Users Guide

Access Control Lists (ACLs)

This chapter describes access control lists (ACLs), prefix lists, and route-maps.

At their simplest, access control lists (ACLs), prefix lists, and route-maps permit or deny traffic based on MAC and/or IP addresses. This

chapter describes implementing IP ACLs, IP prefix lists and route-maps. For MAC ACLS, refer to Layer 2.

An ACL is essentially a filter containing some criteria to match (examine IP, transmission control protocol [TCP], or user datagram protocol

[UDP] packets) and an action to take (permit or deny). ACLs are processed in sequence so that if a packet does not match the criterion in

the first filter, the second filter (if configured) is applied. When a packet matches a filter, the switch drops or forwards the packet based

on the filter’s specified action. If the packet does not match any of the filters in the ACL, the packet is dropped (implicit deny).

The number of ACLs supported on a system depends on your content addressable memory (CAM) size. For more information, refer to

User Configurable CAM Allocation and CAM Optimization. For complete CAM profiling information, refer to Content Addressable Memory

(CAM).

NOTE: You can apply Layer 3 VRF-aware ACLs only at the ingress level.

• VRF Instances

• Interfaces

• V4 ACL CAM

• VRF V4 ACL CAM

• L2 ACL CAM

• Port/VLAN based PERMIT/DENY Rules

• Port/VLAN based IMPLICIT DENY Rules

• VRF based PERMIT/DENY Rules

• VRF based IMPLICIT DENY Rules

NOTE: You can configure VRF-aware ACLs on interfaces either using a range of VLANs or a range of VRFs but not both.

Topics:

• IP Access Control Lists (ACLs)

• Important Points to Remember

• IP Fragment Handling

• Configure a Standard IP ACL

• Configure an Extended IP ACL

• Configure Layer 2 and Layer 3 ACLs

• Assign an IP ACL to an Interface

• Applying an IP ACL

• Configure Ingress ACLs

• Configure Egress ACLs

• IP Prefix Lists

• ACL Resequencing

• Route Maps

• Logging of ACL Processes

• Flow-Based Monitoring Support for ACLs

IP Access Control Lists (ACLs)

In Dell Networking switch/routers, you can create two different types of IP ACLs: standard or extended.

A standard ACL filters packets based on the source IP packet. An extended ACL filters traffic based on the following criteria:

• IP protocol number

• Source IP address

98 Access Control Lists (ACLs)