SMC Networks SMC TigerAccess SMC7824M/FSW - Manual (Page 174)

A
CCESS
C
ONTROL
L
ISTS
8-2
The following filtering modes are supported:
• Standard IP ACL mode (STD-ACL) filters packets based on the source
IP address.
• Extended IP ACL mode (EXT-ACL) filters packets based on source or
destination IP address, as well as protocol type and protocol port
number. If the TCP protocol is specified, packets can also be filtered
based on the TCP control code.
• MAC ACL mode (MAC-ACL) filters packets based on the source or
destination MAC address and the Ethernet frame type (RFC 1060).
Command Usage
The following restrictions apply to ACLs:
• The switch supports ACLs for both ingress and egress filtering.
However, only one IP ACL and one MAC ACL can be bound to any
port for ingress filtering, and one IP ACL and one MAC ACL to any port
for egress filtering. In other words, only four ACLs can be bound to an
interface – Ingress IP ACL, Egress IP ACL, Ingress MAC ACL and
Egress MAC ACL.
• When an ACL is bound to an interface as an egress filter, all entries in
the ACL must be deny rules. Otherwise, the bind operation will fail.
• The maximum number of ACLs is:
Fast Ethernet ports - 157 rules, 4 masks shared by 8-port groups
Gigabit Ethernet ports - 29 rules, 4 masks
• Each ACL can have up to 32 rules. However, due to resource
restrictions, the average number of rules bound to the ports should not
exceed 20.
• You must configure a mask for an ACL rule before you can bind it to a
port or set the queue or frame priorities associated with the rule.
• The switch does not support the explicit “deny any any” rule for the
egress IP ACL or the egress MAC ACLs. If these rules are included in an
ACL, and you attempt to bind the ACL to an interface for egress
checking, the bind operation will fail.