Arista EOS ACLs: IPv4, MAC ACLs and Counters

EOS ships three ACL flavours (standard, IPv4/IPv6 and MAC) that all behave like the industry-standard syntax, but the operational differences matter: counters are not enabled by default on most platforms, egress ACLs have their own TCAM and resource-sharing rules, and MAC ACLs are the only way to filter non-IP traffic. This guide covers writing the lists, attaching them, getting visibility into which rule is actually matching, and the platform caveats that decide whether a rule is installed at all.

ACL types and where they live

• Standard ACL – filters on source address only, created in standard-ACL configuration mode.
• IPv4 / IPv6 ACL – matches addresses, protocols, ports, TTL, VLAN and flags; created in ACL configuration mode.
• MAC ACL – matches the layer-2 header (source/destination MAC, EtherType, PCP, VLAN) and is the tool for filtering ARP, LLDP or non-IP protocols.

An entry created in one mode cannot be modified in another, and every list implicitly denies everything that is not permitted unless you end with permit ip any any.

Writing IPv4 and MAC ACLs with counters

switch(config)# ip access-list ACL1
switch(config-acl-ACL1)# counters per-entry
switch(config-acl-ACL1)# 10 permit tcp 10.10.10.0/24 any eq 443
switch(config-acl-ACL1)# 20 permit tcp 10.10.10.0/24 any eq 80 log
switch(config-acl-ACL1)# 30 deny ip 10.10.10.0/24 any
switch(config-acl-ACL1)# 40 permit ip any any
switch(config-acl-ACL1)# exit

switch(config)# mac access-list MGMT_FILTER
switch(config-mac-acl-MGMT_FILTER)# 10 permit any any 0x0806
switch(config-mac-acl-MGMT_FILTER)# 20 deny any any 0x0800
switch(config-mac-acl-MGMT_FILTER)# exit

Per-entry counters are the difference between guessing and knowing. Without counters per-entry, most non-Trident platforms simply do not count matches, and show ip access-list shows nothing useful. Real sequence numbers let you insert rules later without rewriting the list – avoid relying on implicit 10/20/30 ordering when you know the policy will grow.

Applying ACLs to interfaces and SVIs

switch(config)# interface Ethernet1
switch(config-if-Et1)# ip access-group ACL1 in
switch(config-if-Et1)# mac access-group MGMT_FILTER in
switch(config-if-Et1)# exit

switch(config)# interface Vlan100
switch(config-if-Vl100)# ip access-group ACL_OUT out

Ingress IPv4 and IPv6 PACLs are broadly supported; egress IPv4/IPv6 PACLs are supported by default on current EOS releases but consume a separate TCAM region and may need resource sharing. Egress IPv6 counters do not work in unshared mode – you must enable sharing with hardware access-list resource sharing vlan ipv6 out for the counters to move.

Reading hits and clearing counters

switch# show ip access-lists ACL1
switch# show mac access-lists
switch# show ip access-lists ACL1 counters
switch(config)# clear ip access-list counters ACL1 session

The session keyword clears only what your CLI session sees, which is useful when several engineers are chasing the same problem. Note the aggregate drop counter (EgressAclDropCounter) that appears in the output – it is the implicit deny, and a fast-incrementing implicit deny usually means a missing permit rather than an actual attack.

TCAM and verification pitfalls

• ACLs are compiled into TCAM in platform-specific widths; a list that is correct but too wide for the configured profile partially installs – check with the platform TCAM show commands.
• IPv6 ACLs silently install four ICMPv6 neighbour-discovery permits so that ND still works; do not count on an IPv6 ACL to block all ICMPv6.
• log on a high-rate rule can flood syslog; prefer counters plus a periodic poll for steady-state policy, and logging only on the deny you actually expect to see.
• Verify the direction: an ACL attached in on a port never sees traffic arriving from the switch's own control plane.

ACLs are one half of a switch hardening story; the AAA side is covered in Arista EOS AAA with TACACS+ and RADIUS, and QoS classification that shares TCAM space in QoS trust boundaries and DSCP marking.

原文链接：https://www.arista.com/en/um-eos/eos-acls-and-route-maps