Extreme Networks ExtremeWare XOS Guide - Page 265

ACLs
ExtremeWare XOS 11.3 Concepts Guide
265
example, DiffServ replacement is configured such that QP8 is mapped to code point 56. Matching
packets are sent to QP8, and the DSCP value in the packet is set to 56:
entry voice_entry {
if {
source-address 2.2.2.2/32;
} then {
qosprofile qp8;
replace-dscp;
}
}
See Chapter 15, “Quality of Service,” for more details about QoS profiles, and 802.1p and DSCP
replacement.
Syntax Details
Table 34 lists the match conditions that can be used with ACLs, and whether the condition can be used
for ingress ACLs only, or with both ingress and egress. The conditions are case-insensitive; for example,
the match condition listed in the table as
TCP-flags can also be written as tcp-flags. Within Table 34
are five different data types used in matching packets. Table 35 lists the data types and details on using
them.
Table 34: ACL match conditions
Match Conditions Description
Applicable
IP Protocols/
Direction
ethernet-type <number> Ethernet packet type. In place of the numeric value, you can
specify one of the following text synonyms (the field values are
also listed): ETHER-P-IP (0x0800), ETHER-P-8021Q (0x8100),
ETHER-P-IPV6 (0x86DD)
Ethernet/
Ingress only
ethernet-source-address
<mac-address>
Ethernet source MAC address Ethernet/
Ingress only
ethernet-destination-address
<mac-address>
Ethernet destination MAC address Ethernet/
Ingress only
source-address <prefix> IP source address and mask. Egress ACLs do not support IPv6
addresses, only IPv4 addresses. Use either all IPv4 or all IPv6
addresses in an ACL.
1
All IP/
Ingress and
Egress
destination-address <prefix> IP destination address and mask. Egress ACLs do not support
IPv6 addresses, only IPv4 addresses. Use either all IPv4 or all
IPv6 addresses in an ACL.
1
All IP/
Ingress and
Egress
protocol <number> IP protocol field. In place of the numeric value, you can specify
one of the following text synonyms (the field values are also
listed): egp(8), esp(5), gre(47), icmp(1), igmp(2), ipip(4),
ipv6(41), ospf(89), pim(102), rsvp(46), tcp(6), or udp(17)
All IP/
Ingress and
Egress
fragments BlackDiamond 10K only—IP fragmented packet. FO > 0 (FO =
Fragment Offset in IP header)
All IP, no L4
rules/Ingress
only
first-fragments Non-IP fragmented packet or first fragmented packet. FO==0. All IP/
Ingress only
Source-port {<number> |
<range>}
TCP or UDP source port. In place of the numeric value, you can
specify one of the text synonyms listed under destination port.
TCP, UDP/
Ingress and
Egress