Brocade Network Advisor IP User Manual 561
53-1003056-01
Chapter
18
Security Management
In this chapter
Security overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561
Layer 2 access control list management. . . . . . . . . . . . . . . . . . . . . . . . . . . 561
Layer 3 access control list policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
Media Access Control (MAC) filter management. . . . . . . . . . . . . . . . . . . . . 620
Security configuration deployment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629

Security overview

Security management enables you to filter traffic using Layer 2 and Layer 3 access control lists
(ACLs) and Media Access Control (MAC) filters:
Access control lists enable you to filter traffic based on Layer 2 or Layer 3 information in the
packet header of the Ethernet frame.
-Layer 2, the data link layer, transfers data between the source and destination within the
same network.
-Layer 3, the network layer, transfers data between the source and destination through one
or more networks.
MAC Filters enable you to filter traffic based on the MAC layer header in the Ethernet frame.

Layer 2 access control list management

A Layer 2 access control list (ACL) enables you to filter traffic based on the information in the IP
packet header using the MAC address and Ethernet type.
NOTE
Layer 2 ACLs can filter traffic for both Fabric OS and IronWare FCoE devices.
An ACL is a unique collection of permit and deny statements (rules) that apply to frames. You can
use ACLs to permit or deny incoming frames from passing through an interface to which you
assigned the ACLs. When the interface receives the frame, the device compares the fields in the
frame against any ACLs assigned to the interface to verify that the frame has the required
permissions to be forwarded. The device compares the frame, sequentially, against each rule in the
assigned ACL. If the frame matches the permit rule, the traffic is forwarded; otherwise, the traffic is
dropped.