KB.15.15

Exception for Connection-Rate filtering

Connection-rate filtering can be configured along with one or more other ACL applications on the

same interface. In this case, a connection-rate match for a filter action is carried out according

to the configured policy, regardless of whether any other ACLs on the interface have a match for

a deny action. Also, if a connection-rate filter permits (ignore action) a packet, it can still be

denied by another ACL on the interface.

Features common to all ACL applications

• Any ACL canhave multiple entries (ACEs).

• You can apply any one ACL to multiple interfaces.

• All ACEs in an ACL configured on the switch are automatically sequenced (numbered). For

an existing ACL, entering an ACE without specifying a sequence number automatically places

the ACE at the end of the list. Specifying a sequence number inserts the ACE into the list at

the specified sequential location.

◦ Automatic sequence numbering begins with "10" and increases in increments of 10. You

can renumber the ACEs in an ACL and also change the sequence increment between

ACEs.

◦ The CLI remark command option allows you to enter a separate comment for each ACE.

• A source or destination IPv4 address and amask, together, can define a single host, a range

of hosts, or all hosts.

• Every ACL populated with one or more explicit ACEs includes an Implicit Deny as the last

entry in the list. The switch applies this action to any packets that do not match other criteria

in the ACL. For standard ACLs, the Implicit Deny is deny any. For extended ACLs, it is deny

ip any any.

• In any ACL, you can apply an ACL log function to ACEs that have an explicit "deny" action.

The logging occurs when there is a match on a "deny" ACE. The switch sends ACL logging

output to Syslog, if configured, and, optionally, to a console session.

You can create ACLs for the switch configuration using either the CLI or a text editor. The text-editor

method is recommended when you plan to create or modify an ACL that has more entries than

you can easily enter or edit using the CLI alone. See “Enabling ACL logging on the switch”

(page 294).

312 IPv4 Access Control Lists (ACLs)