SNR S2989G-48TX-DC [275/553] Acl configuration task list

S2989G-24TX Operation Manual

Chapter 6 Security Function Configuration

6-2

direction on all ports. Access-group is the description to the binding of an access-list to the

incoming direction on a specific port. When an access-group is created, all packets from

in the incoming direction through the port will be compared to the access-list rule to decide

whether to permit or deny access.

The current firmware only supports ingress ACL configuration.

6.1.1.3 Access-list Action and Global Default Action

There are two access-list actions and default actions: “permit” or “deny”. The

following rules apply:

 An access-list can consist of several rules. Filtering of packets compares packet

conditions to the rules, from the first rule to the first matched rule; the rest of the rules

will not be processed. Global default action applies only to IP packets in the incoming

direction on the ports.

 Global default action applies only when packet flirter is enabled on a port and no ACL

is bound to that port, or no binding ACL matches.

6.1.2

ACL Configuration Task List

ACL Configuration Task Sequence:

1. Configuring access-list

(1) Configuring a numbered standard IP access-list

(2) Configuring a numbered extended IP access-list

(3) Configuring a standard IP access-list based on nomenclature

a) Create a standard IP access-list based on nomenclature

b) Specify multiple “permit” or “deny” rule entries

c) Exit ACL Configuration Mode

(4) Configuring an extended IP access-list based on nomenclature

a) Create an extensive IP access-list based on nomenclature

b) Specify multiple “permit” or “deny” rule entries

c) Exit ACL Configuration Mode

(5) Configuring a numbered standard MAC access-list

(6) Configuring a numbered extended MAC access-list

(7) Configuring a extended MAC access-list based on nomenclature

a) Create a extensive MAC access-list based on nomenclature

b) Specify multiple “permit” or “deny” rule entries

c) Exit ACL Configuration Mode

(8) Configuring a numbered extended MAC-IP access-list

(9) Configuring a extended MAC-IP access-list based on nomenclature