ACL

This help contains the following topics:

·     Introduction

¡     ACL types

¡     Match order

¡     Rule numbering

·     Restrictions and guidelines

Introduction

An access control list (ACL) is a set of rules for identifying traffic based on criteria such as source IP address, destination IP address, and port number. The rules are also called permit or deny statements. The device processed identified traffic according to the configured policy.

ACL types

Table 1 ACL types

Match order

The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the matching result and action to take depend on the rule order.

The following ACL match orders are available:

·     config—Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule with a higher ID. If you use this method, check the rules and their order carefully.

·     auto—Sorts ACL rules in depth-first order. Depth-first ordering makes sure any subset of a rule is always matched before the rule. Table 2 lists the sequence of tie breakers that depth-first ordering uses to sort rules for each type of ACL.

Table 2 Sorting ACL rules in depth-first order

Rule numbering

If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID. The rule numbering step sets the increment by which the system automatically numbers rules. For example, if the ACL rule numbering step is 5 and you do not assign IDs to rules you are creating, they are automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert between two rules.

By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of inserting rules in an ACL. This feature is important for a config-order ACL, where ACL rules are matched in ascending order of rule ID.

The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the current highest rule ID, starting with 0.

For example, if the step is 5, and there are five rules numbered 0, 5, 9, 10, and 12, the newly defined rule is numbered 15. If the ACL does not contain a rule, the first rule is numbered 0.

Whenever the step changes, the rules are renumbered, starting from 0. For example, changing the step from 5 to 2 renumbers rules 5, 10, 13, and 15 as rules 0, 2, 4, and 6.

Restrictions and guidelines

·     You can create an ACL on the ACL page or on the page for a feature that uses the ACL. However, you can manage ACLs (for example, modify or delete ACLs) only on the ACL page.

·     Deleting or modifying an ACL might affect the feature that uses the ACL.

·     If the match order for an ACL is config, you can modify any rules in the ACL. If the match order for an ACL is auto, you cannot modify any rules in the ACL.