Users Guide

Access Control Lists 723
No Implicit “deny all” Rule
When an access-group is configured on an interface, an implicit rule of “deny
all” is applied to the last access-group on the interface. Since PBR processing
occurs after normal ACL processing, when a “permit” route-map associated
ACL is applied to an interface, the implicit “deny all” rule is not applied.
When match rules in an ACL associated with a route-map are successful,
packets are considered as candidates for routing according to rules specified in
route-map. If none of the match rules are successful, then packet is routed by
the standard L3 routing process. The implicit “deny all” rule is not applicable
to interfaces on which a routing policy is configured. Configuring an explicit
deny all ACL that not associated with a route-map will drop packets prior to
them being processed by PBR.
Black Holes Possible
If the next hop specified by a policy-based rule is not reachable, packets
matching the ACL are routed using the routing table. If the routing table
does not supply a route to the destination, then the packets are lost. If a set
interface null0 statement is present in the policy map, the packets are
dropped. The set interface null0 statement can also be used to drop
undesirable or unwanted traffic, i.e. create a black hole route.
Counter Support for Route-map ACL
A counter is associated with each ACL rule associated with a route-map in
order to indicate how many packets have been policy routed. There is no
provision to non-destructively clear these counters from the UI. Counters
associated with route-map statement are cleared when the route-map is
removed from the VLAN. The hardware does not support both a counter and
a rate-limit. Therefore, the system does not support configuring ACLs with a
rate-limit being used for PBR. In this case, a separate interface or VLAN ACL
with a rate-limit can be used at the cost of consuming additional resources.
Packets matching PBR-associated ACLs that contain deny statements are not
counted. Deny ACLs in PBR rules are optimized out of the system as they
always fall through to the next PBR statement.