Access Control List (ACL)

An Access Control List (ACL) is a list of permissions attached to an object, to filter or match switches packets. When the pattern is matched at the hardware lookup engine, a specified action (e.g. permit/deny) is applied. The rule fields represent flow characteristics such as source and destination addresses, protocol and VLAN ID.

ACL support currently allows actions of permit or deny rules, with or without mirroring, and supports only ingress direction. ACL search pattern can be taken from either L2 or L3 fields, e.g L2/L3 source and destination addresses, protocol, VLAN ID and priority or TCP port.

ACL is configured by the user and is applied to a port once the ACL search engine matches search criteria with a received packet.

To configure ACL:

1. Create a MAC / IPv4 ACL (access-list) entity. Run:

   Copy

   Copied!

               
   
               
   switch (config) mac access-list mac-acl
   switch (config mac access-list mac-acl) #
           

2. Add a MAC / IP rules to the appropriate access-list. Run:

   Copy

   Copied!

               
   
               
   switch (config mac access-list mac-acl) # seq-number 10 deny 0a:0a:0a:0a:0a:0a mask ff:ff:ff:ff:ff:ff any vlan 6 cos 2 protocol 80
           

3. Bind the created access-list to an interface (port or LAG). Run:

   Copy

   Copied!

               
   
               
   switch (config) # interface ethernet 1/1
   switch (config interface ethernet 1/1) # mac port access-group mac-acl
           

An ACL action is a set of actions can be activated in case the packet hits the ACL rule.

To modify the VLAN tag of the egress traffic as part of the ACL “permit” rule:

1. Create access-list action profile:

   1. Create an action access-list profile using the command “access-list action <action-profile-name>”.

   2. Add rule to map a VLAN using the command “vlan-map <vlan-id>” within the action profile configuration mode.

   3. Add action on a rule to strip the VLAN from a packet using the command “vlan-pop” within the action profile configuration mode.

   4. Add action on a rule to append a VLAN to a packet using the command “vlan-push” within the action profile configuration mode.

2. Create an access-list and bind the action rule:

   1. Create an access-list profile using the command “{ipv4/ipv4-udk/ipv6/mac/mac-udk} access-list”.

   2. Add access list rule using the command “deny/permit” (“action <action profile name>”).

3. Bind the access-list to an interface using the command “{ipv4/ipv4-udk/ipv6/mac/mac-udk} port access-group”.

   Copy

   Copied!

               
   
               
   Create an action profile and add vlan mapping action:
   switch (config)# access-list action my-action
   switch (config access-list action my-action)# vlan-map 20
   switch (config access-list action my-action)# exit
    
   Create an access list and bind rules:
   switch (config)# mac access-list my-list
   switch (config mac access-list my-list)# permit any any action my-action
   switch (config mac access-list my-list)# exit
    
   Bind an access-list to a port:
   switch (config)# interface ethernet 1/1
   switch (config interface ethernet 1/1)# mac access-list my-list
           

To mirror traffic to the monitor session as part of the ACL “permit” rule"

1. Create access-list action profile:

   1. Create an action access-list profile using the command “access-list action ”.

   2. Add a rule to mirror traffic to monitor session using the command “monitor session” within the action profile configuration mode.

2. Create an access-list and bind the action rule:

   1. Create an access-list profile using the command “{ipv4/ipv4-udk/ipv6/mac/mac-udk} access-list”.

   2. Add access list rule using the command “deny/permit” (“action ”).

3. Bind the access-list to an interface using the command “{ipv4/ipv4-udk/ipv6/mac/mac-udk} port access-group

   Copy

   Copied!

               
   
               
   Create an action profile and add monitor mapping action:
   switch (config)# access-list action my-action
   switch (config access-list action my-action)# monitor session 1
   switch (config access-list action my-action)# exit
    
   Create an access list and bind rules:
   switch (config)# mac access-list my-list
   switch (config mac access-list my-list)# permit any any vlan 10 action my-action
   switch (config mac access-list my-list)# exit
    
   Bind an access-list to a port:
   switch (config)# interface ethernet 1/1
   switch (config interface ethernet 1/1)# mac access-list my-list
   switch (config interface ethernet 1/1)# exit
           

A strong insight into the system is given by ACL logging. ACLs can log packets that pass through the switch, so the flows can later be analyzed.

A packet that hits an ACL with a log clause is passed to the logger. The logger writes the partial header of the packet (L2 or L3) to the syslog, with a timestamp and some additional information such as ingress interface and the VLAN to which the packet belongs.

To protect the system memory, a limited number of flows are collected for each time interval. If the number of flows for a specific time interval is exceeded, then no packets are logged for this time interval.

To further protect the system, a rate-limiter controls the number of packets passed to the CPU.

The following table summarizes the ACL capabilities supported by NVIDIA Onyx.

For more information about this feature and its potential applications, please refer to the following community post:

• HowTo Configure Filtering Rules on Ethernet Switches (ACLs, IP Filtering)

• ACL Commands