Users Guide

676 Access Control Lists
What Is the ACL Mirror Function?
ACL mirroring provides the ability to send a copy of traffic that matches a
permit rule to a specific physical port or LAG. Using ACLs to mirror traffic is
called flow-based mirroring, since the traffic flow is defined by the ACL
classification rules. This is in contrast to port mirroring, where all traffic
encountered on a specific interface is replicated out of another interface.
Mirroring is similar to the redirect function, except that in flow-based
mirroring a copy of the permitted traffic is delivered to the mirror interface
while the packet itself is forwarded normally through the device. A given ACL
rule cannot be configured with both mirror and redirect attributes.
What Is ACL Logging
ACL Logging provides a means for counting the number of “hits” against an
ACL rule. To configure ACL Logging, augment the ACL permit or deny rule
specification with a “log” parameter that enables hardware hit count
collection and reporting. The switch uses a fixed five minute logging interval,
at which time trap log entries are written for each ACL logging rule that
accumulated a non-zero hit count during that interval. The hit count is the
number of times the rule has been invoked since the expiry of the last logging
interval. It is not possible to configure the logging interval.
What Are Time-Based ACLs?
The time-based ACL feature allows the switch to dynamically apply an
explicit ACL rule within an ACL for a predefined time interval by specifying a
time range on a per-rule basis within an ACL, so that the time restrictions are
imposed on the ACL rule.
With a time-based ACL, one can define when and for how long an individual
rule of an ACL is in effect. To apply a time to an ACL, first define a specific
time interval and then apply it to an individual ACL rule so that it is
operational only during the specified time range, for example, during a
specified time period or on specified days of the week.
A time range can be absolute (specific time) or periodic (recurring). If an
absolute and periodic time range entry are defined within the same time
range, the periodic timer is active only when the absolute timer is active.