Intel® NetStructure™ 6000 Switch

C H A P T E R 5
Managing the Switch
IP access control and access lists do not apply to frames that are
switched within the same VLAN. If the devices are on the same
VLAN, they maintain their IP connectivity and are able to ping or
Telnet each other even though ACL rules may forbid IP traffic
between the two.
IP connection between an end station and the 6000 switch is never
subjected to ACL rules. An end station can Telnet the switch or use
an SNMP agent for management activities.
The IP Access Control configuration is stored in NVRAM.
ACL rules
The order rules are applied to an incoming packet are determined by
the order that a rule was entered into the ACL. The 6000 switch
supports a maximum of 128 filtering rules.
The source IP address and source wildcard mask or destination IP
address and destination wildcard mask represents a single host or a
range of hosts in a network.
A wildcard mask is a method used to define a range of host IP
addresses with an accompanying network or subnet IP address. It
uses the same notation as the dotted decimal IP address. The wildcard
mask cannot overlap with the corresponding network or subnet
address.
Network/
Subnet
Address
Wildcard Mask Examples
Wildcard
Mask
172.18.1.0 0.0.0.255
172.18.2.0 0.0.0.7
Description
All the host addresses in the range
172.18.1.0. through 172.18.1.255,
All the host addresses in the range
172.18.2.0. through 172.18.2.7,
172.18.3.0 0.0.255.255 Invalid since address and mask overlap,
For a single device or host, the address must be the designated IP
address of the device and the wildcard mask must be 0.0.0.0 or the
word “host.”
permit 172.18.1.2 0.0.0.0 172.18.3.2 0.0.0.0
or
permit 172.18.1.2 host 172.18.3.2 host
188