Switch ACL

1. Introduction

This document describes frame filtering configuration and retrieval of status information.

2. ACL key types

The key that is generated for the VCAP IS2 lookup is configured per lookup and covers all ports. The key type decides which match parameters an ACE is able to use. The key types and the ACL rules are configured independently of each other, in any order, and an ACE which does not agree with the key type of its lookup cannot be hit and reports this in its status.

Three key types are configured independently, one per frame category: 'etype-key-type', 'ipv4-key-type' and 'ipv6-key-type'. All three default to 'acl-key-ext', the extended key, which supports the most match parameters at the cost of twice the TCAM space. An ACE selects the extended key with 'extended-key' in its 'lookup-params' container, which defaults to 'true' and therefore agrees with the default key type.

Let’s read the key types of lookup '0':

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-key-types/lookup[index='0']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-key-types/lookup"
  : index: 0
    etype-key-type: acl-key-ext
    ipv4-key-type: acl-key-ext
    ipv6-key-type: acl-key-ext

Let’s select the ETYPE key for IPv4 frames. An IPv4 ACE can then no longer be hit, so any IPv4 ACE in this lookup reports 'acl-status-inactive':

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-key-types/lookup"
  : index: 0
    ipv4-key-type: acl-key-etype

Let’s see that the key type is changed:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-key-types/lookup[index='0']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-key-types/lookup"
  : index: 0
    etype-key-type: acl-key-ext
    ipv4-key-type: acl-key-etype
    ipv6-key-type: acl-key-ext

3. ACL rule filtering

Access Control List

Advanced frame processing can be set up using the Access Control List (ACL) of the switch. Each rule in the list is called an Access Control Entry (ACE). For each frame received on an ingress port, the ACL is searched until an ACE matching the ingress port and frame properties is found. The action of the first matching ACE determines the forwarding of the frame. If no matching ACE is found, the default action (section 'Port ACL default actions') of the ingress port is used.

By default, the ACL is empty and the default port actions allow forwarding of frames.

An ACE is identified by two keys, 'lookup' and 'id'. The 'lookup' selects the VCAP IS2 lookup that the entry is programmed into, so the same 'id' can be used once per lookup. Lookup '0' is available on all targets, while the extended lookups '1' and '2' require a target with an extended VCAP. A frame is matched against every lookup, so an ACE in each lookup can match the same frame.

Within a lookup, the search order is given by the mandatory 'priority'. The lowest 'priority' value is searched first, and the value must be unique within the lookup - configuring an ACE with a 'priority' that is already in use is rejected.

The read-only 'status' reports whether the ACE can be hit at all. It is 'acl-status-inactive' when the ACE key does not agree with the key types of its lookup, for example when 'extended-key' does not match the configured key type, or when the frame type the ACE matches cannot be generated. See section 'ACL key types'.

An ACE is divided into two parts - the matching key and the action.
The matching key has the key the lookup must generate in the 'lookup-params' container, the common parameters in the 'common-match-params' container, and the parameters that are related to the frame type selected in the matching 'frame-…' container.
The action parameters are in the 'actions' container and are common, independent of the selected frame type.
Some parameters xxx have a related xxx-mask parameter. In this xxx-mask, any bit position with a '0' is matched as a 'don’t-care', meaning both '0' and '1' in this position generate a match.

The 'icl-acl-link' parameter in 'common-match-params' matches the ACL link number that an ingress classifier (ICL) action generates, which is how an ICL entry is linked to an ACE. It requires a target with ICL support, and with the default 'icl-acl-link-mask' of '0' any link number matches.

All parameters for an ACE can be found described in the mchp-velocitysp-acl2.yang file.

3.1. Check initial ACL rule list is empty

First, let’s see that the ACL rule list is empty:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : []

3.2. Add an ACE matching any frame

Let’s make a simple ACE that matches any frame received on a set of ports.
The ingress ports are '1' and '2'.

3.2.1. Forward action 'filtering'

An ACL with the forwarding action 'filtered' is meaning that the normal forwarding port mask is ANDed with the 'egress-port-list'. In this case the forwarding port mask is restricted to '3'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 1
    priority: 1
    ingress-port-list:
    - '1'
    - '2'
    common-match-params: {}
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '3'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='1']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 1
    priority: 1
    ingress-port-list:
    - '1'
    - '2'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '3'
      enable: ''
      policer-index: 0

3.2.2. Forward action 'redirect'

An ACL with the forwarding action 'redirect' is meaning that the normal forwarding port mask is replaced with the 'egress-port-list'. In this case the forwarding port mask is set to '3'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 1
    priority: 1
    ingress-port-list:
    - '1'
    - '2'
    common-match-params: {}
    frame-any:
      any:
      -
    actions:
      forwarding: redirect
      egress-port-list:
      - '3'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='1']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 1
    priority: 1
    ingress-port-list:
    - '1'
    - '2'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: redirect
      egress-port-list:
      - '3'
      enable: ''
      policer-index: 0

3.3. Add an ACE matching a specific MAC

Let’s make an ACE that matches any frame type received on a specific port with a specific SMAC. The frame will have two egress ports as possible forwarding ports.

The ingress port is '1'.
The SMAC is 00-00-00-00-00-01. It is an exact match as the smac-mask is all '1'.
The possible egress ports are '2' and '3'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 2
    priority: 2
    ingress-port-list:
    - '1'
    common-match-params:
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      - '3'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='2']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 2
    priority: 2
    ingress-port-list:
    - '1'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      - '3'
      enable: ''
      policer-index: 0

3.4. Add an ACE matching a specific frame type

Matching on frame types that are not IPV4/IPV6.

The ingress port is '2'.
The SMAC is 00-00-00-00-00-01.
The frame type is ARP (Address Resolution Protocol) - value 0x0806 or 2056
The possible egress ports are '1' and '3'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 3
    priority: 3
    ingress-port-list:
    - '2'
    common-match-params:
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
    frame-etype:
      etype: 2054
      etype-mask: 65535
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '3'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='3']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 3
    priority: 3
    ingress-port-list:
    - '2'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-etype:
      etype: 2054
      etype-mask: 65535
      data: 0
      data-mask: 0
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '3'
      enable: ''
      policer-index: 0

3.5. Add an ACE matching an IPv4 NOT UDP/TCP frame

When not matching on UDP/TCP:
The TCP and UDP sport/dport range is ignored.
It is possible to match on IP data value.

The ingress port is '3'.
The IPv4 SIP is 1.2.3.4/16.
The possible egress ports are '1' and '2'.
The IP protocol is IGMP - protocol value 2
IP data value is 1234.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 4
    priority: 4
    ingress-port-list:
    - '3'
    common-match-params: {}
    frame-ipv4:
      proto: 2
      proto-mask: 255
      sip: 1.2.3.4/16
      data: 1234
      data-mask: 4294967295
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '2'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='4']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 4
    priority: 4
    ingress-port-list:
    - '3'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-ipv4:
      fragment: any
      options: any
      sip: 1.2.3.4/16
      dip: 0.0.0.0/0
      ttl: any
      proto: 2
      proto-mask: 255
      ds: 0
      ds-mask: 0
      data: 1234
      data-mask: 4294967295
      sport-min: 0
      sport-max: 0
      dport-min: 0
      dport-max: 0
      tcp-fin: any
      tcp-syn: any
      tcp-rst: any
      tcp-psh: any
      tcp-ack: any
      tcp-urg: any
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '2'
      enable: ''
      policer-index: 0

3.6. Add an ACE matching an IPv4 UDP frame

When matching on UDP:
The SPORT/DPORT range must be given or it is only matching in SPORT/DPORT value '0'.
It is NOT possible to match on IP data value.

The ingress port is '1'.
The IPv4 SIP is 1.2.3.4/16.
The UDP SPORT range is 10-20.
The UDP DPORT range is 30-40.
The possible egress ports are '2' and '3'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 5
    priority: 5
    ingress-port-list:
    - '1'
    common-match-params: {}
    frame-ipv4:
      proto: 17
      proto-mask: 255
      sip: 1.2.3.4/16
      sport-min: 10
      sport-max: 20
      dport-min: 30
      dport-max: 40
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      - '3'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='5']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 5
    priority: 5
    ingress-port-list:
    - '1'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-ipv4:
      fragment: any
      options: any
      sip: 1.2.3.4/16
      dip: 0.0.0.0/0
      ttl: any
      proto: 17
      proto-mask: 255
      ds: 0
      ds-mask: 0
      data: 0
      data-mask: 0
      sport-min: 10
      sport-max: 20
      dport-min: 30
      dport-max: 40
      tcp-fin: any
      tcp-syn: any
      tcp-rst: any
      tcp-psh: any
      tcp-ack: any
      tcp-urg: any
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      - '3'
      enable: ''
      policer-index: 0

3.7. Add an ACE matching an IPv4 TCP frame

When matching on TCP:
The SPORT/DPORT range must be given or it is only matching in SPORT/DPORT value '0'.
It is NOT possible to match on IP data value.

The ingress port is '2'.
The IPv4 SIP is 1.2.3.4/16.
The UDP SPORT range is 10-20.
The UDP DPORT range is 30-40.
The possible egress ports are '1' and '3'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 6
    priority: 6
    ingress-port-list:
    - '2'
    common-match-params: {}
    frame-ipv4:
      proto: 6
      proto-mask: 255
      sip: 1.2.3.4/16
      sport-min: 10
      sport-max: 20
      dport-min: 30
      dport-max: 40
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '3'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='6']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 6
    priority: 6
    ingress-port-list:
    - '2'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-ipv4:
      fragment: any
      options: any
      sip: 1.2.3.4/16
      dip: 0.0.0.0/0
      ttl: any
      proto: 6
      proto-mask: 255
      ds: 0
      ds-mask: 0
      data: 0
      data-mask: 0
      sport-min: 10
      sport-max: 20
      dport-min: 30
      dport-max: 40
      tcp-fin: any
      tcp-syn: any
      tcp-rst: any
      tcp-psh: any
      tcp-ack: any
      tcp-urg: any
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '3'
      enable: ''
      policer-index: 0

3.8. Add an ACE matching a specific classified VID/PCP in a Tagged frame

The ingress port is '3'.
The Classified VID is 200.
The Classified PCP is 4.
The possible egress ports are '1' and '2'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 7
    priority: 7
    ingress-port-list:
    - '3'
    common-match-params:
      tagged: one
      vid: 200
      vid-mask: 4095
      pcp: 4
      pcp-mask: 7
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '2'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='7']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 7
    priority: 7
    ingress-port-list:
    - '3'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: one
      vid: 200
      vid-mask: 4095
      pcp: 4
      pcp-mask: 7
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '2'
      enable: ''
      policer-index: 0

3.9. Add an ACE matching an Un-Tagged frame

The ingress port is '3'.
The possible egress ports are '1' and '2'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 8
    priority: 8
    ingress-port-list:
    - '3'
    common-match-params:
      tagged: zero
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '2'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='8']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 8
    priority: 8
    ingress-port-list:
    - '3'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: zero
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '1'
      - '2'
      enable: ''
      policer-index: 0

3.10. Add an ACE matching a specific MAC and dropping it

If the forwarding type is filter and the egress-port-list is empty, the frame is dropped.

The ingress port is '1'.
The SMAC is 00-00-00-00-00-01.
The possible egress ports are none.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 9
    priority: 9
    ingress-port-list:
    - '1'
    common-match-params:
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list: []

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='9']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 9
    priority: 9
    ingress-port-list:
    - '1'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      enable: ''
      policer-index: 0

3.11. Add an ACE matching a specific MAC and policing it

The actions an ACE applies are selected by the bits of its 'enable' parameter: an action is only applied to a matching frame when its bit is set. The bits are 'policer' and 'mirror'.
An ACE can point to an ACL policer as an action, by setting the 'policer' bit of 'enable' and naming the policer in 'policer-index'.

The reference and the policer are configured independently. An ACE may name a policer that does not exist yet, a policer may be created before or after the ACEs that name it, and either may be deleted while the other remains. No order is enforced and nothing is rejected on account of the order, which keeps the two lists free of ordering rules.

An ACE with the 'policer' bit of 'enable' set and whose 'policer-index' names a policer that has not been created discards every frame it matches. Such a policer has never been given a rate, and its rate reads as zero, so nothing is allowed through it. This is deliberate: a mismatch between the ACEs and the policer list shows up immediately as lost traffic, rather than as traffic that quietly passes unpoliced. When policing stops behaving as expected, check that every 'policer-index' in use names a policer that exists.

A policer that was created and then deleted while an ACE still names it behaves almost the same, but not exactly: the delete leaves the rate at zero and the burst capacity in place, so the burst is still forwarded and only the traffic behind it is policed away. Deleting a policer is therefore not a way to stop the traffic of the ACEs that name it; clear the 'policer' bit of 'enable' or delete the ACE for that.

The example below creates the policer first.
The policer index is 0.
The Frame Rate is 1000 frames/s.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-policers/policer-list"
  : index: 0
    frame-rate: 1000

Let’s see that the ACL policer is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-policers/policer-list[index='0']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-policers/policer-list"
  : index: 0
    frame-rate: 1000

Now we create the ACE that points to the ACL policer.

The ingress port is '1'.
The SMAC is 00-00-00-00-00-01.
No forwarding filtering.
The ACL police index is '0'.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 10
    priority: 10
    ingress-port-list:
    - '1'
    common-match-params:
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
    frame-any:
      any:
      -
    actions:
      forwarding: none
      enable: policer
      policer-index: 0

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='10']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 10
    priority: 10
    ingress-port-list:
    - '1'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-01
      smac-mask: FF-FF-FF-FF-FF-FF
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: none
      enable: policer
      policer-index: 0

3.12. Add an ACE matching a range of destination MACs

Let’s make an ACE that matches any frame type received on a specific port with a range of DMACs. The frame will have two egress ports as possible forwarding ports.

The ingress port is '1'.
The DMAC range is 00-00-00-00-00-01 to 00-00-00-00-00-FF.
The possible egress ports are '2' and '3'.

NOTE that the dmac-mask has the value '01' in the least significant byte. Bit '0' means don’t-care, so the least significant bit must be '1' and all other bits are don’t-care. The DMAC 00-00-00-00-00-00 does not match.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 11
    priority: 11
    ingress-port-list:
    - '1'
    common-match-params:
      dmac: 00-00-00-00-00-01
      dmac-mask: FF-FF-FF-FF-FF-01
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      - '3'

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='11']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 11
    priority: 11
    ingress-port-list:
    - '1'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-01
      dmac-mask: FF-FF-FF-FF-FF-01
      smac: 00-00-00-00-00-00
      smac-mask: 00-00-00-00-00-00
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      - '3'
      enable: ''
      policer-index: 0

3.13. Add an ACE with an explicit priority and mirroring

The examples above leave 'priority' equal to the ACE 'id'. Let’s add an ACE that is searched after all of them by giving it a higher 'priority' value, and let it copy the matching frames to the port configured as mirror monitor with the 'mirror' bit of 'enable'. The response also shows the read-only 'status', which is 'acl-status-active' because the ACE key agrees with the key types of the lookup:

Mirroring is not configured by the ACL: a port must have been given the Mirroring 'Monitor' role with 'eth-mirror/config/monitor', and a switch has at most one such port. When no 'Monitor' port is configured, the frames copied by the 'mirror' bit have nowhere to go and are discarded. See the Mirroring guide for how to give a port that role.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 20
    priority: 100
    ingress-port-list:
    - '1'
    common-match-params:
      smac: 00-00-00-00-00-02
      smac-mask: FF-FF-FF-FF-FF-FF
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      enable: mirror

Let’s see that the ACL rule list is created:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='20']"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list"
  : lookup: 0
    id: 20
    priority: 100
    ingress-port-list:
    - '1'
    status: acl-status-active
    rx-count: 0
    lookup-params:
      extended-key: true
    common-match-params:
      icl-acl-link: 0
      icl-acl-link-mask: 0
      dmac: 00-00-00-00-00-00
      dmac-mask: 00-00-00-00-00-00
      smac: 00-00-00-00-00-02
      smac-mask: FF-FF-FF-FF-FF-FF
      tagged: any
      vid: 0
      vid-mask: 0
      pcp: 0
      pcp-mask: 0
      dei: any
    frame-any:
      any:
      -
    actions:
      forwarding: filter
      egress-port-list:
      - '2'
      enable: mirror
      policer-index: 0

3.14. Read the ACE RX counter

When there is a match on an ACE, the related RX counter is incremented.

Let’s read the RX counter of the ACE with id 1 in lookup 0:

FETCH request message:

- "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='1']/rx-count"

FETCH response message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list/rx-count"
  : 0

3.15. Clear the ACE RX counter

The ACE related RX counter can be cleared.

Let’s clear the RX counter of the ACE with id 1 in lookup 0:

POST request message:

- ? "/mchp-velocitysp-acl2:acl/acl-rules/rule-list[lookup='0'][id='1']/clear"
  :

4. Port ACL default actions

Port based Access Control

Per port, there is a default action used if no ACE is matching in the ACL. The possible actions are an egress port list, a policer pointer and copying the frame to the port configured as mirror monitor. The action parameters are the same as the ones in the 'actions' container of an ACE.

4.1. Check initial default actions

Verify that by default, no actions are active.
When forwarding is none, it means "No frame forwarding change."

The interface (port) name is '1'.

FETCH request message:

- "/ietf-interfaces:interfaces/interface[name='1']/\
   mchp-velocitysp-acl2:acl-port/actions"

FETCH response message:

- ? "/ietf-interfaces:interfaces/interface/mchp-velocitysp-acl2:acl-port/\
     actions"
  : forwarding: none
    enable: ''
    policer-index: 0

4.2. Enable forwarding to a port list

Configure the default action to forward to a list of ports.

The interface (port) name is '1'.
The possible egress ports are '2' and '3'.

iPATCH request message:

- ? "/ietf-interfaces:interfaces/interface[name='1']/\
     mchp-velocitysp-acl2:acl-port/actions"
  : forwarding: filter
    egress-port-list:
    - '2'
    - '3'

Let’s see that the Port ACL is changed:

FETCH request message:

- "/ietf-interfaces:interfaces/interface[name='1']/\
   mchp-velocitysp-acl2:acl-port/actions"

FETCH response message:

- ? "/ietf-interfaces:interfaces/interface/mchp-velocitysp-acl2:acl-port/\
     actions"
  : forwarding: filter
    egress-port-list:
    - '2'
    - '3'
    enable: ''
    policer-index: 0

4.3. Disable forwarding

Configure the default action to disable forwarding from the port.

The interface (port) name is '1'.
The possible egress ports list is empty.

iPATCH request message:

- ? "/ietf-interfaces:interfaces/interface[name='1']/\
     mchp-velocitysp-acl2:acl-port/actions"
  : forwarding: filter
    egress-port-list: []

Let’s see that the Port ACL is changed:

FETCH request message:

- "/ietf-interfaces:interfaces/interface[name='1']/\
   mchp-velocitysp-acl2:acl-port/actions"

FETCH response message:

- ? "/ietf-interfaces:interfaces/interface/mchp-velocitysp-acl2:acl-port/\
     actions"
  : forwarding: filter
    enable: ''
    policer-index: 0

4.4. Enable policing

Configure the default action to point to a policer.

A port default action names a policer exactly as an ACE does, and the same applies: the reference and the policer are configured in any order, and a default action naming a policer that has not been created discards every frame that reaches it. See [acl-policer-reference].

The example below creates the policer first.
The policer index is 1.
The Frame Rate is 1000 frames/s.

iPATCH request message:

- ? "/mchp-velocitysp-acl2:acl/acl-policers/policer-list"
  : index: 1
    frame-rate: 1000

Now we configure the default action to point to the ACL policer.

The interface (port) name is '1'.
The possible egress ports are '2' and '3'.
The policer index is 1.

iPATCH request message:

- ? "/ietf-interfaces:interfaces/interface[name='1']/\
     mchp-velocitysp-acl2:acl-port/actions"
  : forwarding: filter
    egress-port-list:
    - '2'
    - '3'
    enable: policer
    policer-index: 1

Let’s see that the Port ACL is changed:

FETCH request message:

- "/ietf-interfaces:interfaces/interface[name='1']/\
   mchp-velocitysp-acl2:acl-port/actions"

FETCH response message:

- ? "/ietf-interfaces:interfaces/interface/mchp-velocitysp-acl2:acl-port/\
     actions"
  : forwarding: filter
    egress-port-list:
    - '2'
    - '3'
    enable: policer
    policer-index: 1

4.5. Read the RX counter

When the default action is used, the related RX counter is incremented.

FETCH request message:

- "/ietf-interfaces:interfaces/interface[name='1']/\
   mchp-velocitysp-acl2:acl-port/rx-count"

FETCH response message:

- ? "/ietf-interfaces:interfaces/interface/mchp-velocitysp-acl2:acl-port/\
     rx-count"
  : 0

4.6. Clear the RX counter

The default action RX counter can be cleared.

POST request message:

- ? "/ietf-interfaces:interfaces/interface[name='1']/\
     mchp-velocitysp-acl2:acl-port/clear"
  :