Acl overview – Brocade Mobility RFS7000-GR Controller System Reference Guide (Supporting software release 4.1.0.0-040GR and later) User Manual
Page 336
322
Brocade Mobility RFS7000-GR Controller System Reference Guide
53-1001944-01
Configuring firewalls and access control lists
6
Use the Wireless Firewall screen to view, add and configure access control configurations.
Typically, an ACL consists of series of entries called an Access Control Entry (ACE). Each ACE
defines the rule which defines whether the packets needs to be switched/routed or needs to be
dropped. The ACL screen displays three tabs:
•
Security Policy
•
Configuration
•
Statistics
Each of these tabs has sub tabs which provide configuration options for creating and attaching the
ACLs.
NOTE
For an overview of how the switch uses an ACL to filter permissions to the switch managed network,
go to
ACL overview
An ACL contains an ordered list of Access Control Entries (ACEs). Each ACE specifies an action and
a set of conditions that a packet must satisfy in order to match the ACE. The order of conditions in
the list is critical because the switch stops testing conditions after the first match.
The switch supports the following ACLs to filter traffic:
•
Router ACLs — Applied to VLAN (Layer 3) interfaces. These ACLs filter traffic based on Layer 3
parameters like source IP, destination IP, protocol types and port numbers. They are applied
on packets routed through the switch. Router ACLs can be applied to inbound traffic only, not
both directions.
•
Port ACLs— Applied to traffic entering a Layer 2 interface. Only switched packets are subjected
to these kind of ACLs. Traffic filtering is based on Layer 2 parameters like–source MAC,
destination MAC, Ethertype, VLAN-ID, 802.1p bits (OR) Layer 3 parameters like– source IP,
destination IP, protocol, port number.
NOTE
Port and router ACLs can be applied only in an inbound direction. WLAN ACLs support applying ACLs
in the inbound and outbound direction.
•
Wireless LAN ACLs - A Wireless LAN ACL is designed to filter/mark packets based on the
wireless LAN from which they arrived rather than filtering the packets arrived on Layer 2 ports.
For more information, see
•
•
•
•
•