acl
interface/ethernet/switch/acl
Syscap: musicswitch
Type: Directory
Access Control List consists of ingress policy and egress policy engines and allows configuration of up to 128 policy rules (limited by RouterOS). It is an advanced tool for wire-speed packet filtering, forwarding, shaping, and modifying based on Layer2, Layer3, and Layer4 protocol header field conditions.
note
Due to hardware limitations, it is not possible to match broadcast/multicast traffic on specific ports. You should use port isolation, drop traffic on ingress ports, or use VLAN filtering to prevent certain broadcast/multicast traffic from being forwarded.
| Flag | Name | Description |
|---|---|---|
| X | disabled | |
| I | invalid |
| Argument | Type | Description |
|---|---|---|
| table | enum (ingress | egress) { ingress:0, egress:1 } | Selects the policy table for incoming or outgoing packets. |
| invert-match | bool | Inverts the whole ACL rule matching. |
| src-ports | multi { array-id } | Matching physical source ports or trunks. |
| dst-ports | multi { array-id } | Matching physical destination ports or trunks. It is not possible to match broadcast/multicast traffic on the egress port due to a hardware limitation. |
| service-vid | super { ! , service-vid: range [ .. 4095] } | Matching service VLAN ID. |
| service-pcp | num | Matching service PCP. |
| service-dei | num | Matching service DEI. |
| customer-vid | super { ! , customer-vid: range [ .. 4095] } | Matching customer VLAN ID. |
| customer-pcp | num | Matching customer PCP. |
| customer-dei | num | Matching customer DEI. |
| src-l3-port | super { ! , src-l3-port: range [ .. 65535] } | Matching Layer3 source port. |
| dst-l3-port | super { ! , dst-l3-port: range [ .. 65535] } | Matching Layer3 destination port. |
| custom-fields | object { custom-field: super { ! , custom-field: super { base: enum (start-of-frame | end-of-l2-header | end-of-l3-header) { start-of-frame:0, end-of-l2-header:1, end-of-l3-header:2 } , [offset] :num [ .. 127] , [range] :range [ .. 65535] , [mask] [ /num [ .. 65535]] } } } | |
| priority | num | Matching internal priority. Valid only in the egress table. |
| drop-precedence | enum (green | yellow | red | drop) | Matching internal drop precedence. Valid only in the egress table. |
| dst-addr-registered | bool | Defines whether to match packets with a registered state - packets whose destination MAC address is in UFDB/MFDB/RFDB. Valid only in the egress table. |
| service-tag | enum (untagged | priority-tagged | tagged | tagged-or-priority-tagged) { untagged:0, priority-tagged:1, tagged:2, tagged-or-priority-tagged:3 } | Format of the service tag. |
| customer-tag | enum (untagged | priority-tagged | tagged | tagged-or-priority-tagged) { untagged:0, priority-tagged:1, tagged:2, tagged-or-priority-tagged:3 } | Format of the customer tag. |
| mac-src-address | super { address: macAddr , [mask] [ /macAddr] } | Source MAC address and mask. |
| mac-dst-address | super { address: macAddr , [mask] [ /macAddr] } | Destination MAC address and mask. |
| mac-protocol | alt { protocol-name: enum (ip-or-ipv6 | non-ip) { ip-or-ipv6:0x10000, non-ip:0x10001 } , protocol-number: num [ .. 65535] } | Ethernet payload type (MAC-level protocol).
|
| lookup-vid | num | VLAN ID used in lookup. It can be changed before reaching the egress table. |
| ip-protocol | enum (tcp | udp | udp-lite | other) { tcp:0, udp:1, udp-lite:2, other:3 } | IP protocol type. |
| fragmented | bool | Whether to match fragmented packets. |
| first-fragment | bool | YES matches not fragmented and the first fragments, NO matches other fragments. |
| ttl | enum (0 | 1 | max | other) { 0:0, 1:1, max:2, other:3 } | Matching TTL field of the packet. |
| ip-dst | composite { address: ipAddr , netmask: [ num [ .. 32]] } | Matching destination IPv4 address. |
| ip-src | composite { address: ipAddr , netmask: [ num [ .. 32]] } | Matching source IPv4 address. |
| dscp | num | Matching DSCP field of the packet. |
| ecn | num | Matching ECN field of the packet. |
| ipv6-dst | ip6Prefix | Matching destination IPv6 address. |
| ipv6-src | ip6Prefix | Matching source IPv6 address. |
| mac-isolation-profile | enum (promiscuous | isolated | community1 | community2) { promiscuous:0, isolated:1, community1:2, community2:3 } | Matches isolation profile based on UFDB. Valid only in the egress policy table. |
| src-mac-addr-state | enum (sa-found | sa-not-found | dynamic-station-move | static-station-move) { sa-found:0, sa-not-found:1, dynamic-station-move:2, static-station-move:3 } | Defines whether to match packets with registered state - packets whose destination MAC address is in UFDB/MFDB/RFDB. Valid only in the egress policy table. |
| flow-id | num | |
| action | enum (forward | redirect-to-cpu | copy-to-cpu | send-to-new-dst-ports | drop) { forward:0, redirect-to-cpu:1, copy-to-cpu:2, send-to-new-dst-ports:3, drop:7 } | Action for matching ACL packets.
|
| new-dst-ports | multi { array-id } | If the action is send-to-new-dst-ports, then this property sets which ports/trunks are the new destinations. |
| new-flow-id | num | |
| attack-filter-bypass | bool | |
| ingress-vlan-filter-bypass | bool | Allows bypassing ingress VLAN filtering in the VLAN table for matching packets. This applies only to the ingress policy table. |
| egress-vlan-filter-bypass | bool | Allows bypassing egress VLAN filtering in the VLAN table for matching packets. This applies only to the ingress policy table. |
| isolation-filter-bypass | bool | Allows bypassing the Isolation table for matching packets. This applies only to the ingress policy table. |
| new-registered-state | bool | Whether to modify packet status. YES sets packet status to registered, NO - unregistered. Valid only in the ingress policy table. |
| src-mac-learn | bool | Whether to learn the source MAC of the matched ACL packets. Valid only in the ingress policy table. |
| mirror-to | enum (mirror0 | mirror1) { mirror0:0, mirror1:1 } | Mirroring destination for ACL packets. |
| new-service-vid | num | New service VLAN ID for ACL packets. |
| new-customer-vid | num | New customer VLAN ID for ACL packets. If set to 4095, then traffic is dropped. |
| egress-vlan-translate-bypass | bool | Allows bypassing the egress VLAN translation table for matching packets. |
| new-service-pcp | num | New service PCP for ACL packets. |
| new-service-dei | num | New service DEI for ACL packets. |
| new-customer-pcp | num | New customer PCP for ACL packets. |
| new-customer-dei | num | New customer DEI for ACL packets. |
| new-dscp | num | New DSCP for ACL packets. |
| new-priority | num | New internal priority for ACL packets. |
| new-drop-precedence | enum (green | yellow | red | drop) | New internal drop precedence for ACL packets. |
| policer | enum | Applied ACL Policer for ACL packets. |