topic ACL best practices (one file with multiple entry or many files with single entry) in ExtremeSwitching (EXOS/Switch Engine)

ACL best practices (one file with multiple entry or many files with single entry)

eyeV — Wed, 21 May 2014 12:46:00 GMT

Hi everybody.
I want to add two access profiles to VLAN. For example

First
entry block-in-abonvlan {
if match any {
ethernet-type 0x8863;
ethernet-type 0x8864;
}
then {
permit;
}
}

entry deny (
if {
}
then {
deny;
}
}

Second
entry BCAST {
if {
ethernet-destination-address ff:ff:ff:ff:ff:ff;
}
then {
count broadcast;
}
}

entry ACTION {
if {
count broadcast > 10000;
period 10 ;
}
then {
syslog "It's probably a broadcast storm... Rule $ruleName $ruleValue exceeds limit $ruleThreshold" WARN 120;
}
}

What is the best way to do this?

Two .pol files and two conf access-list command.
Join this .pol files to one file.

RE: ACL best practices (one file with multiple entry or many files with single entry)

Sumit_Tokle — Wed, 21 May 2014 13:38:00 GMT

Create one single policy and add all three rule in it.

These matching condition will be kept in different hardware slices even though you would create single policy file or multiple files.

RE: ACL best practices (one file with multiple entry or many files with single entry)

eyeV — Wed, 21 May 2014 13:38:00 GMT

Thank you!

RE: ACL best practices (one file with multiple entry or many files with single entry)

Paul_Russo — Wed, 21 May 2014 19:21:00 GMT

Hey eyeV I agree with Sumit having one policy is always best because the order of the entries will determine how they are executed. If you have two policies it gets tricky to determine which policy to run first.

Hope that helps.
P

RE: ACL best practices (one file with multiple entry or many files with single entry)

eyeV — Wed, 21 May 2014 19:21:00 GMT

If you have two policies it gets tricky to determine which policy to run first.

By the way, how can I determine this order?

RE: ACL best practices (one file with multiple entry or many files with single entry)

Sumit_Tokle — Wed, 21 May 2014 19:21:00 GMT

Please read the section "ACL Evaluation Precedence" under the ACL chapter in EXOS 15.4 concept guide, page # 701.

RE: ACL best practices (one file with multiple entry or many files with single entry)

eyeV — Wed, 21 May 2014 19:21:00 GMT

Thanks.