Brocade BigIron RX Series Configuration Guide - Manual (Page 718)

640 BigIron RX Series Configuration Guide
53-1002484-04
ACL filtering for traffic switched within a virtual routing interface
22
The <acl-name> | <acl-num> parameter allows you to specify an ACL name or number. If using a
name, specify a string of up to 255 alphanumeric characters. You can use blanks in the ACL name,
if you enclose the name in quotation marks (for example, “ACL for Net1”). The <acl-num>
parameter allows you to specify an ACL number if you prefer. If you specify a number, enter a
number from 100 – 199 for extended ACLs. You must always specify a number (from 500 – 599)
for super ACLs
Enter the fragment parameter to allow the ACL to filter fragmented packets. Use the
non-fragmented parameter to filter non-fragmented packets.
NOTE
The fragmented and non-fragmented parameters cannot be used together in an ACL entry.
Complete the configuration by specifying options for the ACL entry. Options you can use are
discussed in the appropriate sections for configuring ACLs in this chapter.
ACL filtering for traffic switched within a virtual routing
interface
By default, a BigIron RX does not filter traffic that is switched from one port to another within the
same virtual routing interface, even if an ACL is applied to the interface. You can enable the device
to filter switched traffic within a virtual routing interface. When you enable the filtering, the device
uses the ACLs applied to inbound traffic to filter traffic received by a port from another port in the
same virtual routing interface. This feature does not apply to ACLs applied to outbound traffic.
To enable filtering of traffic switched within a virtual routing interface, enter the following command
at the configuration level for the interface.
BigIron RX(config-vif-1)# ip access-group ve-traffic in
Syntax: [no] ip access-group ve-traffic in
ICMP filtering for extended ACLs
Extended ACL policies can be created to filter traffic based on its ICMP message type. You can
either enter the description of the message type or enter its type and code IDs. All packets
matching the defined ICMP message type or type number and code number are processed in
hardware.
Numbered ACLs
For example, to deny the echo message type in a numbered, extended ACL, enter commands such
as the following when configuring a numbered ACL.
BigIron RX(config)# access-list 109 deny icmp any any echo
or
BigIron RX(config)# access-list 109 deny icmp any any 8 0
Syntax: [no] access-list <num> deny | permit icmp any any [log] <icmp-type> | <type-number>
<code-number>