October 2012
Intermediate to advanced
419 pages
10h 47m
English
Content preview from Arista WarriorBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Chapter 16. Access Lists
At some point, we all need to write an access list. Like most things in EOS, doing so is very similar to doing so in IOS, with some minor changes here and there that we’ll cover in this chapter.
There are a variety of different Access-Control List (ACL) types, depending on how and where they are applied. The types include:
- Port-based ACL (PACL)
PACLs are applied to ports.
- Router-based ACL (RACL)
RACLs are applied to SVIs.
- MAC-Based ACLs (MACL or MAC ACL)
MACLs are ACLs that filter based on MAC address.
- Control Plane ACL
ACL used to filter access to the CPU on the switch. This ACL is where you would filter SSH, SNMP, Telnet, and so on to the switch itself.
Let’s look at the benefits and limitations of ACLs in EOS. According to the Arista Configuration Guide for EOS version 4.9.3.2, the following are features for ACLs:
Ingress ACLs
Port ACL applied on layer-2 Ethernet interfaces
Port ACL on port-channel interfaces. Ports in a port-channel apply the port-channel’s ACL
Filters: IPv4 protocol, source and destination address, TCP and UDP ports, TCP flags, and TTL
List size: 512 active rules; diminished capacity if rules contain L4 and port range filters
Broadcast and multicast storm control
The same document also lists the following:
Egress ACLs
Filters based on IPv6/MAC
I’ve never had much of a use for egress ACLs on routers, so on the surface that’s not a big deal for me.
Note
There are some valid uses for egress ACLs on switches, especially cut-through models. Additionally, the ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.