Administrator Guide

72 Switch Feature Overview
Access Control Lists (ACLs)
Access Control Lists (ACLs) can help to ensure network availability for
legitimate users while blocking attempts to access the network by
unauthorized users or to restrict legitimate users from accessing the network.
ACLs may be used to provide traffic flow control, restrict contents of routing
updates, decide which types of traffic are forwarded or blocked, and above all,
provide some level of security for the network. The switch supports the
following ACL types:
•IPv4 ACLs
•IPv6 ACLs
• MAC ACLs
For all ACL types, the ACL rule can be configured to filter traffic when a
packet enters or exits the Ethernet port, LAG, or VLAN interface. ACLs work
only on switched ports. They do not operate on the out-of-band port.
ACLs can be used to implement policy-based routing (PBR) to implement
packet routing according to specific organizational policies.
For information about configuring ACLs and PBR, see "Access Control Lists "
on page 629.
Time-Based ACLs
With the Time-based ACL feature, the administrator can define when an
ACL is in effect and the amount of time it is in effect.
For information about configuring time-based ACLs, see "Access Control
Lists " on page 629.
IP Source Guard (IPSG)
IP source guard (IPSG) is a security feature that filters IP packets based on
the source ID. The source ID may either be source IP address or a source IP
address source MAC address pair as found in the local DHCP snooping
database. IPSG depends on DHCP Snooping to associate IP address with
MAC addresses.
For information about configuring IPSG, see "Snooping and Inspecting
Traffic " on page 943.