====== Traffic Management ======

==== ACL ====

In the end of every ACL there is an **implicit deny any**!

There are ''three'' ACL types:
  - Standard - filter based on source IP
  - IP ACL - filter based on src/dst IP, port, protocol
  - MAC ACL - filter based on src/dst MAC address. Can be applied only to "inbound" direction


Example Standard ACL:
<code>
ip access-list standard ACL-BGP-PEER
   10 permit 172.22.1.0/31
!
interface Ethernet32/1
   ip access-group ACL-BGP-PEER in
</code>

Example IP ACL:
<code>
ip access-list ACL-BGP-PEER
   10 permit ip 172.22.1.0/31 172.22.1.0/31
</code>

Example MAC ACL (allowing arp traffic sourcing from 00:10:10:00:xx:xx):
<code>
mac access-list MAC-ACL-TEST
   10 permit 00:10:10:00:10:00 00:00:00:00:ff:ff any arp
</code>

Applying ACL to the management traffic:
<code>
management ssh
   ip access-group ACL-SSH-USERS in
</code>

Applying ACL to all management protocols:
<code>
system control-plane
   ip access-group CONTROL-PLANE-PROTECTION-V4 in
</code>