An Access Control List, or ACL, is an ordered set of rules that are evaluated on a packet-by-packet basis to determine whether access should be provided to a specific resource. ACLs can be used to drop unauthorized or suspicious packets from entering or leaving a routing device via specified interfaces.
SR Linux supports the following types of ACLs:
An ACL is applied to a selected set of traffic contexts. A traffic context could be all the IPv4 or IPv6 packets arriving or leaving on a specific subinterface, or the out-of-band IP traffic arriving on a management interface, or all the in-band IPv4 or IPv6 packets that are locally terminating on the CPM of the router.
Each ACL rule, or entry, has a sequence ID. The ACL evaluates packets starting with the entry with the lowest sequence ID, progressing to the entry with the highest sequence ID. Evaluation stops at the first matching entry (that is, when the packet matches all of the conditions specified by the ACL entry).
When a packet matches an ACL entry, an action specified by the ACL entry is applied to the packet. An ACL entry has a primary action and an optional secondary action. The secondary action extends the primary action with additional packet handling operations.
For traffic transiting through the router, ACL entries support the following primary actions:
For traffic transiting through the router, the following secondary action is supported:
For traffic terminating on the CPM of the router, the preceding primary and secondary actions are supported, as well as the following secondary actions for ACL entries where accept is the primary action:
If a packet matches an ACL entry, no further evaluation is done for the packet. If the packet does not match any ACL entry, the default action is accept. To drop traffic that does not match any ACL entry, you can optionally configure an entry with the highest sequence ID in the ACL to drop all traffic. This causes traffic that does not match any of the lower-sequence ACL entries to be dropped.
The supported actions for each type of ACL differ based on the hardware platform where the ACL is configured. The following tables indicate which actions are supported for each ACL filter type for each hardware platform.
Table 15 lists the supported actions for each ACL filter type on IXR-7250 systems.
ACL filter type | Action | Supported? |
Interface filter (input) | accept | Yes |
accept and log | Yes | |
drop | Yes | |
drop and log | Yes | |
Interface filter (output) | accept | Yes |
accept and log | Yes | |
drop | Yes | |
drop and log | Yes | |
CPM filter | accept | Yes |
accept and log | Yes | |
drop | Yes | |
drop and log | Yes | |
accept and distributed-policer | Yes | |
accept and distributed-policer and log | No log generated | |
accept and system-cpu-policer | Yes | |
accept and system-cpu-policer and log | No log generated | |
Packet capture filter | accept | Yes |
copy | Yes | |
System filter | accept | No |
drop | No | |
drop and log | No |
Table 16 lists the supported actions for each ACL filter type on 7220 IXR-D1, D2, and D3 systems.
ACL filter type | Action | Supported? |
Interface filter (input) | accept | Yes |
accept and log | No log generated | |
drop | Yes | |
drop and log | Yes, using separate CPU queue | |
Interface filter (output) | accept | Yes |
accept and log | No log generated | |
drop | Yes | |
drop and log | No log generated | |
CPM filter | accept | Yes |
accept and log | No log generated | |
drop | Yes | |
drop and log | Yes, using shared CPU queue | |
accept and distributed-policer | Yes | |
accept and distributed-policer and log | No log generated | |
accept and system-cpu-policer | Yes | |
accept and system-cpu-policer and log | No log generated | |
Packet capture filter | accept | Yes |
copy | Yes | |
System filter | accept | Yes |
drop | Yes | |
drop and log | Yes |
Table 17 lists the supported actions for each ACL filter type on 7220 IXR-H2 and H3 systems.
ACL filter type | Action | Supported? |
Interface filter (input) | accept | Yes |
accept and log | No log generated | |
drop | Yes | |
drop and log | Yes, but logged packet is also processed by CPM filter | |
Interface filter (output) | accept | Yes |
accept and log | No log generated | |
drop | Yes | |
drop and log | No log generated | |
CPM filter | accept | Yes |
accept and log | No log generated | |
drop | Yes | |
drop and log | Yes | |
accept and distributed-policer | No policing | |
accept and distributed-policer and log | No policing and no log generated | |
accept and system-cpu-policer | Yes | |
accept and system-cpu-policer and log | No log generated | |
Packet capture filter | accept | Yes |
copy | Yes | |
System filter | accept | No |
drop | No | |
drop and log | No |
An interface filter is an IPv4 or IPv6 ACL that restricts traffic allowed to enter or exit a subinterface.
IPv4 ACLs analyze IPv4 packets. The following match criteria are supported by IPv4 ACLs:
IPv6 ACLs analyze IPv6 packets. The following match criteria are supported by IPv6 ACLs:
IPv4 and/or IPv6 ACLs can be applied to a subinterface to restrict traffic entering or exiting that subinterface, as follows:
For troubleshooting purposes, the SR Linux supports ACL policies called packet capture filters. When an ingress IP packet on any line card transits through the router, and it matches a rule in a capture-filter policy, it is copied and extracted towards the CPM (using the capture-filter extraction queue) and delivered to a Linux virtual Ethernet interface, so that it can be displayed by tcpdump (or similar packet capture utility), or encapsulated and forwarded to a remote monitoring system.
Similarly, when an ingress IP packet on any line card terminates locally, and it matches a rule of a capture-filter policy, it is extracted towards the CPM (using the normal protocol-based extraction queue), and a header field indicates to the CPM to replicate it (after running the CPM-filter rules) towards the Linux virtual Ethernet interface.
There is one capture-filter for IPv4 traffic and another capture-filter for IPv6 traffic. The default IPv4 capture-filter policy copies no IPv4 packets and the default IPv6 capture-filter copies no IPv6 packets.
The entries for each capture-filter are installed on every line card. On the line card, the entries are evaluated after the input subinterface ACLs and before the CPM-filter ACLs. On the CPM, the entries in the capture-filter policy are evaluated after the CPM-filter entries.
When a capture-filter ACL is created, its rules are evaluated against all transit and terminating IPv4 or IPv6 traffic that is arriving on any subinterface of the router, regardless of where that traffic entered in terms of network-instance, subinterface, linecard, pipeline, and so on. Note that capture-filter ACL rules cannot override interface filter or system-filter ACL drop outcomes; packets dropped by interface filter ACLs or a system filter ACL cannot be mirrored to the control plane.
Each capture-filter entry has a set of zero or more match conditions, and one of two possible actions: accept and copy. The match conditions are the same as the other filter types. The accept action passes the matching packet to the next stage of processing, without creating a copy. The copy action creates a copy of the matching packet, extracts it towards the CPM and delivers it to the designated virtual Ethernet interface.
For control plane protection, SR Linux supports ACL policies called CPM filters. There is one CPM filter for IPv4 traffic and another CPM filter for IPv6 traffic. When an ingress IP packet is matched by a CPM filter rule, and it is a terminating packet (that is, it must be extracted to the CPM), then it is processed according to the matching CPM filter rule.
The entries for each CPM filter are installed on every line card. They are evaluated after the input subinterface ACLs and after the capture-filter ACLs. CPM filter rules have no effect on locally originating traffic or transit traffic, and they have no interaction with output subinterface ACLs.
When a CPM filter ACL is created, its rules are evaluated against all IPv4 or IPv6 traffic that is locally terminating on the router, regardless of where that traffic entered in terms of network-instance, subinterface, linecard, pipeline, and so on.
On 7250 IXR systems, for traffic terminating on the CPM of the router, the following secondary actions are supported for ACL entries where accept is the primary action:
On 7220 IXR-D1, D2, and D3 systems, CPM filter ACLs support the following actions:
The system-cpu-policer and distributed-policer actions police terminating traffic to ensure that the rate does not exceed a safe limit.
The system-cpu-policer action applies an aggregate rate limit, regardless of ingress line card, while the distributed-policer action applies a rate limit to the extracted traffic from each core (7250 IXR) or complex (7220 IXR) associated with the ingress port. You can have both types of policer actions in the same CPM filter entry, or only one of them.
CPM filter rules that apply a system-cpu-policer and/or distributed-policer action do not directly specify the policer parameters; they refer to a generically defined policer. This allows different CPM filter entries, even across multiple ACLs, to use the same policer. Optionally, each policer can be configured as entry-specific, which means a different policer instance is used by each referring filter entry, even if they are part of the same ACL.
A system filter ACL is an IPv4 or IPv6 ACL that evaluates ingress traffic before all other ACL rules. If an IP packet is dropped by a system filter rule, it is the final disposition of the packet; neither a capture-filter copy/accept action, nor an ingress interface ACL accept action, nor a CPM-filter accept action can override the drop action of a system filter.
At most one system filter can be defined for IPv4 traffic, and at most one system filter can be defined for IPv6 traffic. System filter ACLs are supported on 7220 IXR-D1, D2, and D3 systems only. They can be applied only at ingress, not egress.
When a system-filter ACL is created, its rules are automatically installed everywhere, meaning they are evaluated against all transit and terminating IPv4 or IPv6 traffic arriving on any subinterface of the router, regardless of where that traffic entered in terms of network-instance, subinterface, pipeline, and so on.
A system filter is the only type of filter that can match the outer header of tunneled packets. For VXLAN traffic, this allows you to configure a system filter that matches and drops unauthorized VXLAN tunnel packets before they are decapsulated. The system filter matches the outer header of tunneled packets; they do not filter the payload of VXLAN tunnels.
The following is an example IPv4 ACL that has one entry:
This example creates an IPv4 ACL named ip_tcp. Within the ip_tcp ACL, an entry with sequence ID 1000 is configured. The action is specified as accept, with logging set to true.
The filter matches packets with IP destination address 100.1.3.1/32; for TCP traffic, if the source address 100.1.5.1/32, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.
The following is an example of an entry added to the ip_tcp ACL that causes all traffic to be dropped. Since it has the highest sequence ID, traffic that matches any of the lower-sequenced ACL entries would have been accepted before being evaluated by this entry. Only traffic that did not match any of the other ACL entries would be dropped by this entry.
Note that the drop action with logging set to true is not supported on 7220 IXR-D1, D2, and D3 systems when it is attached as an egress filter.
The following is an example IPv6 ACL that has one entry:
This example creates an IPv6 ACL named ipv6_tcp. Within the ipv6_tcp ACL, an entry with sequence ID 100 is configured. The action is specified as accept, with logging set to true.
The filter matches packets with IPv6 destination address 2001:10:1:3::1/120; for TCP traffic, if the source address 2001:10:1:5::1/120, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.
The following is an example of a CPM filter that matches ingress IPv4 packets that terminate at the CPM. Matching packets are subject to the rate limiting defined in system-cpu-policer p1.
The following example defines a system-cpu-policer that specifies a rate limit for packets that match CPM filters that use this policer as an action, such as the example above. If the peak packet rate is not exceeded, the packets are sent to the CPM application. If the peak packet rate is exceeded, then the packets are dropped.
The system-cpu-policer applies to the aggregate of terminating traffic received from all line cards. You can also define a distributed-policer that applies a rate limit to the extracted traffic from each core (7250 IXR) of each ingress line card. Packets to be extracted to the CPM on each line card are fed to a hardware-based policer, which determines if the packet should be queued by the line card towards the CPM or dropped because a bit-per-second rate is exceeded.
The following example defines a distributed-policer that specifies a rate limit for packets that match CPM filters that use this policer as an action. If the distributed-policer is referenced in a CPM filter entry, it is instantiated on every core (7250 IXR) of every line card.
The following is an example of a system filter ACL that filters IPv4 traffic. When the system filter is applied, it evaluates all transit and terminating IPv4 arriving on any subinterface of the router. The system filter ACL evaluates the traffic before any other ACL filters. System filter ACLs can be configured on 7220 IXR-D1, D2, and D3 systems only.
After an ACL is configured, you can attach it to a subinterface so that traffic entering and/or exiting the subinterface is subject to the rules defined in the ACL.
For example, the following commands apply IPv4 and IPv6 ACLs to inbound traffic on a subinterface:
You can check the configuration of the interface to verify that the ACL is successfully attached. For example:
To modulate traffic for the management interface, navigate to the subinterface of interface mgmt0. Under the acl context, attach the IPv4 or IPv6 ACL for input/output traffic. For example:
To verify the configuration for the management interface ACL:
To detach an ACL from an interface, enter the subinterface context and delete the ACL from the configuration. For example, the following commands detach an ACL from a subinterface:
Use the info interface command to verify that the ACL is no longer part of the subinterface configuration. For example:
The following commands detach an ACL from the management interface:
To verify that the ACL was detached from the management interface:
You can add entries to an ACL, delete entries from an ACL, and delete the entire ACL from the configuration.
To add an entry to an ACL, enter the context for the ACL, then add the entry. For example, the following commands add an entry to IPv4 ACL ip_tcp:
To delete an entry in an ACL, use the delete command under the context for the ACL and specify the sequence ID of the entry to be deleted. For example, the following commands delete the entry in IPv4 ACL ip_tcp with sequence ID 65535:
To delete the entire ACL, use the delete command under the acl context. For example, the following commands delete the ip_tcp ACL:
To aid in managing complex ACLs that have many entries, you can resequence the ACL entries to set a sequence ID number for the first entry and a constant increment for the sequence ID for subsequent entries.
For example, if you have an ACL with three entries, sequence IDs 123, 124, and 301, you can resequence the entries so that the initial entry has sequence ID 100, and the other two entries have sequence ID 110 and 120.
The following is an example of an ACL with three entries:
To resequence the entries in the ACL so that the first entry has sequence ID 100, and the next two entries are incremented by 10, enter the context for the ACL, issue the tools resequence command, then specify the initial sequence ID and the increment for the subsequent entries. For example:
After you enter the command, the ACL entries are renumbered. For example:
The resequence command is only available inside an ACL configuration context, and it only applies to the entries of the ACL associated with that context.
If you set the log parameter to true for the accept or drop action in an ACL entry, information about packets that match the ACL entry is recorded in the system log. You can specify settings for the log file for the ACL subsystem, including the location of the log file, maximum log file size, and the number of log files to keep.
For example, the following configuration specifies that the log file for the ACL subsystem be stored in a file named dut1_file, located in the /opt/srlinux/bin/logs/srbase directory. The log file can be a maximum of 1 Mb. When the log file reaches this size, it is renamed using dut1_file as its base name. The five most recent log files are kept.
Ensure that write permission is set for the specified directory path.
The following are examples of syslog entries for ACLs.
IPv4 Accept:
acl||I Type: Ingress IPv4 Filter: testing Sequence Id: 100 Action: Accept Interface: ethernet-1/16:1 Packet length: 56 IP Source: 100.1.5.1 Destination: 100.1.3.1 Protocol: 6 TCP Source port: 6722 Destination Port: 6789 Flags: SYN
IPv4 Drop:
acl||I Type: Ingress IPv4 Filter: test Sequence Id: 65535 Action: Drop Interface: ethernet-1/16:1 Packet length: 44 IP Source: 100.3.2.3 Destination: 100.1.3.1 Protocol: 17 UDP Source port: 6722 Destination Port: 6789
IPv6 Accept:
acl||I Type: Ingress IPv6 Filter: tests Sequence Id: 1000 Action: Accept Interface: ethernet-1/16:1 Packet length: 76 IP Source: 2001:10:1:5::1 Destination: 2001:10:1:3::1 Protocol: 6 TCP Source port: 6722 Destination Port: 6789 Flags: SYN
You can set thresholds for ACL resource usage. When utilization of a specified ACL resource, such as input IPv4 filter instances, reaches the threshold in either the rising or falling direction, it can trigger a log message.
Example:
The following example sets thresholds for resource usage by input IPv4 filter instances. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.
You can set thresholds for TCAM resource usage. When utilization of a specified TCAM resource, such as TCAM used by IPv4 CPM filters, reaches the threshold in either the rising or falling direction, it can trigger a log message.
Example:
The following example sets thresholds for TCAM resource usage by IPv4 CPM filters. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.
You can configure an ACL to collect statistics for packets matching the ACL. Statistics can be collected for packets that match each ACL entry, as well as for matching input/output traffic per subinterface.
The following example configures the ACL to record the number of matching packets for each entry:
By default, if two or more subinterfaces on the same line card reference the same ACL for filtering the same direction of traffic, they use a shared instance of the same ACL in hardware. This means that per-entry statistics (including the number of matched packets and the time stamp of the last matching packet), if enabled, reflect the aggregate of the data gathered for the multiple subinterfaces.
To collect per-entry, per-subinterface statistics, instead of the aggregate of the subinterfaces where the ACL is applied, you can configure an ACL to operate in subinterface-specific mode.
If you change an ACL from subinterface-specific mode to shared mode, or vice-versa, during the transition from one mode to the next, traffic continues to be subject to the previous mode until the system resources (TCAM) entries are programmed for the new mode.
The following example configures the ACL to collect statistics for matching packets inbound and outbound on each subinterface:
You can configure the following values for the subinterface-specific parameter:
Use the info from state command to display the matched packet statistics and the time of the last match for the interfaces to which the ACL is attached. In the following example, the ACL is attached to two interfaces, and statistics are collected for each subinterface:
If the match criteria changes for an ACL entry, the statistics counter does not reset to zero. To reset the statistics counter for an ACL entry to zero, use the tools acl clear command, as described in Clearing ACL statistics.
Use the info from state platform command to display the amount of system resources (TCAM) used by each type of ACL on each line card.
The following example displays the TCAM usage for input IPv4 ACLs on a line card:
The following example displays the amount of system resources allocated to input IPv4 ACLs on a line card, and how much is used and free:
To reset ACL statistics counters to zero, use the tools acl clear command. This command can clear statistics at the IPv4 / IPv6 / CPM filter level, ACL entry level, or for an interface or subinterface to which the ACL is attached.
The following example clears statistics for an IPv4 filter:
After this command is executed, the info from state output for the IPv4 filter includes a timestamp indicating when the statistics were cleared. For example:
The following example clears statistics for a specific entry in the IPv4 filter:
The following example clears statistics for a specified subinterface for a specified entry in the IPv4 filter:
You can display ACL statistics using relevant show commands.
To display information about all active ACLs, use the show acl summary command. For example:
You can display statistics for a specific ACL, including how many times each ACL entry was matched on all subinterfaces to which the ACL was applied. For example:
To display per-interface statistics for packets matching each ACL entry, specify the interface name in addition to the ACL name. For example:
To display statistics for packets matching a CPM filter, specify the CPM filter type (IPv4 or IPv6). For example: