BROCADE IP PRIMER

Security: Access Control Lists (ACL)the packet should be permitted, it will permit the packet, and update the sessiontable in the interface's CAM. The session table in CAM is a record of allthe traffic that the CPU has previously permitted (after applying the ACL rules).It lists the protocol (e.g., TCP, UDP, etc.), source IP address, source port, destinationIP address, and destination port of the packet. If the CPU finds that thepacket should be denied, the CPU will drop the packet, but it will make noupdates to the session table in CAM. CAM, at this point, is only used to recordtraffic that has been previously permitted by the CPU. If an incoming packetmatches an entry in the CAM, the interface hardware will permit the packet. Bydefault, the interface hardware will never deny packets (in Flow-Based ACLs).This can be changed with a global config command hw-drop-acl-deniedpacket.This command tells the switch to update the session table in CAM fordenied traffic as well as permitted traffic.“Fascinating,” you say, “but why are you telling me this?” Flow-Based ACLs aremuch more CPU-intensive to the switch. If you're pushing a heavy amount oftraffic through the switch, and you are applying many Flow-Based ACLs, thiscould tax the switch's CPU resources. For this reason, it is best to use Rule-Based ACLs wherever you can.“But how?” you ask. Remember when I said you have to specify direction inapplying an ACL? Well, it turns out that all outbound (“out”) ACLs are processedas Flow-Based. Inbound (“in”) ACLs are processed as Rule-Based (witha few exceptions). A Rule-Based ACL will change to a Flow-Based ACL underthe following conditions:• It is applied as an outbound ACL• A specific ICMP type is specified (e.g., “icmp any any echo,” as opposed to“icmp any any”)• Network Address Translation (NAT) is applied to the interface• ACL statistics are enabled (“enable-acl-counter”)• ACL logging is enabledThere are other, more specific circumstances as well. For up to date informationon the matter, consult Brocade's web site (http://www.brocade.com).To sum up, wherever possible, choose inbound ACLs, and avoid outboundACLs, particularly for switches that are processing a large amount of traffic.Strict ModeWhen you're using Flow-Based ACLs, the TCP and UDP checks on incoming oroutgoing segments aren't as thorough as you might think.For TCP traffic, only the control segments are checked against the ACLs. Controlsegments would include SYN, FIN, and RST. Data segments are notchecked against the ACLs. This was done to optimize performance. The lineand logic is that a data segment would have to have control segments precedingit. TCP must initiate with a three-way handshake, right?Brocade IP Primer 301