Allied Telesis X900-12XT/S - Manuals

Page 5 | AlliedWare Plus™ OS How To Note Creating hardware ACLs TCP and UDP packets You can filter TCP and UDP packets on the basis of: z source IP address and/or destination IP address (using the same syntax as when filtering IP packets) z source and/or destination TCP/UDP ports. The command syntax...

Page 6 | AlliedWare Plus™ OS How To Note The effects of the action keywords in ACLs Creating MAC address hardware ACLs MAC address hardware ACLs filter packets on the basis of their source or destination MAC address. The command syntax is: awplus(config)#access-list <4000-4699> < action >...

Page 7 | AlliedWare Plus™ OS How To Note Making filters by applying hardware ACLs to ports Making filters by applying hardware ACLs to ports You can create a filter by simply applying one or more ACLs to a port, as long as you can select the matching traffic through hardware ACL keywords, as describ...

Page 8 | AlliedWare Plus™ OS How To Note Making filters by using QoS class-maps Making filters by using QoS class-maps QoS class-maps allow you to match on a much wider range of packet attributes than ACLs by themselves. They do this by determining the match criteria from an ACL, or from match comma...

Page 9 | AlliedWare Plus™ OS How To Note Making filters by using QoS class-maps 3. Specify what the class-map will match on (see page 9 ). This involves: z attaching the ACL to the class-map z using other match commands to further limit what the traffic will match the class-map (unless the ACL’s set...

Page 10 | AlliedWare Plus™ OS How To Note Making filters by using QoS class-maps Matching on “inner” keywords for nested VLANs The match tpid , match inner-tpid , match inner-vlan , and match inner-cos commands all apply to nested VLAN configuration. In this situation, the packets arriving at the co...

Page 11 | AlliedWare Plus™ OS How To Note Making filters by using QoS class-maps Matching on TCP flag Unlike the other match commands, you can match on multiple TCP flags. The switch combines the specified flags by ANDing them together. To specify the multiple flags, either make multiple match tcp-f...

Page 12 | AlliedWare Plus™ OS How To Note Making filters by using QoS class-maps Matching on eth-format and protocol Ethernet format and protocol are specified together, as a pair. You can either specify the command as: match eth-format < keyword > protocol < keyword-or-number > or match...

Page 13 | AlliedWare Plus™ OS How To Note The logic of the operation of the hardware filters The logic of the operation of the hardware filters The operation of the filters follows the standard ACL logic: if a packet matches an ACL on the port, the comparison process stops and the action attached to...

Page 14 | AlliedWare Plus™ OS How To Note Examples Examples Blocking all multicast traffic This example uses an interface ACL with an action of deny. Consider a situation where multiple clients are attached to the switch, with each client attached to a different port. Each client has a specific serv...

Page 15 | AlliedWare Plus™ OS How To Note Examples Blocking all multicast traffic except one address This example uses two interface ACLs, one with an action of permit and one with an action of deny. Use this type of configuration when you want to discard a wide range of traffic but want to forward ...

Page 16 | AlliedWare Plus™ OS How To Note Examples Mirroring ARP packets This example uses a QoS class-map. Use this type of configuration when you want to mirror a subset of the incoming traffic on a port, and you need to use QoS match commands to select the mirrored traffic. Consider a situation w...

Page 17 | AlliedWare Plus™ OS How To Note Examples Blocking TCP sessions in one direction This example uses two QoS class-maps. Administrators often want to block the establishment of TCP sessions in one direction, but allow TCP sessions to be established in the opposite direction. To do this, it is...

Page 18 | AlliedWare Plus™ OS How To Note How many filters can you create? How many filters can you create? The total number of filters that can be created is not an exact number, but depends on which fields the various filters are matching on. So, to understand how to work out whether the set of fi...

Page 19 | AlliedWare Plus™ OS How To Note How many filters can you create? 2. The profile (mask) The other item is called the profile. Conceptually, this is a 16-byte mask that decides which set of bytes should be extracted from a packet as it enters the filtering process, to be compared against all...

Page 20 | AlliedWare Plus™ OS How To Note How many filters can you create? Are there enough bytes for your set of filters? Of course, the mask cannot increase without limit—it has a maximum size of 16 bytes. When it reaches the 16-byte limit, no more ACLs or QoS match commands can be created which w...

USA Headq u ar ters | 19800 Nor th Cr eek Parkwa y | S u ite 200 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895 E u r opea n Headq u ar ters | Via Motta 24 | 6830 Chiasso | Switzerla n d | T: +41 91 69769.00 | F: +41 91 69769.11 Asia-Paci f ic Headq u ar ters | 11 T ai Se ng Li...