SmartSwitch Router User Reference Manual 171Chapter 10: Security Configuration Guide• Type of Service (TOS)For IPX ACLs, the following fields can be specified:• Source network address• Destination network address• Source IPX socket• Destination IPX socketWhen defining an ACL rule, each field in the rule is position sensitive. For example, forTCP, the source address must be followed by the destination address, followed by thesource socket and the destination socket and so on. For example, the following describesthe syntax of a TCP ACL:Not all the fields are required. If a field is not specified, it is treated as don't care. However,since each field is position sensitive, it may be necessary to “skip” some fields in order tospecify a value for another field. To skip a field, the keyword any is used. For example, thefollowing rule denies SMTP traffic between any two hosts:Note that in the above example, the tos field (Type of Service) is not specified and istreated as don't care. The keyword any is needed only to skip a don't care field in order toexplicitly specify another field that is further down in the rule. If there are no other fieldsto specify, the keyword any is not really needed. For example, the following ACL permitsall IP traffic to go through:Ordering of ACL RulesFor an ACL with multiple rules, the ordering of the rules is very important. When therouter looks at an ACL to determine whether a packet should be forwarded or not, it goesthrough each rule in the ACL sequentially. When the router finds a rule that matches thepacket, all subsequent rules are ignored. That is, a first match algorithm is used. Theaction defined by this ACL, to permit or deny, is used to forward or drop the packet. Thereare no hidden or implied ordering of these rules. Nor is there precedence attached to eachfield. The router simply goes down the list, one rule at a time until there is a match.Consequently, rules that are more specific (i.e. with more details) should always be listedacl name permit tcp source-addr dest-addr source-port dest-port tosacl nosmtp deny tcp any any smtp smtpacl yesip permit ip
