Cisco 220 Series Smart Plus Administration Manual page 227

Access Control
Access Control Lists
NOTE
NOTE
Cisco 220 Series Smart Plus Switches Administration Guide Release 1.0.0.x
Each ACE is made up of filters that distinguish traffic groups and associated
actions. A single ACL may contain one or more ACEs, which are matched against
the contents of incoming frames. Either a DENY or PERMIT action is applied to
frames whose contents match the filter.
The switch supports a maximum of 512 ACLs, and a maximum of 128 ACEs per
ACL.
When a packet matches an ACE filter, the ACE action is taken and that ACL
processing is stopped. If the packet does not match the ACE filter, the next ACE is
processed. If all ACEs of an ACL have been processed without finding a match,
and if another ACL exists, it is processed in a similar manner.
If no match is found to any ACE in all relevant ACLs, the packet is dropped (as a
default action). Because of this default drop action you must explicitly add ACEs
into the ACL to permit all traffic, including management traffic, such as Telnet, HTTP,
or SNMP that is directed to the switch itself. For example, if you do not want to
discard all the packets that do not match the conditions in an ACL, you must
explicitly add a lowest priority ACE into the ACL that permits all the traffic.
If IGMP/MLD Snooping is enabled at a port bound with an ACL, add ACE filters in
the ACL to forward IGMP/MLD packets to the switch. Otherwise, IGMP/MLD
Snooping will fail at the port.
The order of the ACEs within the ACL is significant, since they are applied in a first-
fit manner. The ACEs are processed sequentially, starting with the first ACE.
ACLs can be used for security, for example by permitting or denying certain traffic
flows, and also for traffic classification and prioritization in QoS advanced mode.
A port can be either secured with ACLs or configured with advanced QoS policy,
but not both.
There can only be one ACL per port, with the exception that it is possible to
associate both an IPv4-based ACL and an IPv6-based ACL with a single port.
To associate more than one ACL with a port, a policy with one or more class maps
must be used (see Configuring QoS Policies
Mode section).
The following types of ACLs can be defined (depending on which part of the
frame header is examined):
• MAC-based ACL—Examines Layer 2 fields only, as described in the
Configuring MAC-based ACLs
• IP ACL—Examines the L3 layer of IP frames, as described in the
Configuring IPv4-based ACLs
in the Configuring QoS Advanced
section.
section.
17
225