Acl classification, Acl numbering and naming, Match order – H3C Technologies H3C S5120 Series Switches User Manual

Page 528

Advertising
background image

1-2

z

Software-based application: An ACL is referenced by a piece of upper layer software. For example,

an ACL can be referenced to configure login user control behavior, thus controlling Telnet, SNMP

and Web users. Note that when an ACL is reference by the upper layer software, actions to be

taken on packets matching the ACL depend on those defined by the ACL rules. For details about

login user control, refer to the Login Configuration.

z

When an ACL is assigned to a piece of hardware and referenced by a QoS policy for traffic

classification, the switch does not take action according to the traffic behavior definition on a

packet that does not match the ACL.

z

When an ACL is referenced by a piece of software to control Telnet, SNMP, and Web login users,

the switch denies all packets that do not match the ACL.

z

For details of ACL application for packet filtering, refer to

Applying an ACL for Packet Filtering

.

ACL Classification

ACLs fall into three categories, as shown in

Table 1-1

.

Table 1-1 ACL categories

Category

ACL number

Match criteria

Basic ACLs

2000 to 2999

Source IPv4 address

Advanced ACLs

3000 to 3999

Source/destination IPv4 address, protocols over IPv4, and other
Layer 3 and Layer 4 header fields

Ethernet frame
header ACLs

4000 to 4999

Layer 2 header fields, such as source and destination MAC
addresses, 802.1p priority, and link layer protocol type

ACL Numbering and Naming

Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a

number for identification, and in addition, you can also assign the ACL a name for the ease of

identification. After creating an ACL with a name, you can neither rename it nor delete its name.

The ACL number and name must be globally unique.

Match Order

The rules in an ACL are sorted in a certain order. When a packet matches a rule, the device stops the

match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting

rules, the matching result and action to take depend on the rule order.

Two ACL match orders are available:

z

config: Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a

rule with a higher ID. If you use this approach, check the rules and their order carefully.

Advertising