Allied Telesis AT X900-12XT/S manual

C613-16119-00 REV A www .alliedtelesis.com AlliedW ar e Plus TM OS How T o | Intr oduction The SwitchBlade x908 , x900-12XT/S, and x90 0-24 series switches supp or t a pow erful hardwar e based packet-filtering facility . These switches can filter on a range of La yer 2, La yer 3, and La y er 4 pac k et attributes, and perform a variety of differ e[...]

Page 2 | AlliedW are Plus™ OS How T o Note Introduction Contents Introduction .................................................................................................. ................ ............................ 1 Which products and softwar e v ersion does this Note apply to? ......................................... 2 Creating har dwa[...]

Page 3 | AlliedW are Plus™ OS How T o Note Creating hardwar e A CLs Cr eating hardwar e A CLs Hardwar e A CLs contain both the match criteria and the action to take on matching traffic. There ar e two types of har dware A CL: IP ad dress and MA C address. These are index ed by their ID number . IP hardwar e A CLs hav e a number in the range 3000 [...]

Page 4 | AlliedW are Plus™ OS How T o Note Creating hardwar e A CLs IP pack ets Y ou can filter IP packets on the basis of thei r source and/or destination IP addr esses. The command syntax is: awplus(config)#access-list <300 0-3699> < action > ip < source-ip-address > < destination-ip-address > The sour ce and destination[...]

Page 5 | AlliedW are Plus™ OS How T o Note Creating hardwar e A CLs TCP and UDP packets Y ou can filter TCP and UDP packets on the basis of: z sour ce IP address and/or destination IP ad dress (using the same syntax as when filtering IP pack ets) z sour ce and/or destination TCP/UDP por ts. The command syntax is: awplus(config)#access-list <30[...]

Page 6 | AlliedW are Plus™ OS How T o Note The effects of the action k eyw ords in A CLs Cr eating MA C addr ess hardwar e A CLs MA C address hardwar e A CLs filter pack ets on the basis of their source or destination MA C addr ess. The command syntax is: awplus(config)#access-list <4000-4 699> < action > < source-mac-address > [...]

Page 7 | AlliedW are Plus™ OS How T o Note Making fi lters by a pplying har dware A CLs to ports Making filters by a pplying har dware A CLs to por ts Y ou can create a filter by simply a pplying one or more ACLs to a port, as long as y ou can select the matching traffic thr ough hard ware A CL ke ywords, as described abo ve. A C Ls can be applie[...]

Page 8 | AlliedW are Plus™ OS How T o Note Making filt ers by using QoS class-maps Making filters by using QoS class-ma ps QoS class-maps allow y ou to match on a m uch wi der range of pack et attributes than A CLs by themselves. The y do this by determining the match criteria fr om an A CL, or from match commands, or from both in combination. Al[...]

Page 9 | AlliedW are Plus™ OS How T o Note Making filt ers by using QoS class-maps 3. Specify what the class-map will match on (see page 9 ). This inv olves: z attaching the A C L to the class-map z using other match commands to further limi t what the traffic will match the class-map (unless the A CL ’ s se ttings wer e enough) 4. Attach the c[...]

Page 10 | AlliedW are Plus™ OS How T o Note Making filt ers by using QoS class-maps Matching on “inner” k eyw ords f or nested VLANs The match tpid , matc h inner -tpid , match inner -vlan , and match inner -cos commands all apply to nested VLAN configuration. In this situation, the pack ets arriving at the core-facing port can ha ve tw o VLA[...]

Page 11 | AlliedW are Plus™ OS How T o Note Making filt ers by using QoS class-maps Matching on TCP flag Unlik e the other match commands, you can match on multiple TCP flags. The switch combines the specified flags by ANDing them together . T o specify the multiple flags, either mak e multiple match tcp-fla gs commands or specify the flags in on[...]

Page 12 | AlliedW are Plus™ OS How T o Note Making filt ers by using QoS class-maps Matching on eth-format and pr otocol Ethernet format and pr otocol are specified to gether , as a pair . Y ou can either specify the command as: match eth-format < keyword > protocol < keyword-or-number > or match protocol < keyword-or-number > e[...]

Page 13 | AlliedW are Plus™ OS How T o Note The logic of the operation of the har dware filters The logic of the operation of the hardwar e filters The operation of the filters follows the standar d ACL logic: if a pack et matches an A CL on the port, the comparison process stops and the action attached to the A CL is performed. The switch checks[...]

Page 14 | AlliedW are Plus™ OS How T o Note Examples Examples Blocking all multicast traffic This example uses an interface A CL with an action of deny . Consider a situation where m ultiple clients ar e attached to the switch, with each client attached to a differ ent por t. Each client has a sp ecific ser vice , which includes a set of allowed [...]

Page 15 | AlliedW are Plus™ OS How T o Note Examples Blocking all multicast tr affic except one ad dress This example uses two interface A CLs, one with an action of permit and one with an action of deny . Use this type of configuration when y ou want to discard a wide range of traffic but want to forward a subset of traffic within that range. Co[...]

Page 16 | AlliedW are Plus™ OS How T o Note Examples Mirr oring ARP pack ets This example uses a QoS class-map . Use this type of configuration when you want to mir ror a subset of the incoming traffic on a port, a nd y ou need to use QoS match comm ands to select the mirr ored traffic. Consider a situation wh ere y ou want to captur e ARP packet[...]

Page 17 | AlliedW are Plus™ OS How T o Note Examples Blocking TCP sessions in one dir ection This example uses two QoS class-maps. Administrators often want to block the establis hment of TCP sessions in one direction, but allow TCP sessions to be established in the opposi te dir ection. T o do this, it is necessar y to block the ver y first pack[...]

Page 18 | AlliedW are Plus™ OS How T o Note Ho w many filters can you cr eate? How man y filters can you cr eate? The total number of filters that can be cr eate d is not an exact number , but depends on w hich fields the various filters are matching on. So , to understand how to w ork out whether the set of filters you ar e creating might run ou[...]

Page 19 | AlliedW are Plus™ OS How T o Note Ho w many filters can you cr eate? 2. The pr ofile (mask) The other item is called the pr of ile. Conceptually , this is a 16 -byte mask that decides which set of bytes should be extracted fr om a packet as it enters the filtering pr ocess, to be compared against all the interface A CLs and th e QoS cla[...]

Page 20 | AlliedW are Plus™ OS How T o Note Ho w many filters can you cr eate? Ar e there enough bytes f or your set of filters? Of course, the mask cannot increase withou t limit—it has a maximum size of 16 b ytes. When it reaches the 16-b yte limit, no more A CLs or QoS match com mands can be created which would cause the mask to incr ease in[...]

USA Headq u ar ters | 19800 Nor th Cr eek Parkwa y | S u ite 200 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895 E u r opea n Headq u ar ters | Via Motta 24 | 6830 Chiasso | Switzerla n d | T: +41 91 69769.00 | F: +41 91 69769.11 Asia-Paci f ic Headq u ar ters | 11 T ai Se ng Li n k | Si ng apor e | 534182 | T: +65 6383 3832 | [...]