ACL best practices (one file with multiple entry or many files with single entry)

[eyeV]

Hi everybody.
I want to add two access profiles to VLAN. For example

First
entry block-in-abonvlan {
if match any {
ethernet-type 0x8863;
ethernet-type 0x8864;
}
then {
permit;
}
}

entry deny (
if {
}
then {
deny;
}
}

Second
entry BCAST {
if {
ethernet-destination-address ff:ff:ff:ff:ff:ff;
}
then {
count broadcast;
}
}

entry ACTION {
if {
count broadcast > 10000;
period 10 ;
}
then {
syslog "It's probably a broadcast storm... Rule $ruleName $ruleValue exceeds limit $ruleThreshold" WARN 120;
}
}

What is the best way to do this?

• Two .pol files and two conf access-list command.
• Join this .pol files to one file.

[eyeV]

Thanks.

[Sumit_Tokle]

Please read the section "ACL Evaluation Precedence" under the ACL chapter in EXOS 15.4 concept guide, page # 701.

[eyeV]

If you have two policies it gets tricky to determine which policy to run first.

By the way, how can I determine this order?

[Paul_Russo]

Hey eyeV I agree with Sumit having one policy is always best because the order of the entries will determine how they are executed. If you have two policies it gets tricky to determine which policy to run first.

Hope that helps.
P