Understanding the network.pdf - Back to Home

Table 9.5. AppleTalk ACL
Filtering Matches
ACL Match Operator Data Value Description
1-65279 Match on a AppleTalk node address
network Match on a Phase 1 AppleTalk network
address
includes Match on a Phase 2 AppleTalk network
address
nbp Match on a name binding protocol
within
(object, type, zone)
Match on a Phase 2 AppleTalk network
address
zone Match on a AppleTalk zone name
AppleTalk ACLs are created with the same line-by-line entry format used to create
IP ACLs, and you should follow the same approach for ACL creation, editing, and
installation—in other words, using a text editor. The global configuration command
for creating AppleTalk ACL action statements is . Aside from care and
feeding, however, AppleTalk ACLs are very different from their IP and IPX
counterparts, particularly when it comes to filtering AppleTalk's named space.
In Chapter 3, "The Networker's Guide to AppleTalk, IPX, and NetBIOS," we reviewed
AppleTalk's naming entities. The NBP provides the mechanisms needed to map and
distribute object:name@zone information throughout the network. ZIP is used for
the creation and distribution of zone information between routers and nodes, both
of which compile their own Zone Information Tables (ZITs). To filter these services,
two different ACLs are required. NBP and network filtering (which conceptually
resembles IP source/destination filtering) are applied to an interface as an inbound
or outbound command. Both NBP object:type@zone
filtering and AppleTalk network address filtering are applied with the command. It is also possible for both types of filtering to be
performed on the same list.
Because zone information distribution filtering is accomplished through two
different operations, it also uses two different filter applications. The
is used to suppress zone information from being sent to
user workstations when ZIP requests are made. When the
is in place, only the zones permitted in the ACL will be sent in the ZIP response. To