User Manual

Enterasys X-Pedition User Reference Manual 371

ACL Basics

The following syntax description shows the fields of an IPX ACL rule:

Each field in an ACL rule is position sensitive. For example, for a TCP traffic rule, the source

address must be followed by the destination address, the source socket, the destination socket, and

so on.

Not all fields of an ACL rule need to be specified. If you do not specify a particular field, the XP

treats the field as a wildcard or “don't care” condition. However, if a field is specified, that

particular field will be matched against the packet. Each protocol can have a number of different

fields to match. For example, a rule for TCP can use socket port numbers, while a rule for IPX can

use a network node address.

Since each field is position sensitive, it may be necessary to “skip” some fields in order to specify a

value for another field. To skip a field, use the keyword any. For example, the following ACL rule

denies SMTP traffic between any two hosts:

Note that in the above example, the <tos> (Type of Service) field is not specified and is treated as a

wildcard. The any keyword is needed only to skip a wildcard field in order to explicitly specify

another field that is further down in the rule. If there are no other fields to specify, the any keyword

is not necessary. For example, the following ACL permits all IP traffic to go through:

How ACL Rules are Evaluated

For an ACL with multiple rules, the ordering of the rules is important. When the XP checks a

packet against an ACL, it goes through each rule in the ACL sequentially. If a packet matches a

rule, it is forwarded or dropped based on the permit or deny keyword in the rule. All subsequent

rules are ignored. That is, a first-match algorithm is used. There is no hidden or implied ordering of

ACL rules, nor is there precedence attached to each field. The XP simply goes down the list, one

rule at a time, until there is a match. Consequently, rules that are more specific (that is, with more

selection criteria) should always be listed ahead of rules that are less specific. For example, the

following ACL permits all TCP traffic except those from subnet 10.2.0.0/16:

When a TCP packet comes from subnet 10.2.0.0/16, it finds a match with the first rule. This causes

the packet to be dropped. A TCP packet coming from other subnets does not match the first rule.

Instead, it matches the second rule, which allows the packet to go through.

acl <name> permit|deny ipx <SrcAddr> <SrcSocket> <DstAddr> <DstSocket>

acl nosmtp deny tcp any any smtp smtp

acl yesip permit ip

acl 101 deny tcp 10.2.0.0/16 any any any

acl 101 permit tcp any any any any