xStack
The ip parameter instructs the Switch that this new rule will be applied to the IP addresses contained within each frame’s header. source_ip tells the Switch that this rule will apply to the source IP addresses in each frame’s header. Finally, the IP address 10.42.73.1 will be combined with the source_ip_mask 255.255.255.0 to give the IP address 10.42.73.0 for any source IP address between 10.42.73.0 to 10.42.73.255.
Due to a chipset limitation, the Switch supports a maximum of 8 access profiles. The rules used to define the access profiles are limited to a total of 9600 rules for the Switch, depending on line cards installed.
There is an additional limitation on how the rules are distributed among line cards inserted into the chassis. For
For 12 port line cards
It is important to keep this in mind when setting up VLANs as well. Access rules applied to a VLAN require that a rule be created for each port in the VLAN. For example, let’s say VLAN10 contains ports 2, 11 and 12. If you create an access profile specifically for VLAN10, you must create a separate rule for each port. Now take into account the rule limit. The rule limit applies to both port groups
In the example used above - config access_profile profile_id 1 add access_id 1 ip source_ip 10.42.73.1 port 7 deny – a single access rule was created. This rule will subtract one rule available for the port group 1 – 8, as well as one rule from the total available rules.
It must be noted that there are specific circumstances under which the ACL cannot filter a packet even when there is a condition match that should deny forwarding. This is a limitation that may arise if:
•the destination MAC is the same as the Switch (system) MAC
•a packet is directed to the system IP interface such as multicast IP packets or if the hardware IP routing table is full and Switch software routes the packet according to routing protocol.
In order to address this functional limitation of the chip set, an additional function, CPU Interface Filtering, has been added. CPU Filtering may be universally enabled or disabled. Setting up CPU Interface Filtering follows the same syntax as ACL configuration and requires some of the same input parameters. To configure CPU Interface Filtering, see the descriptions below for create cpu access_profile and config cpu access_profile. To enable CPU Interface Filtering, see config cpu_interface_filtering.
The
Due to a backward compatability issue, when a user upgrades to R3 firmware
