Allied Telesis Summit 24 User's Guide download pdf (Page 109)

Using Access Control Lists

Summit 300-48 Switch Software User Guide 109

Rate Limits

Each entry that makes up a rate limit contains a unique name and specifies a previously created access

mask. Like an access list, a rate limit includes a list of values to compare with the incoming packets and

an action to take for packets that match. Additionally, a rate limit specifies an action to take when

matching packets arrive at a rate above the limit you set. When you create a rate limit, you must specify

a value for each of the fields that make up the access mask used by the list.

NOTE

Unlike an access list, a rate limit can only be applied to a single port. Each port will have its own rate

limit defined separately.

For packets that match a particular list, and arrive at a rate below the limit, you can specify the

following action:

• Permit

Forward the packet. You can send the packet to a particular QoS profile, and modify the packet’s

802.1p value and/or DiffServe code point.

For packets that match a particular list, and arrive at a rate that exceeds the limit, you can specify the

following actions:

• Drop

Drop the packets. Excess packets are not forwarded.

• Permit with rewrite

Forward the packet, but modify the packet’s DiffServe code point.

The allowable rate limit values for the 100BT ports are 1, 2, 3, 4 ... 100 Mbps, and for the Gigabit ports

are 8, 16, 24, 32...1000 Mbps.

NOTE

The rate limit specified in the command line does not precisely match the actual rate limit imposed by

the hardware, due to hardware constraints. See the release notes for the exact values of the actual rate

limits, if required for your implementation.

How Access Control Lists Work

When a packet arrives on an ingress port, the fields of the packet corresponding to an access mask are

compared with the values specified by the associated access lists to determine a match.

It is possible that a packet will match more than one access control list. If the resulting actions of all the

matches do not conflict, they will all be carried out. If there is a conflict, the actions of the access list

using the higher precedence access mask are applied. When a match is found, the packet is processed. If

the access list is of type deny, the packet is dropped. If the list is of type permit, the packet is

forwarded. A permit access list can also apply a QoS profile to the packet and modify the packet’s

802.1p value and the DiffServe code point.

1 2 ... 104 105 106 107 108 109 110 111 112 113 114 ... 197 198

No comments

Allied Telesis Summit 24 User's Guide Page 109