Home » Dell Manuals » Hubs & Switches » Dell N3200-ON » Manual Viewer

Dell N3200-ON Networking N-Series Switches User Guide version 6.8.0 - Page 683

ACLs and Policy Interaction, Likewise, if a VLAN interface ACL drops a packet

Get Dell N3200-ON PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 683 highlights

In the last column of the table (Optimized), a Yes entry means the rule is never processed in hardware because the action, if any, is to fall through to the next match criteria. The system optimizes out deny ACL match clauses and never processes them in the system hardware. Counters for these match clauses will always show 0. ACLs and Policy Interaction Within this paragraph, the word policy refers to both DiffServ Policy and Policy Based Routing. A more specific term may be use when the statement only applies to one of the policy types. PBR can be configured only on VLAN routing interfaces. However, ACLs can be configured on all types of interfaces, including physical interfaces, portchannels, and VLANs. DiffServ policies can be defined on Ethernet interfaces and port channels (with or without VLAN match criteria). When processing packets on which both policy and ACLs are configured, policy matching is performed only after the application of all VLAN and interface ACLs matches, including the implicit deny all match at the end of ACL processing. Only packets that match a user-defined ingress permit ACL rule configured on an incoming interface are eligible for processing by policy. This is due to the implicit deny all rule that takes effect at the end of ACL processing and prior to PBR and DiffServ Policy processing. Interface ACLs have a higher precedence than VLAN ACLs or PBR ACLs. In the case of conflicting actions, the interface ACL takes precedence. Specifically, if an interface ACL drops a packet (explicit or implicit deny), policy is not applied to the packet. Likewise, if a VLAN interface ACL drops a packet, policy is not applied to the packet. In many cases, the switch is capable of taking multiple actions on a packet, irrespective of whether the action is configured in a policy or in an ACL configured on a port. For example, the system can both rate limit packets on ingress with an interface ACL and set the ip precedence on packets that do not exceed the rate limit with a PBR ACL or DiffServ Policy. The following table describes the action resolution mechanism when a packet matches both the policy rules configured on a VLAN routing interface and a permit ACL rule configured on a physical interface (the deny ACL action is included for emphasis): Access Control Lists 683

Section	Page
Dell Networking N-Series Switches User's Configuration Guide	1
Contents	3
Introduction	53
About This Document	53
Audience	54
Document Conventions	54
Additional Documentation	55
Switch Feature Overview	57
System Management Features	58
Multiple Management Options	58
System Time Management	58
Log Messages	59
System Reset	59
Integrated DHCP Server	59
Management of Basic Network Information	60
IPv6 Management Features	60
Dual Software Images	60
File Management	61
Switch Database Management Templates	61
Automatic Installation of Firmware and Configuration	61
sFlow	62
SNMP Alarms and Trap Logs	62
CDP Interoperability Through ISDP	63
Remote Monitoring (RMON)	63
Stacking Features	63
Mixed and Single Series Stacking	63
Single IP Management	64
Primary Failover with Transparent Transition	64
Nonstop Forwarding on the Stack	64
Hot Add/Delete and Firmware Synchronization	64
Security Features	66
Configurable Access and Authentication Profiles	66
Password-Protected Management Access	66
Strong Password Enforcement	66
TACACS+ Client	66
RADIUS Support	67
SSH/SSL	67
Inbound Telnet Control	67
Denial of Service	67
Port Protection	68
Captive Portal	69
802.1X Authentication (IEEE 802.1X)	69
MAC-Based 802.1X Authentication	70
802.1X Monitor Mode	70
Port Security	71
Access Control Lists (ACLs)	71
Time-Based ACLs	71
IP Source Guard (IPSG)	72
DHCP Snooping	72
Dynamic ARP Inspection	72
Protected Ports (Private VLAN Edge)	72
Green Technology Features	73
Energy Detect Mode	73
Energy Efficient Ethernet	73
Power Utilization Reporting	73
Power over Ethernet (PoE) Features	74
PD Detection	74
Legacy (Reduced Capacitor) Detection	74
Classification	74
Port Start Up	75
Overload Detection and Port Shutdown	75
Disconnect Detection	75
IC Thermal Monitoring	75
Over-Temperature Protection	75
4-Pair Ports	76
IEEE 802.3bt Capability	77
PoE Port Capabilities and Power Limits	77
Key PoE Plus Features	79
Power Over Ethernet (PoE) Support	80
PoE Plus Support	80
PoE 60W Support	81
Powered Device Detection	81
PoE Power Management Modes	81
Power Management in Guard Band	83
PoE Plus Default Settings	85
Special Mode Setting for Legacy and Non-Compliant PDs	85
Switching Features	87
Flow Control Support (IEEE 802.3x)	87
Head of Line Blocking Prevention	87
Jumbo Frames Support	87
Auto-MDI/MDIX Support	87
VLAN-Aware MAC-based Switching	88
Back Pressure Support	88
Auto-negotiation	88
Storm Control	88
Port Mirroring	89
Static and Dynamic MAC Address Tables	89
Link Layer Discovery Protocol (LLDP)	89
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	90
Connectivity Fault Management (IEEE 802.1ag)	91
Cisco Protocol Filtering	91
DHCP Layer-2 Relay	91
Virtual Local Area Network Supported Features	92
VLAN Support	92
Port-Based VLANs	92
IP Subnet-based VLAN	92
MAC-based VLAN	92
IEEE 802.1v Protocol-Based VLANs	92
Voice VLAN	93
GARP and GVRP Support	93
Guest VLAN	93
Unauthorized VLAN	93
Double VLANs	93
Spanning Tree Protocol Features	94
Spanning Tree Protocol (STP)	94
Spanning Tree Port Settings	94
Rapid Spanning Tree	94
Multiple Spanning Tree	94
Bridge Protocol Data Unit (BPDU) Guard	95
BPDU Filtering	95
RSTP-PV and STP-PV	95
Link Aggregation Features	96
Link Aggregation	96
Link Aggregate Control Protocol (LACP)	97
Multi-Switch LAG (MLAG)	97
Routing Features	98
Address Resolution Protocol (ARP) Table Management	98
VLAN Routing	98
IP Configuration	98
Open Shortest Path First (OSPF)	99
Border Gateway Protocol (BGP)	99
Virtual Routing and Forwarding	99
BOOTP/DHCP Relay Agent	100
IP Helper and DHCP Relay	100
Routing Information Protocol	100
Router Discovery	100
Routing Table	100
Virtual Router Redundancy Protocol (VRRP)	101
Tunnel and Loopback Interfaces	101
IPv6 Routing Features	102
IPv6 Configuration	102
IPv6 Routes	102
OSPFv3	102
DHCPv6	102
Quality of Service (QoS) Features	103
Differentiated Services (DiffServ)	103
Class Of Service (CoS)	103
Auto Voice over IP (VoIP)	103
Internet Small Computer System Interface (iSCSI) Optimization	104
Layer-2 Multicast Features	104
MAC Multicast Support	104
IGMP Snooping	104
IGMP Snooping Querier	105
MLD Snooping	105
Multicast VLAN Registration	105
Layer-3 Multicast Features	106
Distance Vector Multicast Routing Protocol	106
Internet Group Management Protocol	106
IGMP Proxy	106
Protocol Independent Multicast—Dense Mode	106
Protocol Independent Multicast—Sparse Mode	107
Protocol Independent Multicast—Source Specific Multicast	107
Protocol Independent Multicast IPv6 Support	107
MLD/MLDv2 (RFC2710/RFC3810)	107
Hardware Overview	109
Dell Networking N1108EP-ON Series Switch Hardware	109
N1108EP-ON Series Front Panel	109
N1108EP-ON Series Power Supply	112
N1108EP-ON Series Ventilation System	112
N1108EP-ON Series Thermal Shutdown	112
N1108EP-ON Series LED Definitions	112
Power Consumption for N1108EP-ON Series PoE Switches	115
N1108EP-ON Series Wall Installation	116
Dell Networking N1500 Series Switch Hardware	118
N1500 Series Front Panel	118
N1500 Series Back Panel	121
N1500 Series LED Definitions	123
Power Consumption for N1500 Series PoE Switches	125
Dell Networking N2200-ON Series Switch Hardware	127
N2200-ON Series Front Panel	127
N2200-ON Series Rear Panel	127
N2200X-ON Series Switch Ports	128
N2200-ON Series Console Port	129
N2200-ON Series USB Port	130
N2200-ON Series Reset Button	130
N2200-ON Series Port and System LEDs	130
N2200-ON Series LED of Management Unit in Stack and Stack Number Display	130
N2200-ON Series Power Supplies	131
N2200-ON Series LED Definitions	132
Dell Networking N3200-ON Series Switch Hardware	136
N3200-ON Series Front Panel	136
N3200-ON Series Rear Panel	136
N3200-ON Series Switch Ports	137
N3200-ON Series Console Port	138
N3200-ON Series USB Port	139
N3200-ON Series Reset Button	139
N3200-ON Series Port and System LEDs	140
N3200-ON Series LED of Management Unit in Stack and Stack Number Display	140
N3200-ON Series Power Supplies	140
N3200-ON Series LED Definitions	141
Switch MAC Addresses	154
Cables and Optics	156
Using Dell OpenManage Switch Administrator	159
About Dell OpenManage Switch Administrator	159
Starting the Application	160
Understanding the Interface	161
Using the Switch Administrator Buttons and Links	163
Defining Fields	164
Understanding the Device View	164
Using the Device View Port Features	164
Using the Device View Switch Locator Feature	165
Using the Command-Line Interface	167
Accessing the Switch Through the CLI	167
Console Connection	167
Telnet Connection	168
Understanding Command Modes	169
Entering CLI Commands	171
Using the Question Mark to Get Help	171
Using Command Completion	172
Entering Abbreviated Commands	172
Negating Commands	172
Command Output Paging	172
Understanding Error Messages	173
Recalling Commands from the History Buffer	173
Default Settings	175
Setting the IP Address and Other Basic Network Information	179
IP Address and Network Information Overview	179
What Is the Basic Network Information?	179
Why Is Basic Network Information Needed?	180
How Is Basic Network Information Configured?	181
What Is Out-of-Band Management and In-Band Management?	181
Default Network Information	184
Configuring Basic Network Information (Web)	185
Out-of-Band Interface	185
IP Interface Configuration (Default VLAN IP Address)	186
Route Entry Configuration (Switch Default Gateway)	188
Domain Name Server	190
Default Domain Name	191
Host Name Mapping	192
Dynamic Host Name Mapping	193
Configuring Basic Network Information (CLI)	194
Enabling the DHCP Client on the OOB Port	194
Enabling the DHCP Client on the Default VLAN	194
Managing DHCP Leases	195
Configuring Static Network Information on the OOB Port	196
Configuring Static Network Information on the Default VLAN	197
Configuring and Viewing Additional Network Information	198
Basic Network Information Configuration Examples	200
Configuring Network Information Using the OOB Port	200
Configuring Network Information Using the Serial Interface	201
Stacking	205
Stacking Overview	205
Dell Networking Stacking Compatibility	208
How is the Management Unit in the Stack Selected?	209
Adding a Switch to the Stack	210
Removing a Switch from the Stack	211
How is the Firmware Updated on the Stack?	212
What is Stacking Standby?	212
What is Nonstop Forwarding?	213
Switch Stack MAC Addressing and Stack Design Considerations	216
NSF Network Design Considerations	217
Why is Stacking Needed?	217
Default Stacking Values	217
Managing and Monitoring the Stack (Web)	219
Unit Configuration	219
Stack Summary	220
Stack Firmware Synchronization	221
Supported Switches	222
Stack Port Summary	223
Stack Port Counters	224
Stack Port Diagnostics	224
NSF Summary	225
Checkpoint Statistics	226
Managing the Stack (CLI)	227
Configuring Stack Member, Stack Port, SFS and NSF Settings	227
Viewing and Clearing Stacking and NSF Information	229
Connecting to the Management Console from a Stack Member	230
Stacking and NSF Usage Scenarios	230
Basic Failover	230
Preconfiguring a Stack Member	232
NSF in the Data Center	234
NSF and VoIP	235
NSF and DHCP Snooping	236
NSF and the Storage Access Network	237
NSF and Routed Access	239
Authentication, Authorization, and Accounting	241
AAA Introduction	241
Methods	242
Method Lists	243
Access Lines	244
Enabling SSH Access	245
Access Lines (AAA)	246
Access Lines (Non-AAA)	246
Authentication	247
Authentication Access Types	247
Authentication Manager	248
Using RADIUS	257
Using TACACS+	262
Dynamic ACL Overview	264
Downloadable ACLs	271
Authentication Examples	272
Public Key SSH Authentication Example	281
Associating a User With an SSH Key	290
Multi-Factor Authentication	292
Authorization	293
Exec Authorization Capabilities	293
Authorization Examples	295
RADIUS Change of Authorization	297
TACACS Authorization	301
Accounting	305
RADIUS Accounting	305
IEEE 802.1X	308
What is IEEE 802.1X?	308
What are the 802.1X Port Authentication Modes?	309
What are Authentication Host Modes	310
What is MAC Authentication Bypass?	311
What is the Role of 802.1X in VLAN Assignment?	313
What is Monitor Mode?	317
How Does the Authentication Server Assign DiffServ Policy or ACLs?	319
What is the Internal Authentication Server?	319
Default 802.1X Values	320
Configuring IEEE 802.1X (Web)	321
Captive Portal	345
Captive Portal Overview	345
Default Captive Portal Behavior and Settings	353
Configuring Captive Portal (Web)	355
Configuring Captive Portal (CLI)	371
Captive Portal Configuration Example	377
In Case Of Problems in Captive Portal Deployment	381
Network Access Control	382
Pre-enrollment State	382
Walled Garden	382
Media Access Control Security	384
Monitoring and Logging System Information	385
System Monitoring Overview	385
What System Information Is Monitored?	385
Why Is System Information Needed?	386
Where Are Log Messages Sent?	386
What Are the Severity Levels?	387
What Are the System Startup and Operation Logs?	387
What Is the Log Message Format?	388
What Factors Should Be Considered When Configuring Logging?	390
Default Log Settings	391
Monitoring System Information and Configuring Logging (Web)	392
Device Information	392
System Health	394
System Resources	395
Unit Power Usage History	396
Integrated Cable Test for Copper Cables	397
Optical Transceiver Diagnostics	398
Log Global Settings	399
RAM Log	400
Log File	402
SYSLOG Server	402
Email Alert Global Configuration	405
Email Alert Mail Server Configuration	405
Email Alert Subject Configuration	407
Email Alert To Address Configuration	408
Email Alert Statistics	408
Monitoring System Information and Configuring Logging (CLI)	410
Viewing System Information and Enabling the Locator LED	410
Running Cable Diagnostics	410
Configuring Local Logging	412
Configuring Remote Logging	413
Configuring Mail Server Settings	414
Configuring Email Alerts for Log Messages	415
Logging Configuration Examples	417
Configuring Local and Remote Logging	417
Configuring Email Alerting	420
Managing General System Settings	423
System Settings Overview	423
Why Does System Information Need to Be Configured?	424
What Are SDM Templates?	425
Why is the System Time Needed?	427
How Does SNTP Work?	427
Default General System Information	428
Configuring General System Settings (Web)	429
System Information	429
CLI Banner	432
SDM Template Preference	433
Clock	434
SNTP Global Settings	435
SNTP Authentication	436
SNTP Server	438
Summer Time Configuration	441
Time Zone Configuration	442
Card Configuration	443
Slot Summary	444
Supported Cards	445
Power Over Ethernet Global Configuration	446
Power Over Ethernet Unit Configuration	447
Power Over Ethernet Interface Configuration	448
Configuring System Settings (CLI)	450
Configuring System Information	450
Configuring the Banner	451
Managing the SDM Template	452
Configuring SNTP Authentication and an SNTP Server	452
Setting the System Time and Date Manually	454
Viewing Slot Information	455
Configuring PoE Settings	455
General System Settings Configuration Examples	458
Configuring System and Banner Information	458
Configuring SNTP/NTP	461
Configuring the Time Manually	463
SNMP	465
SNMP Overview	465
What Is SNMP?	465
What Are SNMP Traps?	466
Why Is SNMP Needed?	467
Default SNMP Values	467
Configuring SNMP (Web)	469
SNMP Global Parameters	469
SNMP View Settings	470
Access Control Group	472
SNMPv3 User Security Model (USM)	474
Communities	477
Notification Filter	479
Notification Recipients	480
Trap Flags	482
OSPFv2 Trap Flags	483
OSPFv3 Trap Flags	484
Trap Log	485
Configuring SNMP (CLI)	487
Configuring the SNMPv3 Engine ID	487
Configuring SNMP Views, Groups, and Users	488
Configuring Communities	491
Configuring SNMP Notifications (Traps and Informs)	493
SNMP Configuration Examples	496
Configuring SNMPv1 and SNMPv2	496
Configuring SNMP Management Station Access	497
Configuring SNMPv3	498
Images and File Management	503
Image and File Management Overview	503
What Files Can Be Managed?	503
Why Is File Management Needed?	505
What Methods Are Supported for File Management?	508
What Factors Should Be Considered When Managing Files?	508
How Is the Running Configuration Saved?	511
Managing Images and Files (Web)	512
File System	512
Active Images	513
USB Flash Drive	514
File Download	515
File Upload	517
Copy Files	519
Managing Images and Files (CLI)	520
Downloading and Activating a New Image (TFTP)	521
Managing Files in Internal Flash	522
Managing Files on a USB Flash Device	523
Uploading a Configuration File (SCP)	524
Managing Configuration Scripts (SFTP)	525
SCP Server	526
File and Image Management Configuration Examples	527
Upgrading the Firmware	527
Managing Configuration Scripts	530
Managing Files by Using the USB Flash Drive	532
DHCP and USB Auto-Configuration	535
Auto Configuration Overview	535
What Is USB Auto Configuration?	536
What Files Does USB Auto Configuration Use?	536
How Does USB Auto Configuration Use the Files on the USB Device?	537
What Is the Setup File Format?	539
What Is the DHCP Auto Configuration Process?	539
Monitoring and Completing the DHCP Auto Configuration Process	546
What Are the Dependencies for DHCP Auto Configuration?	547
Default Auto Configuration Values	548
Managing Auto Configuration (Web)	549
Auto-Install Configuration	549
Managing Auto Configuration (CLI)	550
Managing Auto Configuration	550
Auto Configuration Example	551
Enabling USB Auto Configuration and Auto Image Download	551
Enabling DHCP Auto Configuration and Auto Image Download	552
Easy Firmware Upgrade/Downgrade via USB	554
Monitoring Switch Traffic	555
Traffic Monitoring Overview	555
What is sFlow Technology?	555
What is RMON?	558
What is Port Mirroring?	559
Port Mirroring Behaviors	561
RSPAN	563
Remote Capture	564
Why is Traffic Monitoring Needed?	565
Default Traffic Monitoring Values	565
Monitoring Switch Traffic (Web)	566
sFlow Agent Summary	566
sFlow Receiver Configuration	567
sFlow Sampler Configuration	568
sFlow Poll Configuration	569
Interface Statistics	570
Etherlike Statistics	571
GVRP Statistics	572
EAP Statistics	573
Utilization Summary	574
Counter Summary	575
Switchport Statistics	576
RMON Statistics	577
RMON History Control Statistics	577
RMON History Table	580
RMON Event Control	581
RMON Event Log	583
RMON Alarms	584
Port Statistics	586
LAG Statistics	587
Port Mirroring	588
Monitoring Switch Traffic (CLI)	590
Configuring sFlow	590
Configuring RMON	592
Viewing Statistics	594
Configuring Port Mirroring	595

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405
1,406
1,407
1,408
1,409
1,410
1,411
1,412
1,413
1,414
1,415
1,416
1,417
1,418
1,419
1,420
1,421
1,422
1,423
1,424
1,425
1,426
1,427
1,428
1,429
1,430
1,431
1,432
1,433
1,434
1,435
1,436
1,437
1,438
1,439
1,440
1,441
1,442
1,443
1,444
1,445
1,446
1,447
1,448
1,449
1,450
1,451
1,452
1,453
1,454
1,455
1,456
1,457
1,458
1,459
1,460
1,461
1,462
1,463
1,464
1,465
1,466
1,467
1,468
1,469
1,470
1,471
1,472
1,473
1,474
1,475
1,476
1,477
1,478
1,479
1,480
1,481
1,482
1,483
1,484
1,485
1,486
1,487
1,488
1,489
1,490
1,491
1,492
1,493
1,494
1,495
1,496
1,497
1,498
1,499
1,500
1,501
1,502
1,503
1,504
1,505
1,506
1,507
1,508
1,509
1,510
1,511
1,512
1,513
1,514
1,515
1,516
1,517
1,518
1,519
1,520
1,521
1,522
1,523
1,524
1,525
1,526
1,527
1,528
1,529
1,530
1,531
1,532
1,533
1,534
1,535
1,536
1,537
1,538
1,539
1,540
1,541
1,542
1,543
1,544
1,545
1,546
1,547
1,548
1,549
1,550
1,551
1,552
1,553
1,554
1,555
1,556
1,557
1,558
1,559
1,560
1,561
1,562
1,563
1,564
1,565
1,566
1,567
1,568
1,569
1,570
1,571
1,572
1,573
1,574
1,575
1,576
1,577
1,578
1,579
1,580
1,581
1,582
1,583
1,584
1,585
1,586
1,587
1,588
1,589
1,590
1,591
1,592
1,593
1,594
1,595
1,596
1,597
1,598
1,599
1,600
1,601
1,602
1,603
1,604
1,605
1,606
1,607
1,608
1,609
1,610
1,611
1,612
1,613
1,614
1,615
1,616
1,617
1,618
1,619
1,620
1,621
1,622
1,623
1,624
1,625
1,626
1,627
1,628
1,629
1,630
1,631
1,632
1,633
1,634
1,635
1,636
1,637
1,638
1,639
1,640
1,641
1,642
1,643
1,644
1,645
1,646
1,647
1,648
1,649
1,650
1,651
1,652
1,653
1,654
1,655
1,656
1,657
1,658
1,659
1,660
1,661
1,662
1,663
1,664
1,665
1,666
1,667
1,668
1,669
1,670
1,671
1,672
1,673
1,674
1,675
1,676
1,677
1,678
1,679
1,680
1,681
1,682
1,683
1,684
1,685
1,686
1,687
1,688
1,689
1,690
1,691
1,692
1,693
1,694
1,695
1,696
1,697
1,698
1,699
1,700
1,701
1,702
1,703
1,704
1,705
1,706
1,707
1,708
1,709
1,710
1,711
1,712
1,713
1,714
1,715
1,716
1,717
1,718
1,719
1,720
1,721
1,722
1,723
1,724
1,725
1,726
1,727
1,728
1,729
1,730
1,731
1,732
1,733
1,734
1,735
1,736
1,737
1,738
1,739
1,740
1,741
1,742

Match case Limit results 1 per page

Access Control Lists

683

In the last column of the table (Optimized), a Yes entry means the rule is

never processed in hardware because the action, if any, is to fall through to the

next match criteria. The system optimizes out deny ACL match clauses and

never processes them in the system hardware. Counters for these match

clauses will always show 0.

ACLs and Policy Interaction

Within this paragraph, the word policy refers to both DiffServ Policy and

Policy Based Routing. A more specific term may be use when the statement

only applies to one of the policy types.

PBR can be configured only on VLAN routing interfaces. However, ACLs can

be configured on all types of interfaces, including physical interfaces, port-

channels, and VLANs. DiffServ policies can be defined on Ethernet interfaces

and port channels (with or without VLAN match criteria). When processing

packets on which both policy and ACLs are configured, policy matching is

performed only after the application of all VLAN and interface ACLs

matches, including the implicit deny all match at the end of ACL processing.

Only packets that match a user-defined ingress permit ACL rule configured

on an incoming interface are eligible for processing by policy. This is due to

the implicit deny all rule that takes effect at the end of ACL processing and

prior to PBR and DiffServ Policy processing. Interface ACLs have a higher

precedence than VLAN ACLs or PBR ACLs. In the case of conflicting actions,

the interface ACL takes precedence. Specifically, if an interface ACL drops a

packet (explicit or implicit deny), policy is not applied to the packet.

Likewise, if a VLAN interface ACL drops a packet, policy is not applied to the

packet.

In many cases, the switch is capable of taking multiple actions on a packet,

irrespective of whether the action is configured in a policy or in an ACL

configured on a port. For example, the system can both rate limit packets on

ingress with an interface ACL and set the ip precedence on packets that do

not exceed the rate limit with a PBR ACL or DiffServ Policy.

The following table describes the action resolution mechanism when a packet

matches both the policy rules configured on a VLAN routing interface and a

permit ACL rule configured on a physical interface (the deny ACL action is

included for emphasis):