590 Configuring Access Control Lists
The order of the rules is important: when a packet matches multiple rules,
the first rule takes precedence. Once a packet has matched a rule, the
corresponding action is taken and no further attempts to match the packet
are made. Also, once you define an ACL for a given port, all traffic not
specifically permitted by the ACL is denied access.
Egress (out) ACLs only affect switched/routed traffic. They have no effect
on packets generated locally by the switch, e.g., LACPDUs or spanning
tree BPDUs.
Ingress ACLs filter packets before they are processed by the switching
fabric. Egress ACLs filter packets after they have been processed by the
switching fabric.
User-defined ingress ACLs are prioritized before system ACLs. User-
defined ingress ACLs that match control plane packets such as BPDUs
interfere with switch operation.
Port ranges are not supported for egress ACLs for either IPv4 or IPv6 ACLs.
•The
fragments
and
routing
keywords are not supported for egress IPv6
ACLs. The
fragments
keywords is not supported on IPv4 egress ACLs.
On the N4000 switches, the IPv6 ACL
routing
keyword is not supported
when any IPv6 address is specified. The
routing
keyword is not support for
IPv4 ACLs.
On the N4000 switches, the IPv6 ACL
fragment
keyword matches only on
the first two IPv6 extension headers for the fragment header (next header
code 44). If the fragment header appears in the third or subsequent header,
it is not matched
On the N2000 and N3000 switches, the IPv6 ACL
fragment
keyword
matches only on the first IPv6 extension header (nex t header code 44). If
the fragment header appears in the second or subsequent header, it is not
matched.
•The IPv6 ACL
routing
keyword matches only on the first IPv6 extension
header (next header code 43). If the fragment he ader appears in the
second or subsequent header, it is not matched.
NOTE: The actual number of ACLs and rules supported depends on the
resources consumed by other processes and confi gured features running on the
switch.