Qtech QSW-3200-28T [57/136] Brief introduction of acl

+7(495) 797-3311www.qtech.ru

Москва, Новозаводская ул., 18, стр. 1

Chapter 7 ACL CONFIGURATION

7.1 Brief introduction of ACL

7.1.1 Introduction of ACL

In order to filtrate data packet, it needs configuring a series of matching rules to recognize the

object which needs filtration. After recognizing special object, it can configure to permit or deny

corresponded data packet passing according to the scheduled strategy. Access Control List

(ACL) is used to realize this function.

ACL can classifies data packet according to a series of matching condition which can be

source address, destination address and interface number. Switch detects data packet

according to the specified condition of ACL to determine to transmit or drop.

Data packet matching rules defined by ACL can be introduced to other situation which needs

distinguish flow, such as the flow classification in QoS.

7.1.2 Matching order configuration

An ACL rule consists of many «permit | deny» syntax, and the range of data packet specified

by each syntax is different. When matching a data packet and ACL rule, there should be order.

Use following command to configure ACL matching order:

access-list access-list-number match-order { config | auto }

Parameter:

access-list-number: the number of ACL rule which is in the range of 1 to 399.

config: Specify user configured order when matching this rule.

auto: Specify auto-sequencing when matching this rule. (according to the deep precedency) It

is defaulted to specify user configured order, that is «config» . Once user configures the

matching order of an ACL rule, it cannot be changed unless delete the content of the rule and

re-configure its order.

The deep precedency used by auto means locating the syntax with the smallest data range at

the end, which can be realized by comparing address wildcard. The smaller the wildcard value

is, the smaller range the host has. For example, 192.168.3.1 0 specifies a host:

192.168.3.1,while 192.168.3.1 0.0.255.255 specifies a network interface: 192.168.3.1

～192.168.255.255. The former is before the latter in ACL. The concrete rule is: For standard

ACL syntax, compare source address wildcard, if their wildcard is the same, use config order;

for layer 2 ACL, the rule with «any» is in the front, others use config order; for extended ACL,

compare source address wildcard, if they are the same, compare destination address wildcard,

if they are the same, compare interface number range, the smaller is in the back, if the

interface number range is the same, use config order; for user-defained ACL, compare the

length of mask, the longer is in the back, if they are the same, use config order.

7.1.3 ACL support

ACL can be classified as following:

ACL is the command control list applied to switch. These command is used to tell switch which

data packet to receive and which to refuse. It consists of a series of judging syntax. After

activating an ACL, switch will examine each data packet entering switch according to the

judging condition given by ACL. The one which satisfies the ACL will be permit or dropped

according to ACL. QOS introduces the permit rule configuration.