SMC Networks SMC6224M manual IP ACLs, Access Control Lists

ACCESS CONTROL LIST COMMANDS

•This switch supports ACLs for ingress filtering only. You can only bind one IP ACL to any port and one MAC ACL globally for ingress filtering. In other words, only two ACLs can be bound to an interface - Ingress IP ACL and Ingress MAC ACL.

The order in which active ACLs are checked is as follows:

1.User-defined rules in the Ingress MAC ACL for ingress ports.

2.User-defined rules in the Ingress IP ACL for ingress ports.

3.Explicit default rule (permit any any) in the ingress IP ACL for ingress ports.

4.Explicit default rule (permit any any) in the ingress MAC ACL for ingress ports.

5.If no explicit rule is matched, the implicit default is permit all.

Table 4-33 Access Control Lists

Command	Function	Page
Groups
IP ACLs	Configures ACLs based on IP addresses, TCP/UDP	4-117
	port number, protocol type, and TCP control code
MAC ACLs	Configures ACLs based on hardware addresses, packet	4-127
	format, and Ethernet type
ACL Information	Displays ACLs and associated rules; shows ACLs	4-133
	assigned to each port

IP ACLs

Table 4-34 IP ACLs

Command	Function	Mode	Page
access-list ip	Creates an IP ACL and enters configuration	GC	4-118
	mode
permit, deny	Filters packets matching a specified source	STD-ACL	4-119
	IP address
permit, deny	Filters packets meeting the specified criteria,	EXT-ACL	4-120
	including source and destination IP address,
	TCP/UDP port number, protocol type, and
	TCP control code

4-117