ACL Match/Action Matrix
The Access Control List (ACL) match/action matrix defines the conditions a packet must meet (the "match") and the resulting behavior applied to that traffic (the "action"). The tables below outline the match/action support available for user-defined, Layer-2, and Multi-field Classifer ACLs.
User-Defined L3v4 ACL
Match Criteria
| User-Defined L3v4 ACL Match | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge 4q, 1q, NAT 4q, NAT 1q) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
destination-ipv4-local |
Yes |
Yes |
Yes |
Yes |
Yes |
destination-ipv4-prefix |
Yes |
Yes |
Yes |
Yes |
Yes |
destination-ipv4-prefix-list |
Yes |
Yes |
Yes |
Yes |
Yes |
destination-l4-port |
Yes |
Yes |
Yes |
Yes |
Yes |
direction egress |
No |
No |
No |
No |
No |
direction ingress |
Yes |
Yes |
Yes |
Yes |
Yes |
instance |
Yes |
Yes |
Yes |
Yes* |
No |
interface |
No |
No |
No |
No |
No |
ip-options |
No |
Yes |
Yes |
No |
Yes |
ip-protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
ipv4-dscp |
Yes |
Yes |
Yes |
Yes |
Yes |
ipv4-tos |
Yes |
Yes |
Yes |
Yes |
Yes |
l2tp-ppp-lcp |
No |
Yes |
No |
No |
No |
logical-interface |
Yes |
Yes |
Yes |
Yes |
Yes |
match-mpls-traffic |
No |
No |
No |
No |
Yes |
source-ipv4-prefix |
Yes |
Yes |
Yes |
Yes |
Yes |
source-ipv4-prefix-list |
Yes |
Yes |
Yes |
Yes |
Yes |
source-l4-port |
Yes |
Yes |
Yes |
Yes |
Yes |
tcp-control |
Yes |
Yes |
Yes |
Yes |
No |
traffic-class |
No |
Yes |
Yes |
No |
No |
ttl |
No |
No |
No |
No |
Yes |
* The match criteria |
|||||
Action Matrix
| User-Defined L3v4 ACL Action | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge 4q, 1q, NAT 4q, NAT 1q) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
capture |
No |
No |
No |
No |
No |
drop |
Yes |
Yes |
Yes |
Yes |
Yes |
forward-class |
Yes* |
Yes |
Yes |
Yes* |
Yes |
mirror |
No |
Yes |
Yes |
No |
Yes |
permit |
Yes |
Yes |
Yes |
Yes |
Yes |
policer-name |
Yes |
Yes |
Yes |
Yes |
Yes |
redirect-to-cpu |
Yes |
Yes |
Yes |
Yes |
Yes |
remark-codepoint |
No |
Yes |
Yes |
No |
No |
statistics |
Yes |
Yes |
Yes |
Yes |
Yes |
traffic-sample |
Yes |
Yes |
Yes |
Yes |
No |
trap |
Yes |
Yes |
Yes |
Yes |
Yes |
* The action |
|||||
User-Defined L3v6 ACL
Match Criteria
| User-Defined L3v6 ACL Match | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge) |
S9500-22XST (QAX Multiservice Edge) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|---|
destination-ipv6-local |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
destination-ipv6-prefix |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
destination-ipv6-prefix-list |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
destination-l4-port |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
direction egress |
No |
No |
No |
No |
No |
No |
direction ingress |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
interface |
No |
Yes |
Yes |
No |
No |
No |
ip-protocol |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
ipv6-tc |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
logical-interface |
Yes |
No |
No |
Yes |
No |
No |
source-ipv6-prefix |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
source-ipv6-prefix-list |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
source-l4-port |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
traffic-class |
No |
No |
No |
No |
No |
Yes |
Action Matrix
| User-Defined L3v6 ACL Action | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
capture |
No |
No |
No |
No |
No |
drop |
Yes |
Yes |
Yes |
Yes |
Yes |
forward-class |
Yes* |
Yes |
Yes |
Yes* |
Yes |
mirror |
No |
No |
No |
No |
Yes |
permit |
Yes |
Yes |
Yes |
Yes |
Yes |
policer-name |
Yes |
Yes |
Yes |
Yes |
Yes |
redirect-to-cpu |
Yes |
Yes |
Yes |
Yes |
Yes |
statistics |
Yes |
Yes |
Yes |
Yes |
Yes |
traffic-sample |
Yes |
Yes |
Yes |
Yes |
No |
* The action |
|||||
L2 ACL
Match Criteria
| L2 ACL Match | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
destination-mac |
Yes |
Yes |
Yes |
Yes |
Yes |
direction egress |
No |
No |
No |
No |
No |
direction ingress |
Yes |
Yes |
Yes |
Yes |
Yes |
ethertype |
Yes |
Yes |
Yes |
Yes |
Yes |
inner-tag-protocol-id |
No |
No |
No |
No |
Yes |
inner-vlan |
Yes |
Yes |
Yes |
Yes |
Yes |
inner-vlan-cfi |
No |
No |
No |
No |
Yes |
inner-vlan-priority |
No |
No |
No |
No |
Yes |
interface |
Yes |
Yes |
Yes |
Yes |
Yes |
interface-meta-data |
Yes |
Yes |
Yes |
Yes |
No |
logical-interface |
Yes |
Yes |
Yes |
Yes |
Yes |
outer-tag-protocol-id |
No |
No |
No |
No |
Yes |
outer-vlan |
Yes |
Yes |
Yes |
Yes |
Yes |
outer-vlan-cfi |
No |
No |
No |
No |
Yes |
outer-vlan-priority |
No |
No |
No |
No |
Yes |
service-inner-vlan-priority |
Yes |
No |
No |
Yes |
No |
service-outer-vlan-priority |
Yes |
No |
No |
Yes |
No |
source-mac |
Yes |
Yes |
Yes |
Yes |
Yes |
traffic-class |
No |
No |
No |
No |
Yes |
Action Matrix
| L2 ACL Action | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
capture |
No |
No |
No |
No |
No |
drop |
Yes |
No |
Yes |
Yes |
Yes |
forward-class |
Yes |
Yes |
Yes |
Yes |
Yes |
mirror |
Yes |
Yes |
Yes |
No |
Yes |
permit |
Yes |
Yes |
Yes |
Yes |
Yes |
policer-name |
Yes |
Yes |
Yes |
Yes |
Yes |
redirect-to-cpu |
Yes |
Yes |
Yes |
Yes |
Yes |
statistics |
Yes |
Yes |
Yes |
Yes |
Yes |
traffic-sample |
Yes |
Yes |
Yes |
Yes |
Yes |
Multifield Classifier (MF) L3v4 ACL
Match Criteria
| MF L3v4 ACL Match | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge 4q, 1q, NAT 4q, NAT 1q) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
destination-ipv4-prefix |
Yes |
No |
Yes |
Yes |
No |
destination-ipv4-prefix-list |
Yes |
No |
Yes |
Yes |
No |
destination-l4-port |
Yes |
No |
Yes |
Yes |
No |
direction egress |
No |
No |
No |
No |
No |
direction ingress |
Yes |
No |
Yes |
Yes |
No |
forward-class |
No |
No |
Yes |
No |
No |
ip-protocol |
No |
No |
Yes |
No |
No |
ipv4-dscp |
Yes |
No |
Yes |
Yes |
No |
ipv4-tos |
Yes |
No |
Yes |
Yes |
No |
mpls-traffic |
No |
No |
No |
No |
No |
source-ipv4-prefix |
Yes |
No |
Yes |
Yes |
No |
source-ipv4-prefix-list |
Yes |
No |
Yes |
Yes |
No |
source-l4-port |
Yes |
No |
Yes |
Yes |
No |
Action Matrix
| MF L3v4 ACL Action | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge 4q, 1q, NAT 4q, NAT 1q) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
forward-class |
Yes |
No |
Yes |
Yes |
No |
remark-codepoint |
Yes |
No |
Yes |
Yes |
No |
remark-dscp-codepoint |
Yes |
No |
No |
Yes |
No |
Multifield Classifier (MF) L3v6 ACL
Match Criteria
| MF L3v6 ACL Match | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge 4q,1q, NAT 4q, NAT 1q) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
destination-ipv6-prefix |
Yes |
No |
Yes |
Yes |
No |
destination-ipv6-prefix-list |
Yes |
No |
Yes |
Yes |
No |
destination-l4-port |
Yes |
No |
Yes |
Yes |
No |
direction egress |
No |
No |
No |
No |
No |
direction ingress |
Yes |
No |
Yes |
Yes |
No |
forward-class |
No |
No |
No |
No |
No |
ip-protocol |
No |
No |
Yes |
No |
No |
ipv6-tc |
Yes |
No |
Yes |
Yes |
No |
mpls-traffic |
No |
No |
No |
No |
No |
source-ipv6-prefix |
Yes |
No |
Yes |
Yes |
No |
source-ipv6-prefix-list |
Yes |
No |
Yes |
Yes |
No |
source-l4-port |
Yes |
No |
Yes |
Yes |
No |
Action Matrix
| MF L3v6 ACL Action | S9600-72XC /
S9600-102XC /
AGR420 (Q2C Access Leaf) |
S9600-32X /
AGR400 (Q2C Spine) |
S9510-28DC /
CSR440 (Q2A Multiservice Edge) |
S9600-72XC /
S9600-102XC /
S9610-46DX /
AGR420 (Q2C Multiservice Edge 4q,1q, NAT 4q, NAT 1q) |
S9500-22XST (QAX L2 Wholesale (L2BSA)) |
|---|---|---|---|---|---|
forward-class |
Yes |
No |
Yes |
Yes |
No |
remark-codepoint |
Yes |
No |
Yes |
Yes |
No |
remark-dscp-codepoint |
Yes |
No |
No |
Yes |
No |