Chapter 9: Security Configuration Guide9 - 10SSR User Reference ManualFor IPX ACLs, the following fields can be specified:• Source network address• Destination network address• Source IPX socket• Destination IPX socketWhen defining an ACL rule, each field in the rule is position sensitive. For example,for TCP, the source address must be followed by the destination address, followed bythe source socket and the destination socket and so on. For example, the followingdescribes the syntax of a TCP ACL:acl name permit tcp source-addr dest-addr source-port dest-port tosNot all the fields are required. If a field is not specified, it is treated as don't care.However, since each field is position sensitive, it may be necessary to “skip” somefields in order to specify a value for another field. To skip a field, the keyword any isused. For example, the following rule denies SMTP traffic between any two hosts:acl nosmtp deny tcp any any smtp smtpNote that in the above example, the tos field (Type of Service) is not specified and istreated as don't care. The keyword any is needed only to skip a don't care field in orderto explicitly specify another field that is further down in the rule. If there are no otherfields to specify, the keyword any is not really needed. For example, the followingACL permits all IP traffic to go through:acl yesip permit ipThe Ordering of ACL rulesFor an ACL with multiple rules, the ordering of the rules is very important. When therouter looks at an ACL to determine whether a packet should be forwarded or not, itgoes through each rule in the ACL sequentially. When the router finds a rule thatmatches the packet, all subsequent rules are ignored. That is, a first match algorithm isused. The action defined by this ACL, to permit or deny, is used to forward or drop thepacket. There are no hidden or implied ordering of these rules. Nor is there precedenceattached to each field. The router simply goes down the list, one rule at a time untilthere is a match. Consequently, rules that are more specific (i.e. with more details)should always be listed ahead of rules that are less specific. For example, the followingACL permits all TCP traffic except those from subnet 10.2.0.0/16:acl 101 deny tcp 10.2.0.0/16 any any anyacl 101 permit tcp any any any any
