Summit WM3000 Series Controller System Reference Guide 321
Each session has a default idle time-out interval. If no packets are received within this interval, the
session is terminated and a new session must be initiated. These intervals are fixed and cannot be
configured by the user.
The default idle time-out intervals for different sessions are:
● ICMP and UDP sessions— 30 seconds
● TCP sessions— 2 hours
Port ACLs
The controller supports Port ACLs on physical interfaces and inbound traffic only. The following Port
ACLs are supported:
● Standard IP ACL— Uses a source IP address as matching criteria.
● Extended IP ACL— Uses a source IP address, destination IP address and IP protocol type as basic
matching criteria. It can also include other parameters specific to a protocol type, like the source and
destination ports for TCP/UDP protocols.
● MAC Extended ACL— Uses source and destination MAC addresses and VLAN ID. It optionally, also
uses Ethertype information.
Port ACLs are also stateful and are not applied on every packet controllered through the controller.
Whenever a packet is received inbound, it is examined against existing sessions to determine if it
belongs to an established session. ACLs are applied on the packet in the following manner:
1 If the packet matches an existing session, it is not matched against ACL rules and the session decides
where to send the packet.
2 If no existing sessions match the packet, it is matched against ACL rules to determine whether to
accept or reject it. If ACL rules accept the packet, a new session is created and all further packets
belonging to that session are allowed. If ACL rules reject the packet, no session is established.
A session is based on:
● Source IP address
● Destination IP address
● Source Port
● Destination Port
● ICMP identifier
● Incoming interface index
● IP Protocol
● Source MAC
● Destination MAC
● Ethertype
● VLAN-ID
● 802.1p bits
When a Port ACL is applied to a trunk port, the ACL filters traffic on all VLANs present on the
trunk port. With Port ACLs, you can filter:
To Next Page
Loading...