838 CHAPTER 62: ACL OVERVIEW
Whenever the step changes, the rules are renumbered. Continuing with the above
example, if you change the step from 5 to 2, the rules are renumbered 0, 2, 4, 6,
and so on.
Benefits of using the step
With the step and rule numbering/renumbering mechanism, you do not need to
assign rules numbers when defining them. The system will assign a newly defined
rule a number that is the smallest multiple of the step bigger than the currently
biggest number. For example, with a step of five, if the biggest number is currently
28, the newly defined rule will get a number of 30. If the ACL has no rule defined
already, the first defined rule will get a number of 0.
Another benefit of using the step is that it allows you to insert new rules between
existing ones as needed. For example, after creating four rules numbered 0, 5, 10,
and 15 in an ACL with a step of five, you can insert a rule numbered 1.
Effective Period of an
IPv4 ACL
You can control when a rule can take effect by referencing a time range in the
rule.
A referenced time range can be one that has not been created yet. The rule,
however, can take effect only after the time range is defined and comes active.
IP Fragments Filtering
with IPv4 ACL
Traditional packet filtering performs match operation on, rather than all IP
fragments, the first ones only. All subsequent non-first fragments are handled in
the way the first fragments are handled. This causes security risk as attackers may
fabricate non-first fragments to attack your network.
As for the configuration of a rule of an IPv4 ACL, the fragment keyword specifies
that the rule applies to non-first fragment packets only, and does not apply to
non-fragment packets or the first fragment packets. ACL rules that do not contain
this keyword is applicable to both non-fragment packets and fragment packets.
Introduction to IPv6
ACL
This section covers these topics:
■ “IPv6 ACL Classification” on page 838
■ “IPv6 ACL Naming” on page 839
■ “IPv6 ACL Match Order” on page 839
■ “IPv6 ACL Step” on page 840
■ “Effective Period of an IPv6 ACL” on page 840
IPv6 ACL Classification IPv6 ACLs, identified by ACL numbers, fall into three categories, as show in
Table 64.
Table 64 IPv6 ACL categories
Category ACL number Matching criteria
Basic IPv6 ACL 2000 to 2999 Source IPv6 address
Advanced IPv6 ACL 3000 to 3999 Source IPv6 address, destination IPv6 address, protocol
carried on IPv6, and other Layer 3 or Layer 4 protocol
header fields
To Next Page
Loading...
