Basic Policy Based ACL

[Mark_Lamond]

Hi there,
Can anyone explain to my why this basic ACL policy does not work?
This is using XOS 22.2.15 on an X450-G2.

I want to emulate Cisco behaviour of permitting what I want with an deny at the bottom.

# Permit
entry 1.1 { if { source-address 192.168.132.0/26; destination-address 192.168.249.202/32;} then { permit; count Permit;}}

# Deny Everything Else
entry 2.1 { if {} then { deny; count Deny;}}

The access list is applied to a VLAN as follows:

configure access-list Test vlan "Data" ingress

It seems to drop all packets, I thought policies were supposed to process top down with packets until they get a match?

Thanks,
Mark

[Mark_Lamond]

Thanks for the replies folks, now working as expected and making a lot more sense.

We use a lot of ACL's and are moving from Enterasys/Cisco to Extreme so a lot to learn.

Thanks,
Mark

[Erik_Auerswald]

Hi,

if you want to emulate an IPv4 router ACL, you should use a deny statement that denies IPv4 packets only:

entry 2.1 { if {source-address 0.0.0.0/0;} then { deny; count Deny;}}

Otherwise you will have problems with e.g. ARP as mentioned by Jarek.

Thanks,
Erik

[Jarek]

Hi,

the last ACL, will block all traffic including ARP, etc. on vlan ingress.
You should for example add before the last entry:

entry ARP { if match all { ethernet-type 0x0806 ;
} then {
permit ;
} }

and so on...

--
Jarek

[Nick_Yakimenko]

if match any

[Nick_Yakimenko]

more about 'match all' or 'match any'
https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-create-and-apply-an-ACL-in-EXOS