KB.15.15

NOTE: Software release K.15.01 supports connection-rate ACLs for inbound IPv4 traffic, but not

for IPv6 traffic.

In cases where an RACL and any type of port or VLAN ACL are filtering traffic entering the switch,

the switched traffic explicitly permitted by the port or VLAN ACL is not filtered by the RACL (except

when the traffic has a destination on the switch itself). However, routed traffic explicitly permitted

by the port or VLAN ACL (and switched traffic having a destination on the switch itself) must also

be explicitly permitted by the RACL, or it will be dropped.

A switched packet is not affected by an outbound RACL assigned to the VLAN on which the packet

exits from the switch.

Beginning with software release K.14.01, static ACL mirroring and static ACL rate-limiting are

deprecated in favor of classifier-based mirroring and rate-limiting features that do not use ACLs.

If ACL mirroring or ACL rate-limiting are already configured in a switch running software version

K.13.xx, downloading and booting from release K.14.01 or greater automatically modifies the

deprecated configuration to conform to the classifier-based mirroring and rate-limiting supported

in release K.14.01 or greater. For more information on this topic, see chapter "Classifier-Based

Software Configuration" in the latest Advanced Traffic Management Guide for your switch.

For information on traffic mirroring, see the "Monitoring and Analyzing Switch Operation" appendix

in the latest Management and Configuration Guide for your switch.

Features common to all ACL applications

• Any ACL can have multiple entries (ACEs).

• You can apply any one ACL to multiple interfaces.

• All ACEs in an ACL configured on the switch are automatically sequenced (numbered). For

an existing ACL, entering an ACE without specifying a sequence number automatically places

the ACE at the end of the list. Specifying a sequence number inserts the ACE into the list at

the specified sequential location.

• Automatic sequence numbering begins with "10" and increases in increments of 10. You

can renumber the ACEs in an ACL and also change the sequence increment between

ACEs.

• The CLI remark command option allows you to enter a separate comment for each ACE.

• A source or destination IPv6 address and a prefix length, together, can define a single host,

a range of hosts, or all hosts.

• Every ACL populated with one or more explicit ACEs automatically includes an implicit deny

as the last entry in the list. The switch applies this action to packets that do not match other

criteria in the ACL.

• In any ACL, you can apply an ACL log function to ACEs that have an explicit "deny" or

“permit” action. (The logging occurs when there is a match on a "deny" or “permit” ACE that

includes the log keyword.) The switch sends ACL logging output to syslog, if configured, and

optionally, to a console session.

You can create ACLs for the switch configuration using either the CLI or a text editor. The text-editor

method is recommended when you plan to create or modify an ACL that has more entries than

you can easily enter or edit using the CLI alone.

Overview 99