Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

7-8
Access Control Lists (ACLs)
Overview
■ TOS—a mechanism for implementing QoS at Layer 3
The value for the IP header’s one-byte TOS field can range from 0
through 255. Typically, only values 0 through 63 are used—the six-bit
Differential Services (DiffServ) Code Point (DSCP) values. (The other two
bits make up the explicit congestion notification field.)
Again, higher values typically receive higher priority, but the exact han-
dling depends on your network’s implementation.
ACL Strategies
The Wireless Edge Services xl Module’s ACLs can enforce a variety of flexible
policies. Within a given rule, or among the rules in a given ACL, you can
combine filter criteria—for example, to filter based on a port number and
source and destination addresses, or based on an Ethertype and a WLAN index
value, and so on.
Example policies include:
■ limiting a particular subnetwork to accessing certain servers only
For example, your Wireless Edge Services xl Module places wireless
traffic in VLAN 8 (192.168.8.0/24). You want to limit the wireless users to
accessing a Web server. You would create an extended IP ACL and add a
permit rule with the destination address of the Web server. The source
address would be 192.168.1.0, and the prefix length would be 24.
You would then apply the ACL to inbound traffic on VLAN 8. The module
only forwards traffic matching the permit rule (that is, traffic destined to
the Web server).
■ marking traffic destined for a particular port (or range of ports) for QoS
or TOS
You may want to mark time-sensitive traffic, which is often destined to
one of UDP’s real-time ports, for higher QoS. For example, to mark traffic
destined for UDP port 1720 with a TOS value, you would create an
extended IP ACL with a rule that includes these specifications:
• a mark operation and the desired TOS value
• the UDP protocol
• the 1720 destination port
The source and destination wildcard/masks would both be set to “any,”
and you would not specify the WLAN index.