Brocade Communications Systems 6650 manual Applying egress ACLs to Control CPU traffic

Applying egress ACLs to Control (CPU) traffic

The dscp-matchingoption matches on the packet’s DSCP value. Enter a value from 0 – 63. This option does not change the packet’s forwarding priority through the device or mark the packet. Refer to “DSCP matching” on page 1738.

The log parameter enables SNMP traps and Syslog messages for inbound packets denied by the ACL:

-You can enable logging on inbound ACLs and filters that support logging even when the ACLs and filters are already in use. To do so, re-enter the ACL or filter command and add the log parameter to the end of the ACL or filter. The software replaces the ACL or filter command with the new one. The new ACL or filter, with logging enabled, takes effect immediately.

The traffic-policyoption enables the device to rate limit inbound traffic and to count the packets and bytes per packet to which ACL permit or deny clauses are applied. For configuration procedures and examples, refer to the chapter “Traffic Policies” on page 1765.

Configuration example for extended named ACLs

To configure an extended named ACL, enter the ip access-list extended ACL_name command.

Brocade(config)# ip access-list extended “block Telnet”

Brocade(config-ext-nACL)# deny tcp host 10.157.22.26 any eq telnet log

Brocade(config-ext-nACL)# permit ip any any

Brocade(config-ext-nACL)# exit

Brocade(config)# interface ethernet 1/1/1

Brocade(config-if-e10000-1/1/1)# ip access-group “block Telnet” in

The options at the ACL configuration level and the syntax for the ip access-groupcommand are the same for numbered and named ACLs and are described in “Extended numbered ACL configuration” on page 90 and “Extended numbered ACL configuration” on page 90.

Applying egress ACLs to Control (CPU) traffic

By default, outbound ACLs are not applied to traffic generated by the CPU. This must be enabled using the enable egress-acl-on-cpu-trafficcommand.

Syntax: enable egress-acl-on-cpu-traffic

Preserving user input for ACL TCP/UDP port numbers

ACL implementations automatically display the TCP/UDP port name instead of the port number, regardless of user preference, unless the device is configured to preserve user input. When the option to preserve user input is enabled, the system will display either the port name or the number.

To enable this feature, enter the ip preserve-ACL-user-input-formatcommand.

Brocade(config)# ip preserve-ACL-user-input-format

Syntax: ip preserve-ACL-user-input-format

Brocade ICX 6650 Security Configuration Guide	101
53-1002601-01