DIGITAL GIGAswitch/Router User Reference Manual
245
Using ACLs
•
Only certain ACL rule parameters are relevant for each configuration command. For
example, the configuration command to create NAT address pools for dynamic
bindings (the
nat create dynamic
command) only looks at the source IP address in the
specified ACL rule. The destination IP address, ports, and TOS parameters, if specified,
are ignored.
Specific usage of Profile ACLs is described in more detail in the following sections.
Using Profile ACLs with the IP Policy Facility
The IP policy facility uses a Profile ACL to define criteria that determines which packets
should be forwarded according to an IP policy. Packets that meet the criteria defined in the
Profile ACL are forwarded according to the
ip-policy
command that references the Profile
ACL.
For example, you can define an IP policy that causes all telnet packets travelling from
source network 9.1.1.0/24 to destination network 15.1.1.0/24 to be forwarded to
destination address 10.10.10.10. You use a Profile ACL to define the selection criteria (in
this case, telnet packets travelling from source network 9.1.1.0/24 to destination network
15.1.1.0/24). Then you use an
ip-policy
command to specify what happens to packets that
match the selection criteria (in this example, forward them to address 10.10.10.10). The
following commands illustrate this example.
This command creates a Profile ACL called
prof1
that uses as its selection criteria all telnet
packets travelling from source network 9.1.1.0/24 to destination network 15.1.1.0/24:
This Profile ACL is then used in conjunction with the
ip-policy
command to cause packets
matching prof1’s selection criteria (that is, telnet packets travelling from 9.1.1.0/24 to
15.1.1.0/24) to be forwarded to 10.10.10.10:
See
Chapter 13, ”IP Policy-Based Forwarding Configuration Guide
,” for more information
on using the
ip-policy
command.
gs/r(config)#
acl prof1 permit ip 9.1.1.0/24 15.1.1.0/24 any any telnet
0
gs/r(config)#
ip-policy p5 permit profile prof1 next-hop-list
10.10.10.10
