ACL Style Policy

Traditional ONEPolicy architecture uses a hierarchical approach to rule precedence where rule type dictates precedence. In addition, rule look-ups occur per role, per action type. This means, for example, that triggering a forward/drop rule without an explicit Class of Service (CoS) action results in applying the forward/drop action, and then continuing searching until a rule with CoS action matches. This hierarchical approach is implemented in hardware by maintaining one list for forward/drop actions, and one list for CoS actions. This implementation often results in underused resources, because not every rule has both forward/drop and CoS actions.

With ACL Style Policy, a mode of operation with a single ordered list per role is maintained. Rule look-ups occur in the provided ACL order per role. A match applies all actions specified, and the search stops. This approach can potentially double the advertised scale of classification rules as compared to the traditional model. It also provides a more standard approach to policy classification rules.

Default policy rule-model is hierarchical, unless you are upgrading from ExtremeXOS 30.5 with a saved configuration that is set to access list.

For information about configuring ACL Style Policy, see Configuring ACL Style Policy.

Limitations

SNMP for configuration of ACL Style Policy classification rules is not supported.

Traditional Versus ACL Style Policy Classification Rule Scaling

The following table compares the overall classification rule scale between "traditional" and ACL Style policy:

Table 1. Traditional Versus ACL Style Policy Classification Rule Scaling
Switch Model(s)	Traditional	ACL Style**
5320-48T	Default: 1,976 Less System ACL: 1,976	Default: 4,024 Less System ACL: N/A
5320-16P*	Default: 1,976 Less System ACL: 1,976	Default: 4,024 Less System ACL: N/A
5420M	Default: 4,024 Less System ACL: 4.024	Default: 8,120 Less System ACL: N/A
5420F	Default: 1,976 Less System ACL: 1,976	Default: 4,024 Less System ACL: N/A
5520	Default: 4,024 Less System ACL: 4.024	Default: 8,120 Less System ACL: N/A
5720-MW	Default: 6,072 Less System ACL: 6,072	Default: 12,216 Less System ACL: N/A
5720-MXW	Default: 8,120 Less System ACL: 8,120	Default: 16,312 Less System ACL: N/A

* - 5320-16P models do not support MAC and IPv6 rules.

** - Applies to role-based DACLs as well as static ACLs created via the Policy CLI, which are also associated with a profile. User-based DACLs may achieve lower ACL Style numbers.

ACL Style Classification Rule Architecture

Single ordered list per role.
Rule look-ups done in provided ACL order.
Rule look-up match applies all actions, and then the search stops.
5-tuple rule match support.
Layer 4 port range.
Rule types: application, ipsourcesocket, ipdestsocket, ipfrag, udpsourceportIP, udpdestportIP, tcpsourceportIP, tcpdestportIP, icmptype, icmp6type, ipttl, iptos, ipproto, ether.
Rule actions: permit/deny, CoS (prio, tos, rate-limit, shape, etc), mirror, Syslog, and count.

RESTful API Support

ACL Style Policy implements a new RESTful API for configuration of classification rules.

Note

RESTful API is not supported for Dynamically-created ACLs via RADIUS and COA.