Chapter 17: Access Control List Configuration Guide
242
DIGITAL GIGAswitch/Router User Reference Manual
Maintaining ACLs Using the ACL Editor
In addition to the traditional method of maintaining ACLs using TFTP or RCP, the GSR
provides a simpler and more user-friendly mechanism to maintain ACLs: the ACL Editor.
The ACL Editor can only be accessed within Configure mode using the
acl-edit
command. You edit an ACL by specifying its name together with the
acl-edit
command.
For example, to edit ACL 101, you issue the command
acl-edit 101
. The only restriction is
that when you edit a particular ACL, you cannot add rules for a different ACL. You can
only add new rules for the ACL that you are currently editing. When the editing session is
over, that is, when you are done making changes to the ACL, you can save the changes
and make them take effect immediately. Within the ACL editor, you can add new rules
(
add
command), delete existing rules (
delete
command) and re-order the rules (
move
command). To save the changes, use the
save
command or simply exit the ACL Editor.
If you edit and save changes to an ACL that is currently being used or applied to an
interface, the changes will take effect immediately. There is no need to remove the ACL
from the interface before making changes and reapply it after changes are made. The
process is automatic.
Using ACLs
It is important to understand that an ACL is simply a definition of packet characteristics
specified in a set of rules. An ACL must be
enabled
in one of the following ways:
•
Applying an ACL to an interface, which permits or denies traffic to or from the GSR.
ACLs used in this way are known as
Interface ACLs
.
•
Applying an ACL to a service, which permits or denies access to system services
provided by the GSR. ACLs used in this way are known as
Service ACLs
.
•
Associating an ACL with
ip-policy
,
nat
,
port mirroring
,
rate-limit
, or
web-cache
commands, which specifies the criteria that packets, addresses, or flows must meet in
order to be relevant to these GSR features. ACLs used in this way are known as
Profile
ACLs
.
These uses of ACLs are described in the following sections.
Applying ACLs to Interfaces
An ACL can be applied to an interface to examine either inbound or outbound traffic.
Inbound traffic is traffic coming into the GSR. Outbound traffic is traffic going out of the
GSR. For each interface, only one ACL can be applied for the same protocol in the same
direction. For example, you cannot apply two or more IP ACLs to the same interface in the
inbound direction. You can apply two ACLs to the same interface if one is for inbound
traffic and one is for outbound traffic, but not in the same direction. However, this
