ACL Style Policy

Traditional ONEPolicy architecture uses a hierarchical approach to rule precedence where rule type dictates precedence. In addition, rule look-ups occur per role, per action type. This means, for example, that triggering a forward/drop rule without an explicit Class of Service (CoS) action results in applying the forward/drop action, and then continuing searching until a rule with CoS action matches. This hierarchical approach is implemented in hardware by maintaining one list for forward/drop actions, and one list for CoS actions. This implementation often results in underused resources, because not every rule has both forward/drop and CoS actions.

With ACL Style Policy, a mode of operation with a single ordered list per role is maintained. Rule look-ups occur in the provided ACL order per role. A match applies all actions specified, and the search stops. This approach can potentially double the advertised scale of classification rules as compared to the traditional model. It also provides a more standard approach to policy classification rules.

For information about configuring ACL Style Policy, see Configuring ACL Style Policy.

Limitations

SNMP for configuration of ACL Style Policy classification rules is not supported.

Traditional Versus ACL Style Policy Classification Rule Scaling

Traditional Versus ACL Style Policy Classification Rule Scaling compares the overall classification rule scale between "traditional" and ACL Style policy.

Table 1. Traditional Versus ACL Style Policy Classification Rule Scaling

Table Profile Name	X450-G2 X460-G2		X670-G2 X870		X440-G2 X620		X690 X590 X465		X695
	Traditional	ACL Style	Traditional	ACL Style	Traditional	ACL Style	Traditional	ACL Style	Traditional	ACL Style
Default	952	1,976	952	1,976	440	952	1,976	4,024	1,976	3,512
Less System ACL	1,464	1,976	952	1,976	440	952	1,976	4,024	1,976	3,512

ACL Style Classification Rule Architecture

• Single ordered list per role.
• Rule look-ups done in provided ACL order.
• Rule look-up match applies all actions, and then the search stops.
• 5-tuple rule match support.
• Layer 4 port range.
• Rule types: application, ipsourcesocket, ipdestsocket, ipfrag, udpsourceportIP, udpdestportIP, tcpsourceportIP, tcpdestportIP, icmptype, icmp6type, ipttl, iptos, ipproto, ether.
• Rule actions: permit/deny, CoS (prio, tos, rate-limit, shape, etc), mirror, Syslog, and count.

RESTful API Support

ACL Style Policy implements a new RESTful API for configuration of classification rules.