02.10.2013 Views

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Figure 97 MAC Address Rendered from <strong>the</strong> 48-bit Address<br />

MAC addresses can be used in Access Control Lists (ACLs) to prevent flooding of multicast traffic and to<br />

filter traffic. With <strong>FTOS</strong>, you create an ACL to drop or <strong>for</strong>ward traffic from MAC destination or source<br />

addresses, and you can filter traffic based on <strong>the</strong> E<strong>the</strong>rnet frame <strong>for</strong>mat used by <strong>the</strong> traffic. As soon as you<br />

configure <strong>the</strong> mac access-list command on an interface, it is applied to that interface and filters traffic on<br />

that interface. For more in<strong>for</strong>mation on MAC addresses, refer to IEEE Standard 802.1D Media Access<br />

Control (MAC) Bridges.<br />

MAC Access Control List Basics<br />

An ACL is a series of sequential filters that contain a matching criterion (<strong>the</strong> MAC address) and an action<br />

(deny or permit). The filters are processed in sequence; <strong>for</strong> example, if <strong>the</strong> traffic does not match <strong>the</strong> first<br />

filter, <strong>the</strong> second filter is applied. When <strong>the</strong> MAC address matches a filter, <strong>FTOS</strong> drops or <strong>for</strong>wards <strong>the</strong><br />

traffic based on <strong>the</strong> filter’s designated action. If <strong>the</strong> MAC address does not match any of <strong>the</strong> filters in <strong>the</strong><br />

ACL, <strong>the</strong> traffic is <strong>for</strong>warded. This default behavior is different from IP ACL, which drops traffic not<br />

matching any filters.<br />

MAC ACL Implementation<br />

The maximum size of MAC ACLs is determined by <strong>the</strong> CAM size of <strong>the</strong> line card and <strong>the</strong> Layer 2 CAM<br />

allocation between MAC addresses and MAC ACLs. Once you determine <strong>the</strong> maximum possible <strong>for</strong> your<br />

line card, you must also determine <strong>the</strong> CAM’s allocation of MAC addresses versus MAC ACLs.<br />

In E-<strong>Series</strong>, you can assign multiple ingress ACLs per interface. For TeraScale line cards, you can also<br />

assign one egress ACL per interface. If an ACL is not assigned to an interface, it is not used by <strong>the</strong><br />

software in any o<strong>the</strong>r capacity.<br />

Ingress MAC ACLs are supported on plat<strong>for</strong>ms: c s<br />

In <strong>FTOS</strong>, you can create two different types of MAC ACLs: standard or extended. A standard MAC ACL<br />

filters traffic based on <strong>the</strong> source MAC address. An extended MAC ACL filters traffic based on any of <strong>the</strong><br />

following criteria:<br />

• Source MAC address<br />

• Destination MAC address<br />

48 Bits<br />

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 1 0 0 1 0 1 0 0 0 1 0 1 0 0 1 1 1 1 1 0 1<br />

00:00:0C:12:8A:7D<br />

190 Layer 2<br />

FN00003A

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!