Basic Policy Based ACL


Userlevel 1
Hi there,
Can anyone explain to my why this basic ACL policy does not work?
This is using XOS 22.2.15 on an X450-G2.

I want to emulate Cisco behaviour of permitting what I want with an deny at the bottom.

# Permit
entry 1.1 { if { source-address 192.168.132.0/26; destination-address 192.168.249.202/32;} then { permit; count Permit;}}

# Deny Everything Else
entry 2.1 { if {} then { deny; count Deny;}}

The access list is applied to a VLAN as follows:

configure access-list Test vlan "Data" ingress

It seems to drop all packets, I thought policies were supposed to process top down with packets until they get a match?

Thanks,
Mark

14 replies

Userlevel 4
if match any
Userlevel 4
Nick Yakimenko wrote:

if match any

more about 'match all' or 'match any'
https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-create-and-apply-an-ACL-in-EXOS
Userlevel 3
Hi,

the last ACL, will block all traffic including ARP, etc. on vlan ingress.
You should for example add before the last entry:

entry ARP { if match all { ethernet-type 0x0806 ;
} then {
permit ;
} }

and so on...

--
Jarek
Userlevel 7
Hi,

if you want to emulate an IPv4 router ACL, you should use a deny statement that denies IPv4 packets only:

entry 2.1 { if {source-address 0.0.0.0/0;} then { deny; count Deny;}}

Otherwise you will have problems with e.g. ARP as mentioned by Jarek.

Thanks,
Erik
Userlevel 1
Thanks for the replies folks, now working as expected and making a lot more sense.

We use a lot of ACL's and are moving from Enterasys/Cisco to Extreme so a lot to learn.

Thanks,
Mark
Userlevel 7
Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik
Userlevel 4
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

I'm trying to make a policy from this cisco line
ipv6 prefix-list ipv6_out seq 10 permit 2001:db8::/32 le 48
and it does not seem to work:

entry acl_prefix-list_1 { if {
} then {
permit ;
}
}
Userlevel 7
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

Hi Nick,

a prefix list is not an access control list... 😉 On EXOS, routing policies use .pol files just like ACLs, but they use different match statements and actions. They even have their own chapter in the documentation, Routing Policies.

Anyway, the EXOS equivalent to your IOS prefix list line is:
entry ipv6_out_05 { if { nlri 2001:db8::/49 } then { deny } } entry ipv6_out_10 { if { nlri 2001:db8::/32 } then { permit } }[/code]You can use the exact keyword after the subnet specification to require an exact match, instead of accepting all longer prefixes.

Thanks,
Erik
Userlevel 4
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

Thanks for reply
What about this one?

ipv6 prefix-list allv6 seq 10 permit ::/0 ge 20 le 48

the eqivalent to v4 we use is

ip prefix-list all seq 10 permit 0.0.0.0/0 ge 8 le 24
extreme-style is

entry bgp-min24-00 {
if match any {
nlri any/9 exact ;
nlri any/10 exact ;
nlri any/11 exact ;
nlri any/12 exact ;
nlri any/13 exact ;
nlri any/14 exact ;
nlri any/15 exact ;
nlri any/16 exact ;
nlri any/17 exact ;
nlri any/18 exact ;
nlri any/19 exact ;
nlri any/20 exact ;
nlri any/21 exact ;
nlri any/22 exact ;
nlri any/23 exact ;
nlri any/24 exact ;
}
then {
local-preference 130 ;
community add "65535:65535" ;
permit ;
}
}

entry bgp-min24-01 {
if match any {
nlri any/1 exact;
nlri any/2 exact;
nlri any/3 exact;
nlri any/4 exact;
nlri any/5 exact;
nlri any/6 exact;
nlri any/7 exact;
nlri any/8 exact;
nlri any/25 exact ;
nlri any/26 exact ;
nlri any/27 exact ;
nlri any/28 exact ;
nlri any/29 exact ;
nlri any/30 exact ;
nlri any/31 exact ;
nlri any/32 exact ;
}
then {
deny ;
}
}
Userlevel 7
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

Hi Nick,

first a disclaimer: I did not test that my routing policies above really work...

My understanding is that "nlri any/X" without "exact" matches on any network with a prefix length of X or longer. Thus you can compose the policy to first deny the too-long prefixes, then allow the accepted prefix length range, and then deny anything not yet matched.

Example:
entry all_ipv6_05 { if { nlri any/49 } then { deny } } entry all_ipv6_10 { if { nlri any/20 } then { permit } } entry ipv6_out_15 { if { nlri any/0 } then { permit } } [/code]That method should work for IPv4 as well.

Thanks,
Erik
Userlevel 4
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

That is a very good idea, but it does not work as expected
Line 3 : Failed argument value 49 is invalid
First of all, first argument should be
nlri any-ipv6/49
Secondly, I tried to filter-out a /48 announces from uplink, so I modified first argument to a /47
Did a policy-refresh
Tried to disable and then re-enable the bgp-session, but still I can see /48 announcements from an uplink.
Userlevel 7
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

Thanks for testing. Sorry that it did not work. 😞
Userlevel 4
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

thank you very much for the solution!
That was my typo:
I applied the policy like this
configure bgp neighbor 2001:db8::1 route-policy in allv6-in
and (again!) forgot about address-family ipv6-unicast
now it works as expected
Userlevel 7
Erik Auerswald wrote:

Hi Mark,

if you need to convert Cisco(-like) ACLs to EXOS you can try the IOS to EXOS ACL Convert Perl script. Simple IPv4 ACLs can be converted with E2X as well.

Thanks,
Erik

Great that it works!

Thanks,
Erik

Reply