IPv4 Access Control Lists (ACLs)
Terminology
Terminology
Access Control Entry (ACE): A policy consisting of criteria and an action
(permit or deny) to execute on a packet if it meets the criteria. The
elements composing the criteria include:
• source IPv4 address and mask (standard and extended ACLs)
• destination IPv4 address and mask (extended ACLs only)
• either of the following:
– all IPv4 traffic
– IPv4 traffic of a specific IP protocol (extended ACLs only)
(In the cases of TCP, UDP, ICMP, and IGMP, the criteria can
include either all IP traffic of the protocol type or only the traffic
of a specific sub-type within the protocol.)
• option to log packet matches with deny ACEs
• optional use of IP precedence and ToS settings (extended ACLs only)
Access Control List (ACL): A list (or set) consisting of one or more
explicitly configured Access Control Entries (ACEs) and terminating with
an implicit “deny” ACE. ACL types include “standard” and “extended”. See
also “Standard ACL” and “Extended ACL”. To filter IPv4 traffic, apply
either type:
• Static Port ACL: an ACL assigned to filter inbound traffic on a specific
switch port
• Dynamic Port ACL: dynamic ACL assigned to a port by a RADIUS
server to filter inbound traffic from an authenticated client on that
port
An ACL can be configured on a port (or static trunk) as a static port ACL.
(Dynamic port ACLs are configured on a RADIUS server.)
ACE: See “Access Control Entry”.
ACL: See “Access Control List”.
ACL ID: A number or alphanumeric string used to identify an ACL. A standard
IPv4 ACL ID can have either an alphanumeric string or a number in the
range of 1 to 99. An extended IPv4 ACL ID can have either an alphanumeric
string or a number in the range of 100 to 199. See also “Identifier”.
Note: RADIUS-assigned ACLs are identified by client authentication data
and do not use the ACL ID strings described here.
9-10
To Next Page
Loading...
Need help?
General
