Features common to all ACL applications

  • Any ACL can have multiple entries (ACEs).

  • You can apply any one ACL to multiple interfaces.

  • All ACEs in an ACL configured on the switch are automatically sequenced (numbered). For an existing ACL, entering an ACE without specifying a sequence number automatically places the ACE at the end of the list. Specifying a sequence number inserts the ACE into the list at the specified sequential location.

    • Automatic sequence numbering begins with "10" and increases in increments of 10. You can renumber the ACEs in an ACL and also change the sequence increment between ACEs.

    • The CLI remark command option allows you to enter a separate comment for each ACE.

  • A source or destination IPv6 address and a prefix length, together, can define a single host, a range of hosts, or all hosts.

  • Every ACL populated with one or more explicit ACEs automatically includes an implicit deny as the last entry in the list. The switch applies this action to packets that do not match other criteria in the ACL.

  • In any ACL, you can apply an ACL log function to ACEs that have an explicit "deny" or “permit” action. (The logging occurs when there is a match on a "deny" or “permit” ACE that includes the log keyword.) The switch sends ACL logging output to syslog, if configured, and optionally, to a console session.

You can create ACLs for the switch configuration using either the CLI or a text editor. The text-editor method is recommended when you plan to create or modify an ACL that has more entries than you can easily enter or edit using the CLI alone.