Source And Destination; Implicit Rules For Ip And Mac Acls; Additional Filtering Options - Cisco Nexus 9000 Series Configuration Manual
Nx-os security configuration guide, release 9.x
Hide thumbs
Also See for Nexus 9000 Series:
- Configuration manual (276 pages) ,
- Troubleshooting manual (126 pages) ,
- Quick start configuration manual (6 pages)
Table of Contents
Advertisement
Configuring IP ACLs
Source and Destination
In each rule, you specify the source and the destination of the traffic that matches the rule. You can specify
both the source and destination as a specific host, a network or group of hosts, or any host. How you specify
the source and destination depends on whether you are configuring IPv4 ACLs, IPv6 ACLs, or MAC ACLs.
Implicit Rules for IP and MAC ACLs
IP and MAC ACLs have implicit rules, which means that although these rules do not appear in the running
configuration, the device applies them to traffic when no other rules in an ACL match. When you configure
the device to maintain per-rule statistics for an ACL, the device does not maintain statistics for implicit rules.
All IPv4 ACLs include the following implicit rule:
deny ip any any
This implicit rule ensures that the device denies unmatched IP traffic.
All IPv6 ACLs include the following implicit rule:
deny ipv6 any any
This implicit rule ensures that the device denies unmatched IPv6 traffic.
Note
IPv6 nd-na, nd-ns, router-advertisement, and router-solicitation packets will not be permitted as the implicit
permit rules on IPv6 ACL. You must add the following rules explicitly to allow them:
• permit icmp any any nd-na
• permit icmp any any nd-ns
• permit icmp any any router-advertisement
• permit icmp any any router-solicitation
All MAC ACLs include the following implicit rule:
deny any any protocol
This implicit rule ensures that the device denies the unmatched traffic, regardless of the protocol specified in
the Layer 2 header of the traffic.
Additional Filtering Options
You can identify traffic by using additional options. These options differ by ACL type. The following list
includes most but not all additional filtering options:
• IPv4 ACLs support the following additional filtering options:
• Layer 4 protocol
• TCP and UDP ports
• ICMP types and codes
• IGMP types
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
Source and Destination
217
- Quick Links:
- Radius and Tacacs+ Security Protocols
Hide quick links:
Advertisement
Table of Contents
