topic RE: ACL - redirect-port issue in ExtremeSwitching (EXOS/Switch Engine)

ACL - redirect-port issue

EtherNation_Use — Wed, 08 Jan 2014 05:53:00 GMT

Create Date: Jun 19 2012 5:41AM

Dear all,

I have the following ACL (acl1.pol) applied into port 25:

configure access-list acl1 ports 25 ingress

acl1.pol info:

entry 1 {

if {

source-address 10.80.17.182/32;

}

then {

redirect-port 2

}

}

entry 2 {

if {

destination-address 10.80.17.182/32;

}

then {

redirect-port 2

}

}

It works fine when both source and destination ports (25 and 2) are on the same vlan.

This is a Lab that I'm trying to reproduce, on which I'll need that the port 25 remains on a different vlan.

When I just change it's vlan, I stopped receiving the traffic on redirected-port (#2).

Any ideas on what can be done?

Regards,

Leandro

(from Leandro_Brito)

RE: ACL - redirect-port issue

EtherNation_Use — Wed, 08 Jan 2014 05:53:00 GMT

Create Date: Jun 19 2012 6:27AM

Hey Leandro

The ACL you have below is for L2 which means that the ports will need to be on the same VLAN just like any other L2 traffic i.e broadcast.

If you want to go across VLANs than you need to route the traffic with L3. The concepts guide has an example but essentially instead of the physical port you would add the next hop IP.

Hope that helps.

P (from Paul_Russo)

RE: ACL - redirect-port issue

EtherNation_Use — Wed, 08 Jan 2014 05:53:00 GMT

Create Date: Jun 19 2012 7:29PM

Thank you P,

I thought that the redirect-port would replace all the L2/L3 forwarding decisions.

The next-hop IP is also an option.

Regards,

Leandro

Sorry about the "Report Post".....I misunderstood!

(from Leandro_Brito)

RE: ACL - redirect-port issue

EtherNation_Use — Wed, 08 Jan 2014 05:53:00 GMT

Create Date: Jun 20 2012 7:45AM

Hey Leandro

Redirect does bypass L2/L3 but only within the limits of L2/L3 for example using L2 you can redirect traffic to another port on that VLAN for L3 you can bypass the normal L3 route table and send traffic to another next hop.

What you can't do is go between L2 VLANs by just bridging. Normal L2 switching still applies.

Does that help?

P (from Paul_Russo)

RE: ACL - redirect-port issue

EtherNation_Use — Wed, 08 Jan 2014 05:53:00 GMT

Create Date: Jun 20 2012 7:48AM

Hey Leandro

Redirect does bypass L2/L3 but only within the limits of L2/L3 for example using L2 you can redirect traffic to another port on that VLAN for L3 you can bypass the normal L3 route table and send traffic to another next hop.

What you can't do is go between L2 VLANs by just bridging. Normal L2 switching still applies.

Does that help?

P (from Paul_Russo)

RE: ACL - redirect-port issue

EtherNation_Use — Wed, 08 Jan 2014 05:53:00 GMT

Create Date: Jun 21 2012 12:12PM

The next-hop option will be great for me!

Thank you!

(from Leandro_Brito)