Users Guide

Table Of Contents

690 Access Control Lists

Limitations

Internally Generated Packets

Packets that are generated internally by the router are never policy routed.

Set Clause Required

Route-map deny/permit statements without “set” clauses are ignored except

in the case where a deny route-map refers to an ACL with a permit statement.

Policy Action (VLAN) ACL Action (Interface) Result

set ip precedence deny deny

mirror both

redirect both (see Note 1)

rate limit both

set interface null0 deny deny (see Note 2)

mirror mirror

redirect redirect

rate limit deny

set ip next-hop (default) deny deny

mirror both

redirect both (see Note 1)

rate limit both

1. In the case of redirect ACL action, both the redirect and policy actions are

honored, if possible. This implies the policy routed packet is redirected to the

configured physical port and the redirected port is participating in the egress VLAN

to which the packet is being routed. In other words, the system will select the

interface specified by the ACL which is a member of the egress VLAN. If the physical

interface is not a member of the egress VLAN, the behavior is undefined.

2. In case of the PBR set interface Null0 action, the PBR routed packet is dropped

only if no conflicting port ACL is configured. Configuring ACL deny statements that

also match packets with a PBR set interface Null0 action is redundant and wastes

system resources.