DIGITAL GIGAswitch/Router User Reference Manual
247
Using ACLs
The following command creates a Profile ACL called
local
. The local profile specifies as its
selection criteria the range of IP addresses in network 10.1.1.0/24..
Note:
When a Profile ACL is defined for dynamic NAT, only the source IP address field
in the
acl
statement is evaluated. All other fields in the
acl
statement are ignored.
Once you have defined a Profile ACL, you can then use the
nat create dynamic
command
to bind the range of IP addresses defined in the local profile to a range in network
192.50.20.0/24.
See
Chapter 14, ”Network Address Translation Configuration Guide
,” for more
information on using dynamic NAT.
Using Profile ACLs with the Port Mirroring Facility
Port mirroring refers to the GSR’s ability to copy traffic on one or more ports to a “mirror”
port, where an external analyzer or probe can be attached. In addition to mirroring traffic
on one or more ports, the GSR can mirror traffic that matches selection criteria defined in a
Profile ACL.
For example, you can mirror all IGMP traffic on the GSR. You use a Profile ACL to define
the selection criteria (in this example, all IGMP traffic). Then you use a
port mirroring
command to copy packets that match the selection criteria to a specified mirror port. The
following commands illustrate this example.
This command creates a Profile ACL called
prof3
that uses as its selection criteria all IGMP
traffic on the GSR:
The following command causes packets matching Profile ACL prof3’s selection criteria
(that is, all IGMP traffic) to be copied to mirror port et.1.2.
See
“Configuring the GSR for Port Mirroring” on page 277
for more information on using
the
port mirroring
command.
gs/r(config)#
acl local permit ip 10.1.1.0/24
gs/r(config)#
nat create dynamic local-acl-pool local global-pool
192.50.20.10/24
gs/r(config)#
acl prof3 permit igmp
gs/r(config)#
port mirroring monitor-port et.1.2 target-profile prof3
