SMC Networks SMC6724L3 manual Configuring Access Control Lists

ACCESS CONTROL LISTS

Access Control Lists

Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, TCP/UDP port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter incoming packets, first create an access list, add the required rules, and then bind the list to a specific port.

Configuring Access Control Lists

An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests incoming packets against the conditions in an ACL one by one. If a list contains all permit rules, a packet will be accepted as soon as it passes any of the rules. If a list contains all deny rules, a packet will be rejected as soon as it fails any one of the rules. In other words, if no rules match for a permit list, the packet is dropped; and if no rules match for a deny list, the packet is accepted.

Command Usage

The following restrictions apply to ACLs:

•Each ACL can have up to 32 rules.

•The maximum number of ACLs is also 32.

•However, due to resource restrictions, the average number of rules bound to the ports should not exceed 20.

•The switch does not support the explicit “deny any any” rule for the IP ACL or MAC ACL. If these rules are included in an ACL, and you attempt to bind the ACL to an interface, the bind operation will fail.

•An access list can only contain all permit rules or all deny rules. In other words, for performance reasons, you cannot mix permit and deny rules in the same list.

3-41