NetApp CN1610 - Page 142

134 Access control lists
◆
Logging—You can configure traps to be sent and an entry to be logged when
a packet arrives on a port that matches a deny rule. This attribute is
associated with the rule itself. No more than one trap/ACL rule entry will be
generated per minute. If more than one ACL event occurs within a time
period, then an internal counter is incremented. When the time period
expires, a trap/log entry is generated to indicate the event count.
◆ Mirroring—Packets can be mirrored to a port for monitoring purposes.
◆ Redirecting—Packets can be redirected to a different port than they were
originally destined.
Applying the
access list to an
interface and
specifying the
direction
After creating an ACL, you can assign it to one or more physical interfaces or
LAGs. In addition, ACLs can be bound to a VLAN. Binding an ACL to a VLAN
enables more efficient use of the hardware resources because multiple hardware
entries for each port can be replaced with a single hardware entry that covers all
ports on the VLAN.
Note
ACLs on the CN1610 switch apply only to inbound traffic.
Supported
parameters and
defaults
Access control lists can only be applied on ingress. Up to 100 access lists can be
defined in the system, with each list having up to 100 rules. A given access list
can be applied to any number of interfaces. However, the hardware resources are
limited and may not be able to fully support 100 completely populated ACLs.
The software is designed to allow the user the most flexibility when configuring
ACLs, within the limits of the hardware.
The added packet processing required by the ACL feature does not affect switch
performance. That is, ACL processing occurs at wirespeed.
Note
Access control lists that use IPv6 classification rules are not supported on the
CN1610 switch.
No ACLs are created by default.
CLI show
commands
You can use the following
show commands in Privileged EXEC mode to view
information about ACLs: