Switch does look at layer 2 information - Ethernet payload, L3 switch look at IP payload too, if need.
And the question is: How feature like this "ip access-list extended tcp deny host 1.2.3.4 any eq http" work? Switch start look at all L4 payload?
Switch does look at layer 2 information - Ethernet payload, L3 switch look at IP payload too, if need.
And the question is: How feature like this "ip access-list extended tcp deny host 1.2.3.4 any eq http" work? Switch start look at all L4 payload?
Adding an entry (ACE) to an ACL adds a corresponding entry to the TCAM table that is being applied to the frames/packets passing through the configured port or VLAN.
A ternary CAM doesn't require a complete match like a simple CAM. Instead, wildcard bits can be set to mask/ignore. Your ip access-list extended tcp deny host 1.2.3.4 any eq http
would translate to something along (TCAM hex on left, readable form on right side)
value mask
0800 0000 Ethertype=IPv4
4 0 IP version=4/0
01020304 00000000 IP source address=1.2.3.4/0.0.0.0
00000000 FFFFFFFF IP destination address=0.0.0.0/255.255.255.255 (any)
06 00 L4 protocol=6/0 (TCP)
0000 FFFF L4 source port=0/65535 (any)
0080 0000 L4 destination port=80/0
The / indicating the wildcard bits - 0
means full match, 255
or 65535
or '255.255.255.255' mean "doesn't matter at all "for byte or 16-bit or 32-bit values. The TCAM can also do partial matches for addresses like 192.168.0.0/0.0.0.255
for the 192.168.0.0/24 subnet.
In the switch, each packet is presented to all TCAM-stored ACEs of an ACL at the same time. The first ACE that matches gives its action as result (permit/deny) and the action is carried out. Since there's an implicit deny any any
at the end of the ACL there's always a match.
The L4 (here: TCP) payload isn't checked, only the headers.