Virus Throttling
Configuring and Applying Connection-Rate ACLs
Note Connection-Rate ACLs are a special case of the switch’s ACL feature. If you
need information on other applications of ACLs or more detailed information
on how ACLs operate, refer to the chapter titled “Access Control Lists (ACLs)”
in the Advanced Traffic Management Guide for your switch.
Connection-Rate ACL Operation
A connection-rate ACL applies to inbound traffic on all ports configured for
connection-rate filtering in the assigned VLAN, and creates an exception to
the connection-rate filter policy configured on each port. A connection-rate
ACL has no effect on ports in the VLAN that are not configured for connection-
rate filtering.
A connection-rate ACL accepts inbound, legitimate traffic from trusted
sources without filtering the traffic for the configured connection-rate policy.
You can configure an ACL to assign policy filtering (filter) for traffic from some
sources and no policy filtering (ignore) for traffic from other sources. How-
ever, the implicit filter invoked as the last entry in any connection-rate ACL
ensures that any traffic not specifically excluded from policy filtering (by the
ignore command) will be filtered by the configured policy for the port on which
that traffic entered the switch.
Inbound Routed Traffic from
Host “A” with Relatively High
Number of IP Connection-Rate
Attempts
Source Match
on any ACE in
the ACL?
Ignore
or
Filter
?
Apply Per-Port Connection-Rate
Policy to Host “A” Traffic:
–Notify-Only
– Throttle
–Block
Apply Implicit ACE
(filter)
Filter
Allow Traffic from Host
“A” without Filtering
Through Per-Port
Connection-Rate Policy
No
Yes
Ignore
Figure 3-8. Connection-Rate ACL Applied to Traffic Received Through a Given Port
3-21
To Next Page
Loading...
Need help?
General
