Cabletron Systems SSIM-R8-02 Especificações descarregar pdf (Página 306)

Using ACLs

286 Enterasys Xpedition User Reference Manual

For example, to edit ACL 101, you issue the command acl-edit 101. The only restriction is

that when you edit a particular ACL, you cannot add rules for a different ACL. You can

only add new rules for the ACL that you are currently editing. When the editing session is

over, that is, when you are done making changes to the ACL, you can save the changes

and make them take effect immediately. Within the ACL editor, you can add new rules

(add command), delete existing rules (delete command) and re-order the rules (move

command). To save the changes, use the save command or simply exit the ACL Editor.

If you edit and save changes to an ACL that is currently being used or applied to an

interface, the changes will take effect immediately. There is no need to remove the ACL

from the interface before making changes and reapply it after changes are made. The

process is automatic.

Using ACLs

It is important to understand that an ACL is simply a definition of packet characteristics

specified in a set of rules. An ACL must be enabled in one of the following ways:

• Applying an ACL to an interface, which permits or denies traffic to or from the XP.

ACLs used in this way are known as Interface ACLs.

• Applying an ACL to a service, which permits or denies access to system services

provided by the XP. ACLs used in this way are known as Service ACLs.

• Applying an ACL to ports operating in Layer-4 bridging mode, which permits or

denies bridged traffic. ACLs used in this way are known as Layer-4 Bridging ACLs.

• Associating an ACL with ip-policy, nat, port mirroring, rate-limit, or web-cache

commands, which specifies the criteria that packets, addresses, or flows must meet in

order to be relevant to these XP features. ACLs used in this way are known as Profile

ACLs.

These uses of ACLs are described in the following sections.

Applying ACLs to Interfaces

An ACL can be applied to an interface to examine either inbound or outbound traffic.

Inbound traffic is traffic coming into the XP. Outbound traffic is traffic going out of the XP.

For each interface, only one ACL can be applied for the same protocol in the same

direction. For example, you cannot apply two or more IP ACLs to the same interface in the

inbound direction. You can apply two ACLs to the same interface if one is for inbound

traffic and one is for outbound traffic, but not in the same direction. However, this

restriction does not prevent you from specifying many rules in an ACL. You just have to

put all of these rules into one ACL and apply it to an interface.

When a packet comes into the XP at an interface where an inbound ACL is applied, the XP

compares the packet to the rules specified by that ACL. If it is permitted, the packet is

allowed into the XP. If not, the packet is dropped. If that packet is to be forwarded to go

1 2 ... 301 302 303 304 305 306 307 308 309 310 311 ... 393 394

Sem comentários

Cabletron Systems SSIM-R8-02 Especificações Página 306