Access control lists

This example creates an IPv4 ACL named ip_tcp. Within the ip_tcp ACL, an entry with sequence ID 1000 is configured. The action is specified as accept, with logging set to true.

The filter matches packets with IP destination address 100.1.3.1/32; for TCP traffic, if the source address 100.1.5.1/32, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.

--{ * candidate shared default }--[  ]--
# info acl 
 ipv4-filter ip_tcp {
        entry 1000 {
            description Match_IP_Address_TCP_Protocol_Ports
            action {
                accept {
                    log true
                }
            }
            match {
                destination-address 100.1.3.1/32
                protocol tcp
                source-address 100.1.5.1/32
                destination-port {
                    value 6789
                }
                source-port {
                    value 6722
                }
            }
        }
    }

The following is an example of an entry added to the ip_tcp ACL that causes all traffic to be dropped. Because it has the highest sequence ID, traffic that matches any of the lower-sequenced ACL entries would have been accepted before being evaluated by this entry. Only traffic that did not match any of the other ACL entries would be dropped by this entry.

--{ * candidate shared default }--[  ]--
# info acl
       ipv4-filter ip_tcp {
           entry 65535 {
               action {
                   drop {
                     log true
                   }
               }
           }
        }

Note that the drop action with logging set to true is not supported on 7220 IXR-D1, D2, D3, and D5 systems when it is attached as an egress filter.

This example creates an IPv6 ACL named ipv6_tcp. Within the ipv6_tcp ACL, an entry with sequence ID 100 is configured. The action is specified as accept, with logging set to true.

The filter matches packets with IPv6 destination address 2001:10:1:3::1/120; for TCP traffic, if the source address 2001:10:1:5::1/120, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.

--{ * candidate shared default }--[  ]--
# info acl
ipv6-filter ipv6_tcp {
        entry 100 {
            description Match_Dest_Address_TCP_Src_Address_DP_SP
            action {
                accept {
                    log true
                }
            }
            match {
                destination-address 2001:10:1:3::1/120
                next-header tcp
                source-address 2001:10:1:5::1/120
                destination-port {
                    value 6789
                }
                source-port {
                    value 6722
                }
            }
        }
    }

Drop traffic from a source MAC

This example creates a MAC ACL named mac01. Within the mac01 ACL, an entry with sequence ID 100 is configured. The filter matches Ethernet frames with a source MAC address of AA:BB:19:DD:EE:FF. The action is specified as drop, with logging set to true.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 100 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    source-mac {
                        address AA:BB:19:DD:EE:FF
                    }
                }
            }
        }
    }

Accept traffic using MAC address mask

The following example uses an address mask to specify the source MAC address. The address mask, entered in MAC address format such as ff:ff:ff:ff:00:00, indicates the bit values that must be matched exactly (FF value in the mask) and the bit values that can be 0 or 1 (00 value in the mask).

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 200 {
                action {
                    accept {
                    }
                }
                match {
                    source-mac {
                        address AA:BB:19:DD:EE:FF
                        mask FF:FF:FF:FF:00:00
                    }
                }
            }
        }
    }

Drop traffic of specific Ethertype

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 300 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    ethertype 0x0806
                }
            }
        }
    }

Drop traffic with specific outermost VLAN ID

You can configure a specific VLAN ID or range of VLAN IDs as match criteria. The match is based on the outermost VLAN ID of the Ethernet frame. The VLAN ID can be specified as an integer from 0 to 4095 or none. Specifying 0 as the VLAN ID matches priority-tagged frames; specifying none matches untagged frames.

The following example drops Ethernet frames with VLAN ID 4095.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 400 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    vlan {
                        outermost-vlan-id {
                            value 4095
                        }
                    }
                }
            }
        }
    }

The following example configures a range of VLAN IDs, 100 to 999 inclusive, as match criteria.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 500 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    vlan {
                        outermost-vlan-id {
                           range {
                                start 100
                                end 999
                            }
                        }
                    }
                }
            }
        }
    }

Attach IPv4/IPv6 ACLs to a subinterface

The following example applies IPv4 and IPv6 ACLs to inbound traffic on a subinterface:

--{ * candidate shared default }--[  ]--
# info interface ethernet-1/16 subinterface 1 acl
interface ethernet-1/16 {
    subinterface 1 {
        acl {
            input {
                ipv4-filter ip_tcp
                ipv6-filter ipv6_tcp
            }
        }
    }
}

Attach a MAC ACL to a subinterface

The following example applies a MAC ACL to outbound traffic on a subinterface. To apply a MAC ACL to traffic in the outbound direction on any subinterface, you must set the acl egress-mac-filtering command to true.

--{ * candidate shared default }--[  ]--
# info interface ethernet-1/1 subinterface 1 acl
    interface ethernet-1/1 {
        subinterface 1 {
            acl {
                output {
                    mac-filter mac01
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        egress-mac-filtering true
    }

--{ * candidate shared default }--[  ]--
# interface mgmt0
--{ * candidate shared default }--[ interface mgmt0 ]—
# subinterface 0
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 ]--
# acl
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 acl ]—
# input ipv4-filter ip_tcp
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 acl ]—
# input ipv6-filter ipv6_tcp

To verify the configuration for the management interface ACL:

--{ * candidate shared default }--[  ]--
# info interface mgmt0
   interface mgmt0     {
     admin-state enable
        subinterface 0 {
            admin-state enable
            ipv4 {
               dhcp-client true
            }
            ipv6 {
               dhcp-client true
            }
            acl {
               input {
                   ipv4-filter ip_tcp
                   ipv6-filter ipv6_tcp
               }
            }
        }
   }

The following commands detach an ACL from a subinterface:

--{ * candidate shared default }--[  ]--
# interface ethernet-1/16
--{ * candidate shared default }--[ interface ethernet-1/16 ]—
# subinterface 1
--{ * candidate shared default }--[ interface ethernet-1/16 subinterface 1 ]—
# delete acl input ipv4-filter
--{ * candidate shared default }--[ interface ethernet-1/16 subinterface 1 ]--

Use the info interface command to verify that the ACL is no longer part of the subinterface configuration. For example:

--{ * candidate shared default }--[  ]--
# info interface ethernet-1/16
interface ethernet-1/16 {
    description dut1-dut-2
    subinterface 1 {
        ipv4 {
            address 100.1.5.2/24 {
            }
            arp {
                neighbor 100.1.5.1 {
                    link-layer-address 00:00:64:01:05:05
                }
            }
        }
        ipv6 {
            address 2001:10:1:5::2/120 {
            }
            neighbor-discovery {
                neighbor 2001:10:1:5::1 {
                    link-layer-address 00:00:64:01:05:05
                }
            }
        }
        acl {
            input {
                ipv6-filter ipv6_tcp
            }
        }
    }
}

--{ * candidate shared default }--[  ]--
# interface mgmt0
--{ * candidate shared default }--[ interface mgmt0 ]—
# subinterface 0
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 ]--
# delete acl input ipv4-filter

To verify that the ACL was detached from the management interface:

--{ * candidate shared default }--[  ]--
# info interface mgmt0
   interface mgmt0     {
     admin-state enable
        subinterface 0 {
            admin-state enable
            ipv4 {
               dhcp-client true
            }
            ipv6 {
               dhcp-client true
            }
            acl {
               input {
                  ipv6-filter ipv6_tcp
               }
            }
        }
   }

To add an entry to an ACL, enter the context for the ACL, then add the entry. For example, the following commands add an entry to IPv4 ACL ip_tcp:

--{ * candidate shared default }--[  ]--
# acl ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# entry 65535
--{ candidate shared default }--[ acl ipv4-filter ip_tcp entry 65535 ]--
# action drop
--{ candidate shared default }--[ acl ipv4-filter ip_tcp entry 65535 action drop ]--
# log true
--{ candidate shared default }--[ acl ipv4-filter ip_tcp entry 65535 action drop ]--

To delete an entry in an ACL, use the delete command under the context for the ACL and specify the sequence ID of the entry to be deleted. For example, the following commands delete the entry in IPv4 ACL ip_tcp with sequence ID 65535:

--{ candidate shared default }--[  ]--
# acl ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# delete entry 65535

To delete the entire ACL, use the delete command under the acl context. For example, the following commands delete the ip_tcp ACL:

--{ * candidate shared default }--[  ]--
# acl
--{ candidate shared default }--[ acl ]--
# delete ipv4-filter ip_tcp

The following is an example of an ACL with three entries:

--{ candidate shared default }--[ acl ]—
# info ipv4-filter ip_tcp
 ipv4-filter ip_tcp {
        entry 123 {
            action {
                drop {
                    log true
                }
            }
            match {
                destination-address 1.1.2.1/24
            }
        }
        entry 124 {
            action {
                accept {
                    log true
                }
            }
            match {
                destination-address 1.1.3.1/24
            }
        }
        entry 301 {
            action {
                drop {
                }
            }
            match {
                destination-address 1.1.4.1/24
            }
        }

To resequence the entries in the ACL so that the first entry has sequence ID 100, and the next two entries are incremented by 10, enter the context for the ACL, issue the tools resequence command, then specify the initial sequence ID and the increment for the subsequent entries. For example:

--{ candidate shared default }--[  ]--
# acl ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# tools resequence start 100 increment 10

After you enter the command, the ACL entries are renumbered. For example:

--{ candidate shared default }--[ acl ]—
# info ipv4-filter ip_tcp
 ipv4-filter ip_tcp {
        entry 100 {
            action {
                drop {
                    log true
                }
            }
            match {
                destination-address 1.1.2.1/24
            }
        }
        entry 110 {
            action {
                accept {
                    log true
                }
            }
            match {
                destination-address 1.1.3.1/24
            }
        }
        entry 120 {
            action {
                drop {
                }
            }
            match {
                destination-address 1.1.4.1/24
            }
        }

The resequence command is only available inside an ACL configuration context, and it only applies to the entries of the ACL associated with that context.

Creating an IPv4 CPM filter

The following example creates a CPM filter for IPv4 traffic. IPv4 traffic extracted to the CPM that matches the rule in the filter is processed according to the action configured in the rule. In this example, the matching CPM-bound IPv4 traffic is accepted and rate-limited according to the limit specified by the sp1 system-cpu-policer.

--{ * candidate shared default }--[  ]--
# info acl cpm-filter 
    acl {
        cpm-filter {
            ipv4-filter {
                entry 1000 {
                    action {
                        accept {
                            rate-limit {
                                system-cpu-policer 1000
                            }
                        }
                    }
                    match {
                        protocol tcp
                        destination-ip {
                            address 100.1.3.1
                            mask 255.255.255.255
                        }
                        source-ip {
                            address 100.1.5.1
                            mask 255.255.255.255
                        }
                        destination-port {
                            value 6789
                        }
                        source-port {
                            value 6722
                        }
                    }
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl policers system-cpu-policer sp1
    acl {
        policers {
            system-cpu-policer sp1 {
                peak-packet-rate 1000000
                max-packet-burst 16
            }
        }
    }

Creating a MAC CPM filter

The following example creates a MAC CPM filter. Non-IP traffic extracted to the CPM that matches the filter rule is processed according to the configured action. In this example, the matching CPM-bound Ethernet frames are accepted and rate-limited according to the limit specified by the dp1 distributed-cpu-policer setting.

--{ * candidate shared default }--[  ]--
# info acl cpm-filter
    acl {
        cpm-filter {
            mac-filter {
                entry 100 {
                    action {
                        accept {
                            rate-limit {
                                distributed-policer dp1
                            }
                        }
                    }
                    match {
                        source-mac {
                            address AA:BB:19:DD:EE:FF
                            mask FF:FF:FF:FF:00:00
                        }
                    }
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl policers policer dp1
    acl {
        policers {
            policer dp1 {
                peak-rate 500000
                max-burst 100000
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl system-filter
 acl
    system-filter {
        ipv4-filter {
            entry 44 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    source-ip {
                        address 100.1.5.1
                        mask 0.0.0.255
                    }
                }
            }
        }
    }

For example, the following configuration specifies that the log file for the ACL subsystem be stored in the file dut1_file, located in the /opt/srlinux/bin/logs/srbase directory. The log file can be a maximum of 1 Mb. When the log file reaches this size, it is renamed using dut1_file as its base name. The five most recent log files are kept.

--{ candidate shared default }--[  ]--
# system
--{ candidate shared default }--[ system ]--
# info logging file dut1_file
logging {
        file dut1_file {
            directory /opt/srlinux/bin/logs/srbase/
            rotate 5
            size 1M
            subsystem acl {
            }
        }
}

Ensure that write permission is set for the specified directory path.

The following example sets thresholds for resource usage by input IPv4 filter instances. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.

--{ * candidate shared default }--[  ]--
# info platform resource-monitoring
    platform {
        resource-monitoring {
            acl {
                resource input-ipv4-filter-instances {
                    rising-threshold-log 90
                    falling-threshold-log 90
                }
            }
        }
    }

The following example sets thresholds for TCAM resource usage by IPv4 CPM filters. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.

--{ * candidate shared default }--[  ]--
# info platform resource-monitoring
    platform {
        resource-monitoring {
            tcam {
                resource cpm-capture-ipv4 {
                    rising-threshold-log 90
                    falling-threshold-log 90
                }
            }
        }
    }

The following example configures the ACL to record the number of matching packets for each entry:

--{ candidate shared default }--[ acl ]-- 
# ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# statistics-per-entry true

By default, if two or more subinterfaces on the same line card reference the same ACL for filtering the same direction of traffic, they use a shared instance of the same ACL in hardware. This means that per-entry statistics (including the number of matched packets and the time stamp of the last matching packet), if enabled, reflect the aggregate of the data gathered for the multiple subinterfaces.

To collect per-entry, per-subinterface statistics, instead of the aggregate of the subinterfaces where the ACL is applied, you can configure an ACL to operate in subinterface-specific mode.

If you change an ACL from subinterface-specific mode to shared mode, or the other way around, during the transition from one mode to the next, traffic continues to be subject to the previous mode until the system resources (TCAM) entries are programmed for the new mode.

The following example configures the ACL to collect statistics for matching packets inbound and outbound on each subinterface:

--{ candidate shared default }--[ acl ]-- 
# ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# subinterface-specific input-and-output

You can configure the following values for the subinterface-specific parameter:

• disabled (the default) – All subinterfaces on a single line card that reference the ACL as an input ACL use a shared filter instance, and all subinterfaces on a single line card that reference the ACL as an output ACL use a shared filter instance.

• input-only – All subinterfaces on a single line card that reference the ACL as an output ACL use a shared filter instance, but each subinterface that references the ACL as an input ACL uses its own separate instance of the filter.

• output-only – All subinterfaces on a single line card that reference the ACL as an input ACL use a shared filter instance, but each subinterface that references the ACL as an output ACL uses its own separate instance of the filter.

• input-and-output – Each subinterface that references the ACL as either an input ACL or an output ACL uses its own separate instance of the filter.

In the following example, the ACL is attached to two interfaces, and statistics are collected for each subinterface:

--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# info from state
    subinterface-specific input-and-output
    statistics-per-entry true
    entry 1000 {
        description Match_IP_Address_TCP_Protocol_Ports
        action {
            accept {
                log true
            }
        }
        match {
            destination-address 100.1.3.1/32
            protocol tcp
            source-address 100.1.5.1/32
            destination-port {
                value 6789
            }
            source-port {
                value 6722
            }
        }
        statistics {
            aggregate {
                in-matched-packets 3000
                in-last-match 2019-07-16T10:53:00.1563Z
                out-matched-packets 0
            }
            per-interface {
                subinterface ethernet-1/16.1 {
                    in-matched-packets 3000
                    in-last-match 2019-07-16T10:53:00.1563Z
                }
            }
        }
    }
    entry 65535 {
        action {
            drop {
                log true
            }
        }
        statistics {
            aggregate {
                in-matched-packets 1000
                in-last-match 2019-07-16T10:53:30.1563Z
            }
            per-interface {
                subinterface ethernet-1/16.1 {
                    in-matched-packets 1000
                    in-last-match 2019-07-16T10:53:30.1563Z
                }
            }
        }
    }

If the match criteria changes for an ACL entry, the statistics counter does not reset to zero. To reset the statistics counter for an ACL entry to zero, use the tools acl clear command, as described in Clearing ACL statistics.

The following example shows two different numbers for the remaining (free) TCAM entry resources that are available for input IPv4 ACLs on the line card. The free-static value refers to the available number of resources assuming no additional TCAM banks are dynamically assigned to the ACL type. The free-dynamic value refers to the available number of resources assuming all unallocated TCAM banks are dedicated to the specified ACL type.

--{ candidate shared default }--[  ]--
# info from state platform linecard 1 forwarding-complex 0 tcam resource if-input-ipv4
    platform {
        linecard 1 {
            forwarding-complex 0 {
                tcam {
                    resource if-input-ipv4 {
                        free-static 2046
                        free-dynamic 18430
                        reserved 2
                        programmed 2
                    }
                }
            }
        }
    }

The following example shows the amount of system resources allocated to input IPv4 ACLs on the line card and how much is used and free:

--{ candidate shared default }--[  ]--
# info from state platform linecard 1 forwarding-complex 0 acl resource input-ipv4-filter-instances
    platform {
        linecard 1 {
            forwarding-complex 0 {
                acl {
                    resource input-ipv4-filter-instances {
                        used 1
                        free 254
                    }
                }
            }
        }
    }

The following example clears statistics for an IPv4 filter:

--{ candidate shared default }--[ acl ]-- 
# tools acl ipv4-filter tcp_ip clear

After this command is executed, the info from state output for the IPv4 filter includes a timestamp indicating when the statistics were cleared. For example:

--{ candidate shared default }--[ acl ipv4-filter tcp_ip ]-- 
# info from state 
    subinterface-specific output-only
    statistics-per-entry true
    entry 1000 {
        description Match_IP_Address_TCP_Protocol_Ports
        action {
            accept {
                log true
            }
        }
        match {
            destination-address 100.1.3.1/32
            protocol tcp
            source-address 100.1.5.1/32
            destination-port {
                value 6789
            }
            source-port {
                value 6722
            }
        }
        statistics {
            last-clear 2021-10-03T13:53:51.000Z
        }
    }

The following example clears statistics for a specific entry in the IPv4 filter:

--{ candidate shared default }--[ acl ]-- 
# tools acl ipv4-filter tcp_ip entry 1000 statistics clear

The following example clears statistics for a specified subinterface for a specified entry in the IPv4 filter:

--{ candidate shared default }--[ acl ]-- 
# tools acl ipv4-filter tcp_ip entry 1000 statistics per-interface subinterface 1 clear

To display information about all active ACLs, use the show acl summary command. For example:

--{ candidate shared default }--[  ]--
# show acl summary
--------------------------------------------------------------------------------
CPM Filter ACLs
--------------------------------------------------------------------------------
ipv4-entries: 1
ipv6-entries: 0
mac-entries : 1
--------------------------------------------------------------------------------
Capture Filter ACLs
--------------------------------------------------------------------------------
ipv4-entries: 0
ipv6-entries: 0
--------------------------------------------------------------------------------
IPv4 Filter ACLs
--------------------------------------------------------------------------------
Filter : ip_tcp
Active on : 1 subinterfaces (input) and 0 subinterfaces (output)
Entries : 2
--------------------------------------------------------------------------------
IPv6 Filter ACLs
--------------------------------------------------------------------------------
Filter : ipv6_tcp
Active on : 1 subinterfaces (input) and 0 subinterfaces (output)
Entries : 1
--------------------------------------------------------------------------------
MAC Filter ACLs
--------------------------------------------------------------------------------
Filter   : mac01
Active On: 1 subinterfaces (input) and 0 subinterfaces (output)
Entries  : 5
--------------------------------------------------------------------------------

You can display statistics for a specific ACL, including how many times each ACL entry was matched on all subinterfaces to which the ACL was applied. For example:

--{ candidate shared default }--[  ]--
# show acl ipv4-filter ip_tcp
====================================================================================
Filter        : ip_tcp
SubIf-Specific: input-and-output
Entry-stats   : yes
Entries       : 2
------------------------------------------------------------------------------------
 Subinterface     Input   Output
ethernet-1/16.1   yes     no    
------------------------------------------------------------------------------------
Entry 1000
  Match               : protocol=tcp, 100.1.5.1/32(6722-6722)->100.1.3.1/32(6789-
6789)
  Action              : accept
  Input Match Packets : 3000
  Input Last Match    : 18 seconds ago
  Output Match Packets: 0
  Output Last Match   : never
Entry 65535
  Match               : protocol=<undefined>, any(*)->any(*)
  Action              : drop
  Input Match Packets : 1000
  Input Last Match    : 6 minutes ago
  Output Match Packets: 0
  Output Last Match   : never

To display per-interface statistics for packets matching each ACL entry, specify the interface name in addition to the ACL name. For example:

--{ candidate shared default }--[  ]--
# show acl ipv4-filter ip_tcp interface ethernet-1/16
====================================================================================
Filter        : ip_tcp
SubIf-Specific: input-and-output
Entry-stats   : yes
Entries       : 2
------------------------------------------------------------------------------------
 Subinterface     Input   Output
ethernet-1/16.1   yes     no    
------------------------------------------------------------------------------------
Entry 1000
  Match               : protocol=tcp, 100.1.5.1/32(6722-6722)->100.1.3.1/32(6789-
6789)
  Action              : accept
  Input Match Packets : 3000
  Input Last Match    : 5 minutes ago
  Output Match Packets: 0
  Output Last Match   : never
Entry 65535
  Match               : protocol=<undefined>, any(*)->any(*)
  Action              : drop
  Input Match Packets : 1000
  Input Last Match    : 10 minutes ago
  Output Match Packets: 0
  Output Last Match   : never

To display statistics for packets matching a CPM filter, specify the CPM filter type (IPv4 or IPv6). For example:

--{ candidate shared default }--[  ]--
# show acl cpm-filter ipv4-filter
================================================================================
Filter     : CPM IPv4-filter
Entry-stats: no
Entries    : 1
--------------------------------------------------------------------------------
Entry 1001
  Match          : protocol=<undefined>, any(*)->1.1.2.1/24(*)
  Action         : none
  Matched Packets: 0
--------------------------------------------------------------------------------