Enhancements
Release M.10.02 Enhancements
Test packet against criteria in first ACE.
Is there a | Yes |
|
|
|
| Perform action |
| End | |
match? |
| (permit or deny). |
| |
|
|
| ||
|
|
| ||
|
|
|
|
|
No
Test the packet against criteria in second ACE.
| Is there a |
| Yes |
| Perform action |
|
|
| |||||||
|
|
| End | ||||||||||||
|
|
|
|
|
| ||||||||||
| match? |
|
|
| (permit or deny). |
|
| ||||||||
|
|
|
|
|
|
| |||||||||
|
|
|
|
| |||||||||||
|
| No |
|
|
|
|
|
|
|
|
| ||||
|
|
|
|
|
|
|
|
|
|
| |||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Test packet against |
|
|
|
|
|
|
|
|
|
| ||||
| criteria in Nth ACE. |
|
|
|
|
|
|
|
|
|
| ||||
|
|
|
|
|
|
| Yes |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| ||
| Is there a |
|
| Perform action |
|
|
|
| |||||||
|
|
|
|
|
| End | |||||||||
| match? |
|
|
| (permit or deny). |
|
|
| |||||||
|
|
|
|
|
|
| |||||||||
|
|
|
|
|
| ||||||||||
|
| No |
|
|
|
|
|
|
|
|
| ||||
|
|
|
|
|
|
|
|
|
|
| |||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Deny the packet |
|
| End |
|
|
|
|
|
| |||||
|
|
|
|
|
|
|
|
| |||||||
| (invoke implicit |
|
|
|
|
|
|
|
|
|
|
| |||
|
|
|
|
|
|
|
|
|
|
|
| ||||
| deny any). |
|
|
|
|
|
|
|
|
|
|
| |||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
1.If a match is not found with the first ACE in an ACL, the switch proceeds to the next ACE and so on.
2.If a match with an explicit ACE is subsequently found, the packet is either permit- ted (forwarded) or denied (dropped), depending on the action specified in the matching ACE. In this case the switch ignores all sub- sequent ACEs in the ACL.
3.If a match is not found with any explicit ACE in the ACL, the switch invokes the implicit deny IP any at the end of every ACL, and drops the packet.
Note: If the list includes a permit IP any entry, no packets can reach the implicit deny IP any at the end of the list. Also, a permit IP any ACE at any point in an ACL defeats the purpose of any subsequent ACEs in the list.
Figure 4. The
Note
The order in which an ACE occurs in an ACL is significant. For example, if an ACL contains six ACEs, but the first ACE is a “permit IP any”, then the ACL permits all IP traffic from the authenticated client, and the remaining ACEs in the list do not apply, even if they specify criteria that would make a match with any of the traffic permitted by the first ACE.
52