C H A P T E R 35 Configuring Ipv4 And Ipv6 Access Control Lists; Ipv4-Acl And Ipv6-Acl Configuration Guidelines; About Filter Contents; Protocol Information - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

IPv4-ACL and IPv6-ACL Configuration Guidelines

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
IPv4-ACL and IPv6-ACL Configuration Guidelines
Follow these guidelines when configuring IPv4-ACLs or IPv6-ACLs in any switch or director in the
Cisco MDS 9000 Family:
•
Tip
Caution
•
•

About Filter Contents

An IP filter contains rules for matching an IP packet based on the protocol, address, port, ICMP type,
and type of service (TS).
This section includes the following topics:
•
•
•
•
•

Protocol Information

The protocol information is required in each filter. It identifies the name or number of an IP protocol.
You can specify the IP protocol in one of two ways:
•
•
Cisco MDS 9000 Family CLI Configuration Guide
35-2
You can apply IPv4-ACLs or IPv6-ACLs to VSAN interfaces, the management interface, Gigabit
Ethernet interfaces on IPS modules and MPS-14/2 modules, and Ethernet PortChannel interfaces.
If IPv4-ACLs or IPv6-ACLs are already configured in a Gigabit Ethernet interface, you cannot
add this interface to an Ethernet PortChannel group. See the
Guidelines" section on page 46-7
Do not apply IPv4-ACLs or IPv6-ACLs to only one member of a PortChannel group. Apply
IPv4-ACLs or IPv6-ACLs to the entire channel group.
Configure the order of conditions accurately. As the IPv4-ACL or the IPv6-ACL filters are
sequentially applied to the IP flows, only the first match determines the action taken. Subsequent
matches are not considered. Be sure to configure the most important condition first. If no conditions
match, the software drops the packet.
Configure explicit deny on the IP Storage Gigabit Ethernet ports to apply IP ACLs because implicit
deny does not take effect on these ports.
Protocol Information, page 35-2
Address Information, page 35-3
Port Information, page 35-3
ICMP Information, page 35-4
ToS Information, page 35-5
Specify an integer ranging from 0 to 255. This number represents the IP protocol.
Specify the name of a protocol including, but not restricted to, Internet Protocol (IP), Transmission
Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol
(ICMP).
Chapter 35 Configuring IPv4 and IPv6 Access Control Lists
for guidelines on configuring IPv4-ACLs.
OL-18084-01, Cisco MDS NX-OS Release 4.x
"Gigabit Ethernet IPv4-ACL