Riverstone Networks WICT1-12 - Manual (Page 533)

Riverstone Networks RS Switch Router User Guide Release 8.0 24-3
Access Control List Configuration ACL Basics
Each field in an ACL rule is position sensitive. For example, for a rule for TCP traffic, the source address must be
followed by the destination address, followed by the source socket and the destination socket, and so on.
Not all fields of an ACL rule need to be specified. If a particular field is not specified, it is treated as a wildcard or
“don't care” condition. However, if a field is specified, that particular field will be matched against the packet. Each
protocol can have a number of different fields to match. For example, a rule for TCP can use socket port numbers,
while a rule for IPX can use a network node address.
Since each field is position sensitive, it may be necessary to “skip” some fields in order to specify a value for another
field. To skip a field, use the keyword
any
. For example, the following ACL rule denies SMTP traffic between any
two hosts:
Note that in the above example, the <tos> (Type of Service) field is not specified and is treated as a wildcard. The
any
keyword is needed only to skip a wildcard field in order to explicitly specify another field that is further down in the
rule. If there are no other fields to specify, the
any
keyword is not necessary. For example, the following ACL permits
all IP traffic to go through:
24.1.2 How ACL Rules are Evaluated
For an ACL with multiple rules, the ordering of the rules is important. When the RS checks a packet against an ACL,
it goes through each rule in the ACL sequentially. If a packet matches a rule, it is forwarded or dropped based on the
permit
or
deny
keyword in the rule. All subsequent rules are ignored. That is, a first-match algorithm is used. There
is no hidden or implied ordering of ACL rules, nor is there precedence attached to each field. The RS simply goes down
the list, one rule at a time, until there is a match. Consequently, rules that are more specific (that is, with more selection
criteria) should always be listed ahead of rules that are less specific. For example, the following ACL permits all TCP
traffic except those from subnet 10.2.0.0/16:
When a TCP packet comes from subnet 10.2.0.0/16, it finds a match with the first rule. This causes the packet to be
dropped. A TCP packet coming from other subnets does not match the first rule. Instead, it matches the second rule,
which allows the packet to go through.
acl nosmtp deny tcp any any smtp smtp
acl yesip permit ip
acl 101 deny tcp 10.2.0.0/16 any any any
acl 101 permit tcp any any any any