H3C Technologies H3C S5120 Series Switches - Manual (Page 528)

1-2
z Software-based application: An ACL is referenced by a piece of upper layer software. For example,
an ACL can be referenced to configure login user control behavior, thus controlling Telnet, SNMP
and Web users. Note that when an ACL is reference by the upper layer software, actions to be
taken on packets matching the ACL depend on those defined by the ACL rules. For details about
login user control, refer to the Login Configuration.
z When an ACL is assigned to a piece of hardware and referenced by a QoS policy for traffic
classification, the switch does not take action according to the traffic behavior definition on a
packet that does not match the ACL.
z When an ACL is referenced by a piece of software to control Telnet, SNMP, and Web login users,
the switch denies all packets that do not match the ACL.
z For details of ACL application for packet filtering, refer to Applying an ACL for Packet Filtering .
ACL Classification
ACLs fall into three categories, as shown in Table 1-1 .
Table 1-1 ACL categories
Category ACL number Match criteria
Basic ACLs 2000 to 2999 Source IPv4 address
Advanced ACLs 3000 to 3999
Source/destination IPv4 address, protocols over IPv4, and other
Layer 3 and Layer 4 header fields
Ethernet frame
header ACLs
4000 to 4999
Layer 2 header fields, such as source and destination MAC
addresses, 802.1p priority, and link layer protocol type
ACL Numbering and Naming
Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a
number for identification, and in addition, you can also assign the ACL a name for the ease of
identification. After creating an ACL with a name, you can neither rename it nor delete its name.
The ACL number and name must be globally unique.
Match Order
The rules in an ACL are sorted in a certain order. When a packet matches a rule, the device stops the
match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting
rules, the matching result and action to take depend on the rule order.
Two ACL match orders are available:
z config: Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a
rule with a higher ID. If you use this approach, check the rules and their order carefully.