IP ACLs are Layer 3 ACLs. An IP ACL rule specifies whether the contents of a packet permit or deny access to the network. Depending on the options that are supported on a switch, you can configure rules to inspect the following fields of a packet:
- Source IP address and source IP mask
- Destination IP address and destination IP mask
- Source Layer 4 port
- Destination Layer 4 port
- Protocol number, including:
- TCP flag
- IGMP type
- ICMP type or ICMP message
- Fragments
- Service type, including:
- IP DSCP value
- IP precedence value
- Type of Service (ToS) value
A switch can support basic IPv4 ACLs, extended IPv4 ACLs, and IPv6 ACL. (Some legacy models might not support all these types of IP ACLs.) The differences between a basic IPv4 ACL and an extended IPv4 ACL are as follows:
- Numbered ACL from 1 to 99: A basic IPv4 ACL, which allows you to permit or deny traffic from a source IP address.
- Numbered ACL from 100 to 199: An extended IPv4 ACL, which allows you to permit or deny specific types of Layer 3 or Layer 4 traffic from a source IP address to a destination IP address. This type of ACL provides more granularity and filtering capabilities than a basic IP ACL.
- Named IP ACL: An extended IPv4 ACL with a name string that is up to 31 alphanumeric characters in length. The name must start with an alphabetic character.
You can do the following with IP ACLs:
- Assign incoming packets to queues.
- Mirror or redirect incoming packets.
- Assign a data rate limit and bust size to incoming packets.
- Log the ACL actions.
- Apply a single IP ACL to one or more interfaces.
- Apply multiple ACLs to a single interface; The ACL sequence number determines the order of execution, and the first rule takes precedence.
- However, you cannot configure an IP ACL and a MAC ACL on the same interface.
After you attach an ACL rule to an interface, all traffic that is not specifically permitted by the ACL is denied access.
For more information, see the following support articles:
- What are access control lists (ACLs) and how do they work with my NETGEAR Smart Switch or fully managed switch?
- What are MAC access control lists (ACLs) and how do they work with my NETGEAR Smart Switch or fully managed switch?
- How do I configure access control lists (ACLs) on my NETGEAR Smart Switch or fully managed switch?
Last Updated:08/15/2025
|
Article ID: 21710