Access Lists Tab

Configuration > Templates & Policies > Policies > ACLs > Access Lists

This tab lists the configured Access Control List (ACL) rules. An ACL is a reusable MATCH criteria for filtering flows. It is associated with an action: permit or deny. An ACL can be a MATCH condition in more than one policy—Route, QoS, or Optimization.

Click the edit icon to make add, delete, or modify rules to your ACLs.

Match Criteria

• These are universal across all policy maps—Route, QoS, Optimization, NAT (Network Address Translation), and Security.

• If you expect to use the same match criteria in different maps, you can create an ACL (Access Control List), which is a named, reusable set of rules. For efficiency, create them in Configuration > Templates & Policies > ACLs > Access Lists, and apply them across appliances.

• The available parameters are Application, Address Map (for sorting by country, IP address owner, or SaaS application), Domain, Geo Location, Interface, Protocol, DSCP, IP/Subnet, Port, Traffic Behavior Overlay, Fabric or Internet, and User Role (the User Role as specified in the authentication exchange with the ClearPass RADIUS server).

  NOTE: User Role options include the RADIUS User Role, User Name, User Group, User Device, or User MAC. Configuring User Role match criteria enables an EdgeConnect to automatically assign traffic steering and firewall zone policies.

  NOTE: Additional attributes under the Address Map parameter can be used as match criteria. These attributes are secondary parameters to the address map, so the attributes are evaluated for a policy match only when the configured address map parameter matches the flow. To configure these attributes, click +Attributes.

• To specify different criteria for inbound versus outbound traffic, select the Source:Dest check box.

  NOTE: Source and destination role-based policies can be configured when both source and destination users are in the same network.

Wildcard-based Prefix Matching Rules

• Even when using a range or a wildcard, the IPv4 address must be specified in the 4-octet format, separated by the dot notation. For example, A.B.C.D.

• Range is specified using a single dash. For example, 128-129.

• Wildcard is specified as an asterisk (*).

• Range and Wildcard can both be used in the same address, but an octet can only contain one or the other. For example, 10.136-137.*.64-95.

• A wildcard can only be used to define an entire octet. For example, 10.13*.*.64-95 is not supported. Use 10.130-139.*.64-95 to specify this range.

• The same rules apply to IPv6 addressing.

• CIDR notation and (Range or Wildcard) are mutually exclusive in the same address. For example, 192.168.0.1-127/24 is not supported. Use either 192.168.0.0/24 or 192.168.0.1-127.

• These prefix-matching rules apply to the following policies only: Route, QoS, Optimization, NAT, Security, and ACLs.

Access Lists Edit Row

The Access Lists dialog box lists the configured Access Control List (ACL) rules.

You can add, delete, or rename an ACL by clicking the buttons at the top of this dialog box. You can also add rules to an ACL.

1. Click Add Rule.

2. Enter a priority value.

3. Click the edit icon to configure the match criteria. The Match Criteria dialog box opens and you can specify the match criteria. Click More Options to apply more rules.

4. Select if you want to Permit or Deny traffic in the ACL.

5. Enter any comments if you decide to do so.

---