or any fram es (based on MAC
address or Ethernet type). To filter incoming packets, first cr eate an access list, add
the required rules, and then bi nd the list to a speci fic p ort.

Configuring Access Control Lists

An ACL is a sequential lis t o f perm it o r de ny con diti ons that apply to IP ad dresses ,
MAC addresses, or other more specific criteria. This switch tests in gress packe ts
against the conditions in an ACL one by one. A packet will be accept ed a s soon a s it
matches a permit rule, or dropped as soon as it matches a de ny rule. If no rules
match, the packet is accepted.
Command Usage
The following restrictions apply to ACLs:
• Each ACL can have up to 32 rules.
• The maximum number of ACLs is also 32 .
• The maximum number of rules that ca n be bound to the ports is 96 for e ach of the
following list types: MAC ACLs, IP ACLs (including Standard and Extended ACLs),
IPv6 Standard ACLs, and IPv6 Extended ACLs. For the IC40240-10G, all ports share
this quota. For the IC40480-10G, ports 1-24 share a quota of 96 rules, and ports 25-50
share another quota of 96 rules (since there are two switch chips in this system).
The order in which active ACLs are checked is as follows:
1. User-defin ed rules in IP and MAC AC Ls for in gress p orts are c hecke d in pa ra llel.
2. Rules within an ACL are che cked in th e confi gured o rder, fr om top to bott om.
3. If the result of checking an IP ACL is to p ermit a packet, but t he result of a MAC
ACL on the same packet is to deny it, the packet w ill be denied (because the
decision to deny a packet has a higher priority for security reasons). A packet will
also be denied if the IP ACL denies it and the MAC A CL accep ts it.

Setting the ACL Name and Type

Use the ACL Configuration page to designate the name and type of an ACL.
Command Attributes
• Name – Name of th e ACL. (Maxim um len gth: 16 charac ters)
• Type – There are three filterin g modes:
- IP Standard: IPv4 ACL mode that filters packets based on the so urce IPv4
address.
- IP Extended: IPv4 ACL mode that filters packets based on sou rce or
destination IPv4 address, as well as protocol type and protocol port number.
7-1