Riverstone Networks WICT1-12 - Manual (Page 541)

Riverstone Networks RS Switch Router User Guide Release 8.0 24-11
Access Control List Configuration Using ACLs
For example, you can define an IP policy that causes all telnet packets travelling from source network 9.1.1.0/24 to
destination network 15.1.1.0/24 to be forwarded to destination address 10.10.10.10. You use a Profile ACL to define
the selection criteria (in this case, telnet packets travelling from source network 9.1.1.0/24 to destination network
15.1.1.0/24). Then you use an
ip-policy
command to specify what happens to packets that match the selection
criteria (in this example, forward them to address 10.10.10.10). The following commands illustrate this example.
This command creates a Profile ACL called prof1 that uses as its selection criteria all telnet packets travelling from
source network 9.1.1.0/24 to destination network 15.1.1.0/24:
This Profile ACL is then used in conjunction with the
ip-policy
command to cause packets matching prof1’s
selection criteria (that is, telnet packets travelling from 9.1.1.0/24 to 15.1.1.0/24) to be forwarded to 10.10.10.10:
See Chapter 20, "IP Policy-Based Forwarding Configuration" for more information on using the
ip-policy
command.
Using Profile ACLs with the Traffic Rate Limiting Facility
Traffic rate limiting is a mechanism that allows you to control bandwidth usage of incoming traffic on a per-flow basis.
A flow meeting certain criteria can have its packets re-prioritized or dropped if its bandwidth usage exceeds a specified
limit.
For example, you can cause packets in flows from source address 1.2.2.2 to be dropped if their bandwidth usage
exceeds 10 Mbps. You use a Profile ACL to define the selection criteria (in this case, flows from source address
1.2.2.2). Then you use a
rate-limit
command to specify what happens to packets that match the selection criteria
(in this example, drop them if their bandwidth usage exceeds 10 Mbps). The following commands illustrate this
example.
This command creates a Profile ACL called prof2 that uses as its selection criteria all packets originating from source
address 1.2.2.2:
rs(config)# acl prof1 permit ip 9.1.1.0/24 15.1.1.0/24 any any telnet 0
rs(config)# ip-policy p5 permit profile prof1 next-hop-list 10.10.10.10
rs(config)# acl prof2 permit ip 1.2.2.2