Dynamic Access Control Lists (ACL)
NoteYou must configure VCAP partitioning to use dynamic ACL (see VCAP Partitioning).
If ACL style policy is not selected, or if the specified action-set does not exist, or if insufficient resources are available, the dynamic ACL rules are not applied and a NAK response to the RADIUS CoA request are returned. The maximum number of Dynamic ACL rules per user is 64. Access-Accept can include multiple adds using the += operation (this operation is not supported as part of RADIUS CoA request). Access-Accept usage does not support delete operation is ignored. Dynamic ACL rules can be deleted using an explicit CoA delete or are deleted when the dynamic session associated with the user is deleted.
NoteThe maximum length of a RADIUS packet size is 4096 (both UDP and TLS), which can prevent the Dynamic ACLs from being sent to get trimmed via VSA 232 due to the lengthier ACL lists.
Dynamic ACLs and Layer 7 policy share the slices not used by TCI overwrite-enabled as one shared resource pool (see VCAP Partitioning). Dynamic ACLs have a higher priority to override Layer 7 policy (DNS) entry matches.
Beginning with Release 32.1, masking IPv4 addresses, L4 ports, and IP protocol numbers are supported. The mask is a required value and must be greater than zero and less than or equal to the maximum number of bits in the field being masked. For example, an IPv4 address mask value must be between 1 and 32.
- ipv4src ipv4source/mask-length
- ipv4dst ipv4dest/mask-length
- ipproto ipproto (TCP, UDP, ICMP, or protocol number)
- l4srcport l4sourceport/mask-length (requires ipproto; range is role-based only with no mask)
- l4dstport l4destport-i4sourceportend/mask-length (requires ipproto; range is role-based only with no mask)
- ether (role-based only)
- CoS (not valid if “drop” is specified)
- Drop (not valid if “forward” is specified)
- Forward (not valid if “drop” is specified)
To see an example of dynamic ACL VSA string, see Example Dynamic ACL VSA String.
ExtremeSwitching X450-G2, X460-G2, X440-G2, X465, X590, X620, X695 series switches.
- TCI overwrite is not supported on X435 switches.
- Layer 7 policy (DNS) is not supported on X435 switches.
- Dynamic Access-List is not supported on X435 switches.
- DNS is not supported on Extended Edge switches with Controlling Bridges on the ExtremeSwitching X695 series switch.
- ACL style policy must be selected.
- Only a subset of the existing policy rules is allowed.
- SNMP is not supported.
- Controlling Bridge does not support tci-overwrite on policy profiles for the ExtremeSwitching X695 series switch.