Switch does look at layer 2 information - Ethernet payload, L3 switch look at IP payload too, if need.
And the question is: How feature like this "ip access-list extended tcp deny host 18.104.22.168 any eq http" work? Switch start look at all L4 payload?
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Adding an entry (ACE) to an ACL adds a corresponding entry to the TCAM table that is being applied to the frames/packets passing through the configured port or VLAN.
A ternary CAM doesn't require a complete match like a simple CAM. Instead, wildcard bits can be set to mask/ignore. Your
ip access-list extended tcp deny host 22.214.171.124 any eq http would translate to something along (TCAM hex on left, readable form on right side)
value mask 0800 0000 Ethertype=IPv4 4 0 IP version=4/0 01020304 00000000 IP source address=126.96.36.199/0.0.0.0 00000000 FFFFFFFF IP destination address=0.0.0.0/255.255.255.255 (any) 06 00 L4 protocol=6/0 (TCP) 0000 FFFF L4 source port=0/65535 (any) 0080 0000 L4 destination port=80/0
The / indicating the wildcard bits -
0 means full match,
65535 or '255.255.255.255' mean "doesn't matter at all "for byte or 16-bit or 32-bit values. The TCAM can also do partial matches for addresses like
192.168.0.0/0.0.0.255 for the 192.168.0.0/24 subnet.
In the switch, each packet is presented to all TCAM-stored ACEs of an ACL at the same time. The first ACE that matches gives its action as result (permit/deny) and the action is carried out. Since there's an implicit
deny any any at the end of the ACL there's always a match.
The L4 (here: TCP) payload isn't checked, only the headers.