Access control lists

Table 1. Access Control List product support

Feature

Product

Release introduced

For configuration details, see VOSS User Guide.

Platform specific considerations for ACL and ACE behavior are documented in ACL Filters Behavior Differences, which is in VOSS User Guide.

Access Control List (ACL)-based filtering, including egress ACLs, ingress ACLs, Layer 2 to Layer 4 filtering, port-based, and VLAN-based

5520 Series

VOSS 8.2.5

VSP 4450 Series

VSP 4000 4.0

VSP 4900 Series

VOSS 8.1

VSP 7200 Series

VOSS 4.2.1

VSP 7400 Series

VOSS 8.0

VSP 8200 Series

VSP 8200 4.0

VSP 8400 Series

VOSS 4.2

VSP 8600 Series

VSP 8600 4.5

XA1400 Series

VOSS 8.0.50

InVSN Filter

5520 Series

VOSS 8.2.5

VSP 4450 Series

VOSS 7.0

VSP 4900 Series

VOSS 8.1

VSP 7200 Series

VOSS 7.0

VSP 7400 Series

VOSS 8.0

VSP 8200 Series

VOSS 7.0

VSP 8400 Series

VOSS 7.0

VSP 8600 Series

Not Supported

XA1400 Series

Not Supported

IPv6 ingress filters

5520 Series

VOSS 8.2.5

VSP 4450 Series

VOSS 4.1

VSP 4900 Series

VOSS 8.1

VSP 7200 Series

VOSS 4.2.1

VSP 7400 Series

VOSS 8.0

VSP 8200 Series

VOSS 4.1

VSP 8400 Series

VOSS 4.2

VSP 8600 Series

VSP 8600 6.2

XA1400 Series

Not Supported

IPv6 egress filters

5520 Series

VOSS 8.2.5

VSP 4450 Series

VOSS 7.0

VSP 4900 Series

VOSS 8.1

VSP 7200 Series

VOSS 7.0

VSP 7400 Series

VOSS 8.0

VSP 8200 Series

VOSS 7.0

VSP 8400 Series

VOSS 7.0

VSP 8600 Series

Not Supported

XA1400 Series

Not Supported

Apply rules to incoming and outgoing traffic. The total number of ACLs that you can configure differs depending on the switch.

An ACL can filter either IPv6 or non-IPv6 packets. By default, an ACL filters non-IPv6 packets. You must specify the packet type as IPv6 at the ACL level to enable IPv6 filtering. You cannot change the packet type for the ACL after you configure it. If you need a different packet type, you must delete the ACL, and then re-create it with the other packet type.

You can associate an ACL with the following interfaces:

Note

Note

Traffic filtering supports IPv6 ingress and egress port-based and VLAN-based security ACL filters.

IPv6 ingress and egress QoS ACL filters are not supported.

VLAN-based ACL filters are not supported on a DvR Leaf node.

Note

Note

The VSP 8600 Series Segmented Management Instance does not support ACL based filters or use of ping with -Q option to change the internal priority of management traffic.

The ingress VLAN ACL associations apply to all active port members of a VLAN. An ACL is created in the enabled state by default.

The InVSN Filter is an Access Control List (ACL) that can be used with MAC-in-MAC (MIM) encapsulated packets that are received on the Network Node Interface (NNI) ingress ports and are routed or bridged to UNI ports or terminated on the fabric node. The InVSN Filter matches and filters IPv4 and IPv6 packet headers coming on UNI ports only, NNI ports only, or both UNI and NNI ports. The InVSN Filter does not filter packets that arrive on NNI ingress ports but are bridged to other NNI ports or are for transit traffic.

An ACL can contain multiple filter rules called Access Control Entries (ACE). ACEs provide match criteria and rules for ACL-based filters. An ACE can provide actions such as dropping a packet, monitoring a packet, or remarking QoS on a packet. Complete lists of actions are provided in the Access Control Entries section. After an ingress or egress packet meets the match criteria specified in ACEs within an ACL, the system executes the predefined action.

ACLs provide the ability to configure default and global actions. A default action is applied when no filter rule (ACE) matches on a packet flow. The global action is executed when any filter rule (ACE) matches on a packet flow. The default action mode for ACLs is permit. ACL global actions are:

The following figure shows the relationships between ACEs and VLAN- and port-based ACLs.

Click to expand in new window
ACE and ACL relationships