Users Guide

734 Access Control Lists
Rate limit WWW traffic (ACL)
This example creates an ACL to rate-limit WWW traffic ingressing the
switch on te1/0/1. Initial and established values require tuning for local traffic
patterns and link speeds. Note that this ACL applies to traffic sent to the
switch IP address as well as traffic forwarded by the switch (in rule). Permit
rules with a rate-limit parameter do not require a following deny rule as
matching packets exceeding the rate limit are discarded. Compare this with
the example above.
console#config
console(config)#ip access-list rate-limit-www
console(config-ip-acl)#permit tcp any any eq www flag established
rate-limit 9216 128
console(config-ip-acl)#permit tcp any any eq www rate-limit 1024 64
console(config-ip-acl)#2147483647 permit every
console(config-ip-acl)#exit
console(config)#interface te1/0/1
console(config-if-Te1/0/1)#ip access-group rate-limit-www in
console(config-if-Te1/0/1)#exit
Rate Limit In-Band Management Traffic
The following is an example of rate limiting in-band management traffic on a
Layer-2 switch. The first two rules rate limit Telnet and SSH (22) traffic for
established connections. The third and fourth rules set specific limits for in-
bound Telnet and SSH connection requests (third and fourth rules). Setting
the control plane mode on the access group limits the requests to those
packets transferred to the CPU and does not affect packets transiting the
switching silicon. Likewise, because this is internally an egress ACL, it rate
limits packets egressing the silicon to the CPU and does not affect packets
that are routed in software due to Layer-3 table lookup failures, nor does it
affect packets sent to the CPU via the system rules, as they are applied on
ingress.
The established connection rate limit parameters are 1024 Kbits/second and a
burst of 128 Kbytes. The non-established rate limits are 12 Kbytes/second
with a 2 Kbyte burst.
console#config
console(config)#ip access-list rate-limit-inband-mgmt
console(config-ip-acl)#permit tcp any any eq telnet flag
established rate-limit 1024 128