Owner's Manual

528 Configuring Access Control Lists

How Are ACLs Configured?

To configure ACLs, follow these steps:

Create a MAC ACL by specifying a name.

Create an IP ACL by specifying a number.

Add new rules to the ACL.

Configure the match criteria for the rules.

Apply the ACL to one or more interfaces.

Preventing False ACL Matches

Be sure to specify ACL access-list, permit, and deny rule criteria as fully as

possible to avoid false matches. This is especially important in networks with

protocols such as FCoE that have newly-introduced EtherType values. For

example, rules that specify a TCP or UDP port value should also specify the

TCP or UDP protocol and the IPv4 or IPv6 EtherType. Rules that specify an

IP protocol should also specify the EtherType value for the frame.

In general, any rule that specifies matching on an upper-layer protocol field

should also include matching constraints for each of the lower-layer protocols.

For example, a rule to match packets directed to the well-known UDP port

number 22 (SSH) should also include matching constraints on the IP

protocol field (protocol=0x11 or UDP) and the EtherType field (EtherType=

0x0800 or IPv4). Figure 20-1 lists commonly-used EtherTypes numbers:

NOTE: The actual number of ACLs and rules supported depends on the

resources consumed by other processes and configured features running on the

switch.

Table 20-1. Common EtherType Numbers

EtherType Protocol

0x0800 Internet Protocol version 4 (IPv4)

0x0806 Address Resolution Protocol (ARP)

0x0842 Wake-on LAN Packet

0x8035 Reverse Address Resolution Protocol (RARP)

0x8100 VLAN tagged frame (IEEE 802.1Q)