FTOS Configuration Guide for the C-Series - Force10 Networks

Chapter 17
IP Access Control Lists, Prefix Lists, and Route-maps are supported on platforms: c e s
Ingress IP ACLs are supported on platforms: c s
Ingress and Egress IP ACLs are supported on platform: e
Overview
At their simplest, Access Control Lists (ACLs), Prefix lists, and Route-maps permit or deny traffic based
on MAC and/or IP addresses. This chapter discusses implementing IP ACLs, IP Prefix lists and
Route-maps. For MAC ACLS, refer to Chapter 9, Layer 2, on page 181.
An ACL is essentially a filter containing some criteria to match (examine IP, TCP, or UDP packets) and an
action to take (permit or deny). ACLs are processed in sequence so that if a packet does not match the
criterion in the first filter, the second filter (if configured) is applied. When a packet matches a filter, the
switch drops or forwards the packet based on the filter’s specified action. If the packet does not match any
of the filters in the ACL, the packet is dropped ( implicit deny).
The number of ACLs supported on a system depends on your CAM size. Refer toChapter 3, Content
Addressable Memory (CAM), on page 77 for complete CAM profiling information.
This chapter covers the following topics:
• IP Access Control Lists on page 334
— Configuring Layer 2 and Layer 3 ACLs on an Interface on page 343
— Assign an IP ACL to an Interface on page 343
— Configuring Ingress ACLs on page 345
— Configuring Egress ACLs on page 346
— Configuring ACLs to Loopback on page 348
— Applying an ACL on Loopback Interfaces on page 348
• IP Prefix Lists on page 349
• ACL Resequencing on page 355
• Route Maps on page 357
IP Access Control Lists,
Prefix Lists, and Route-maps
FTOS Configuration Guide, version 7.7.1.0 333