ACL on SVIs

[DanPartelly]

We should be able to specify ACls directly on VLAN interface, and would be also nice to specify prefixes as vlan-ids.

[ipspace]

We should be able to specify ACls directly on VLAN interface

The only way to do that is to specify whatever on node vlans.vlan dictionary, and if that doesn't work yet, then you have to copy the interface attribute to node_vlan attribute (see evpn.yml for an example) or make the routing.acl a link attribute

and would be also nice to specify prefixes as vlan-ids.

Sure. Just add that.

[ipspace]

@DanPartelly -- How do you want to handle this? Make routing.acl a link attribute (so it can be applied to all interfaces on a link), or keep it an interface attribute (so it must be applied to individual interfaces), and copy that into a node_vlan attribute (so it can be applied to SVIs)?

It might be better having it as a link attribute, so it can be (for example) applied to all switches on an edge subnet, or even to all links in a link group.

[DanPartelly]

I was thinking on as having it as a link attribute, but I didn't start implementing yet , so I did not figured out all the consequences and possible pitfalls of the choice. Seeing you lean towards link attributes as well, this is the way it will be done.

Ill start working on it mid-week. Any other functionality you may want for ACLs or implementation ideas to make user (and ours) life easier, please say. resolving prefixes by the new linkid is something we should have.