Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 01-ACL configuration | 121.85 KB |
Contents
Restrictions and guidelines: ACL configuration
Configuring an IPv4 advanced ACL
Configuring an IPv6 advanced ACL
Configuring a user-defined ACL
Configuring the QoS and ACL resource hardware mode
Verifying and maintaining ACLs
Verifying ACL configuration and running status
Configuring ACLs
About ACLs
An access control list (ACL) is a set of rules for identifying traffic based on criteria such as source IP address, destination IP address, and port number. The rules are also called permit or deny statements.
ACLs are primarily used for packet filtering. You can also use ACLs in QoS, security, routing, and other modules for identifying traffic. The packet drop or forwarding decisions depend on the modules that use ACLs.
Numbering and naming ACLs
When creating an ACL, you must assign it a number or name for identification. You can specify an existing ACL by its number or name. Each ACL type has a unique range of ACL numbers.
For basic or advanced ACLs with the same number, you must use the ipv6 keyword to distinguish them. For ACLs with the same name, you must use the ipv6, mac, and user-defined keywords to distinguish them.
ACL types
|
Type |
ACL number |
IP version |
Match criteria |
|
Basic ACLs |
2000 to 2999 |
IPv4 |
Source IPv4 address. |
|
IPv6 |
Source IPv6 address. |
||
|
Advanced ACLs |
3000 to 3999 |
IPv4 |
Source IPv4 address, destination IPv4 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields. |
|
IPv6 |
Source IPv6 address, destination IPv6 address, packet priority, protocol number, and other Layer 3 and Layer 4 header fields. |
||
|
Layer 2 ACLs |
4000 to 4999 |
IPv4 and IPv6 |
Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority, and link layer protocol type. |
|
User-defined ACLs |
5000 to 5999 |
IPv4 and IPv6 |
User specified matching patterns in protocol headers. |
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the matching result and action to take depend on the rule order.
The following ACL match orders are available:
· config—Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule with a higher ID. If you use this method, check the rules and their order carefully.
|
|
NOTE: The match order of user-defined ACLs can only be config. |
· auto—Sorts ACL rules in depth-first order. Depth-first ordering makes sure any subset of a rule is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first ordering uses to sort rules for each type of ACL.
Table 1 Sort ACL rules in depth-first order
|
ACL type |
Sequence of tie breakers |
|
IPv4 basic ACL |
1. VPN instance. 2. More 0s in the source IPv4 address wildcard (more 0s means a narrower IPv4 address range). 3. Rule configured earlier. |
|
IPv4 advanced ACL |
1. VPN instance. 2. Specific protocol number. 3. More 0s in the source IPv4 address wildcard mask. 4. More 0s in the destination IPv4 address wildcard. 5. Narrower TCP/UDP service port number range. 6. Rule configured earlier. |
|
IPv6 basic ACL |
1. VPN instance. 2. Longer prefix for the source IPv6 address (a longer prefix means a narrower IPv6 address range). 3. Rule configured earlier. |
|
IPv6 advanced ACL |
1. VPN instance. 2. Specific protocol number. 3. Longer prefix for the source IPv6 address. 4. Longer prefix for the destination IPv6 address. 5. Narrower TCP/UDP service port number range. 6. Rule configured earlier. |
|
Layer 2 ACL |
1. More 1s in the source MAC address mask (more 1s means a smaller MAC address). 2. More 1s in the destination MAC address mask. 3. Rule configured earlier. |
A wildcard mask, also called an inverse mask, is a 32-bit binary number represented in dotted decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent "do care" bits, and the 1 bits represent "don't care" bits. If the "do care" bits in an IP address are identical to the "do care" bits in an IP address criterion, the IP address matches the criterion. All "don't care" bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask.
Rule numbering
ACL rules can be manually numbered or automatically numbered. This section describes how automatic ACL rule numbering works.
Rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID. The rule numbering step sets the increment by which the system automatically numbers rules. For example, the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are automatically numbered 5, 10, 15, 20, and so on. The wider the numbering step, the more rules you can insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of inserting rules in an ACL. This feature is important for a config-order ACL, where ACL rules are matched in ascending order of rule ID.
The rule numbering step sets the increment by which the system numbers rules automatically. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 12, the rule is numbered 15.
The wider the numbering step, the more rules you can insert between two rules. Whenever the step or start rule ID changes, the rules are renumbered, starting from the start rule ID. For example, if there are five rules numbered 0, 5, 9, 10, and 15, changing the step from 5 to 2 causes the rules to be renumbered 5, 7, 9, 11, and 13.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the current highest rule ID, starting with 0.
For example, if the step is 5, and there are five rules numbered 0, 5, 9, 10, and 12, the newly defined rule is numbered 15. If the ACL does not contain a rule, the first rule is numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, changing the step from 5 to 2 renumbers rules 5, 10, 13, and 15 as rules 5, 7, 9, and 11.
For an ACL of the match order auto, rules are sorted in depth-first order, and are renumbered based on the match order. For example, rules are in the match order of 5, 10, and 15. Changing the numbering step to 2 renumbers rules 5, 15, and 10 (not 5, 10, and 15) as rules 5, 7, 9.
Fragment filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid risks, the ACL feature is designed as follows:
· Filters all fragments by default, including non-first fragments.
· Allows for matching criteria modification for efficiency. For example, you can configure the ACL to filter only non-first fragments.
Restrictions and guidelines: ACL configuration
· If you create a numbered ACL, you can enter the view of the ACL by using either of the following commands:
¡ acl [ ipv6 ] number acl-number.
¡ acl { [ ipv6 ] { advanced | basic } | mac | user-defined } acl-number.
· If you create a named ACL by using the acl [ ipv6 ] number acl-number name acl-name command, you can enter the view of the ACL by using either of the following commands:
¡ acl [ ipv6 ] number acl-number [ name acl-name ].
¡ acl { [ ipv6 ] { advanced | basic } | mac | user-defined } acl-number
¡ acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name.
· If you create a named ACL by using the acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name command, you can enter the view of the ACL by using only the command that is used to create the ACL.
· To specify the IPv4 ACL type, do not specify the ipv6 keyword.
· Matching packets are forwarded through slow forwarding if an ACL rule contains match criteria or has functions enabled in addition to the following match criteria and functions:
¡ Source and destination IP addresses.
¡ Source and destination ports.
¡ Transport layer protocol.
¡ ICMP or ICMPv6 message type, message code, and message name.
¡ VPN instance.
¡ Logging.
¡ Time range.
Slow forwarding requires packets to be sent to the control plane for forwarding entry calculation, which affects the device forwarding performance.
ACL tasks at a glance
To configure an ACL, perform the following tasks:
· Configure ACLs according to the characteristics of the packets to be matched
¡ Configuring a user-defined ACL
· (Optional.) Copying an ACL
· (Optional.) Configuring the QoS and ACL resource hardware mode
Configuring a basic ACL
About basic ACLs
Basic ACLs match packets based only on source IP addresses.
Configuring an IPv4 basic ACL
1. Enter system view.
system-view
2. Create an IPv4 basic ACL and enter its view. Choose one option as needed:
¡ Create an IPv4 basic ACL by specifying an ACL number.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
¡ Create an IPv4 basic ACL by specifying the basic keyword.
acl basic { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the IPv4 basic ACL.
description text
By default, an IPv4 basic ACL does not have a description.
4. (Optional.) Set the rule numbering step.
step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit } [ counting | fragment | source { source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comment is configured.
Configuring an IPv6 basic ACL
1. Enter system view.
system-view
2. Create an IPv6 basic ACL view and enter its view. Choose one option as needed:
¡ Create an IPv6 basic ACL by specifying an ACL number.
acl ipv6 number acl-number [ name acl-name ] [ match-order { auto | config } ]
¡ Create an IPv6 basic ACL by specifying the basic keyword.
acl ipv6 basic { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the IPv6 basic ACL.
description text
By default, an IPv6 basic ACL does not have a description.
4. (Optional.) Set the rule numbering step.
step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit } [ counting | fragment | routing [ type routing-type ] | source { source-address source-prefix | source-address/source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comment is configured.
Configuring an advanced ACL
About advanced ACLs
Advanced ACLs match packets based on the following criteria:
· Source IP addresses.
· Destination IP addresses.
· Packet priorities.
· Local QoS IDs.
· Protocol types.
· Other protocol header information, such as TCP/UDP source and destination port numbers, TCP flags, ICMP message types, and ICMP message codes.
· Encapsulation types.
· Inner source IPv4 addresses.
· Inner destination IPv4 addresses.
· Inner protocol types.
· Other inner protocol header information, such as inner TCP/UDP source and destination port numbers.
Compared to basic ACLs, advanced ACLs allow more flexible and accurate filtering.
Configuring an IPv4 advanced ACL
1. Enter system view.
system-view
2. Create an IPv4 advanced ACL and enter its view. Choose one option as needed:
¡ Create a numbered IPv4 advanced ACL by specifying an ACL number.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
¡ Create an IPv4 advanced ACL by specifying the advanced keyword.
acl advanced { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the IPv4 advanced ACL.
description text
By default, an IPv4 advanced ACL does not have a description.
4. (Optional.) Set the rule numbering step.
step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 5.
5. Create or edit a rule.
¡ Create or edit a rule for matching non-encapsulated packets.
rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { dest-address dest-wildcard | any } | destination-port operator port1 [ port2 ] | { { precedence precedence | tos tos } * | { precedence precedence | ecn ecn } * | { dscp dscp | ecn ecn } * } | fragment | icmp-type { icmp-type [ icmp-code ] | icmp-message } | qos-local-id local-id-value | source { source-address source-wildcard | any } | source-port operator port1 [ port2 ] | time-range time-range-name | user-group group-name | vpn-instance vpn-instance-name ] *
¡ Create or edit a rule for matching encapsulated packets.
rule [ rule-id ] { deny | permit } { gre-encapsulation | ipinip-encapsulation | vxlan } [ destination { dest-address dest-wildcard | any } | source { source-address source-wildcard | any } | source-port operator port1 [ port2 | vxlan-id vxlan-id ] ] * inner-protocol inner-protocol [ inner-destination { dest-address dest-wildcard | any } | inner-destination-port operator port1 [ port2 ] | inner-source { source-address source-wildcard | any } | inner-source-port operator port1 [ port2 ] ] * [ counting | time-range time-range-name ] *
|
Parameter |
Description |
|
gre-encapsulation |
Matches GRE packets. The source-port operator port1 [ port2 ] and vxlan-id vxlan-id options cannot be configured if you specify the gre-encapsulation keyword. |
|
ipinip-encapsulation |
Matches IP-in-IP encapsulation packets. The source-port operator port1 [ port2 ] and vxlan-id vxlan-id options cannot be configured if you specify the ipinip-encapsulation keyword. |
|
vxlan |
Matches VXLAN packets by both outer and inner packet information. |
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comment is configured.
Configuring an IPv6 advanced ACL
1. Enter system view.
system-view
2. Create an IPv6 advanced ACL and enter its view. Choose one option as needed:
¡ Create a numbered IPv6 advanced ACL by specifying an ACL number.
acl ipv6 number acl-number [ name acl-name ] [ match-order { auto | config } ]
¡ Create an IPv6 advanced ACL by specifying the advanced keyword.
acl ipv6 advanced { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the IPv6 advanced ACL.
description text
By default, an IPv6 advanced ACL does not have a description.
4. (Optional.) Set the rule numbering step.
step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port operator port1 [ port2 ] | dscp dscp | ecn ecn | flow-label flow-label-value | fragment | icmp6-type { icmp6-type icmp6-code | icmp6-message } | qos-local-id local-id-value | routing [ type routing-type ] | hop-by-hop [ type hop-type ] | source { source-address source-prefix | source-address/source-prefix | any } | source-port operator port1 [ port2 ] | time-range time-range-name | user-group group-name | vpn-instance vpn-instance-name ] *
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comment is configured.
Configuring a Layer 2 ACL
About this task
Layer 2 ACLs, also called Ethernet frame header ACLs, match packets based on Layer 2 Ethernet header fields, such as:
· Source MAC address.
· Destination MAC address.
· 802.1p priority (VLAN priority).
· Link layer protocol type.
· Encapsulation type.
Procedure
1. Enter system view.
system-view
2. Create a Layer 2 ACL and enter its view. Choose one option as needed:
¡ Create a Layer 2 ACL by specifying an ACL number.
acl number acl-number [ name acl-name ] [ match-order { auto | config } ]
¡ Create a Layer 2 ACL by specifying the mac keyword.
acl mac { acl-number | name acl-name } [ match-order { auto | config } ]
3. (Optional.) Configure a description for the Layer 2 ACL.
description text
By default, a Layer 2 ACL does not have a description.
4. (Optional.) Set the rule numbering step.
step step-value [ start start-value ]
By default, the rule numbering step is 5 and the start rule ID is 5.
5. Create or edit a rule.
¡ Create or edit a rule for matching non-VXLAN packets.
rule [ rule-id ] { deny | permit } [ cos dot1p | counting | dest-mac dest-address dest-mask | { lsap lsap-type lsap-type-mask | type protocol-type protocol-type-mask } | source-mac source-address source-mask | time-range time-range-name ] *
¡ Create or edit a rule for matching VXLAN packets.
rule [ rule-id ] { deny | permit } vxlan [ counting | dest-mac dest-address dest-mask | inner-dest-mac inner-dest-address inner-dest-mask | inner-source-mac inner-source-address inner-source-mask | inner-type inner-protocol-type inner-protocol-type-mask | source-mac source-address source-mask | time-range time-range-name | type protocol-type protocol-type-mask | vxlan-id vxlan-id ] *
6. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comment is configured.
Configuring a user-defined ACL
About this task
User-defined ACLs allow you to customize rules based on information in protocol headers. You can define a user-defined ACL to match packets. A specific number of bytes after an offset (relative to the specified header) are compared against a match pattern after being ANDed with a match pattern mask.
Procedure
1. Enter system view.
system-view
2. Create a user-defined ACL and enter its view. Choose one option as needed:
¡ Create a user-defined ACL by specifying an ACL number.
acl number acl-number [ name acl-name ]
¡ Create a user-defined ACL by specifying the user-defined keyword.
acl user-defined { acl-number | name acl-name }
3. (Optional.) Configure a description for the user-defined ACL.
description text
By default, a user-defined ACL does not have a description.
4. Create or edit a rule.
Command set 1:
rule [ rule-id ] { deny | permit } [ { { l2 | l4 }rule-string rule-mask offset }&<1-8> ] [ counting | time-range time-range-name ] *
Command set 2:
rule [ rule-id ] { deny | permit } protocol [ destination { dest-address dest-wildcard | any } | destination-port { operator port1 [ port2 ] } | dscp dscp | source { source-address source-wildcard | any } | source-port { operator port1 [ port2 ] } ] * [ { { l2 | l4 | l5 } rule-string rule-mask offset }&<1-8> ] [ counting | time-range time-range-name ] *
5. (Optional.) Add or edit a rule comment.
rule rule-id comment text
By default, no rule comment is configured.
Copying an ACL
About this task
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL) has the same properties and content as the source ACL, but uses a different number or name than the source ACL.
Restrictions and guidelines
To successfully copy an ACL, make sure:
· The destination ACL is the same type as the source ACL.
· The source ACL already exists, but the destination ACL does not.
Procedure
1. Enter system view.
system-view
2. Copy an existing ACL to create a new ACL.
acl [ ipv6 | mac | user-defined ] copy { source-acl-number | name source-acl-name } to { dest-acl-number | name dest-acl-name }
Configuring the QoS and ACL resource hardware mode
About this task
Different chips produce different packet matching results for QoS and ACL resources. Perform this task to enhance matching capabilities of QoS and ACL resources.
Restrictions and guidelines
This feature occupies more QoS and ACL resources when an ACL is applied.
Procedure
1. Enter system view.
system-view
2. Configure the QoS and ACL resource hardware mode.
qos-acl resource hardware-mode hardware-mode-value
By default, no QoS and ACL resource hardware mode is configured.
Verifying and maintaining ACLs
Verifying ACL configuration and running status
To verify the ACL configuration and running status, execute the following command in any view:
display acl [ ipv6 | mac | user-defined ] { acl-number | all | name acl-name }
Clearing ACL statistics
To clear ACL statistics, execute the following command in user view:
reset acl [ ipv6 | mac | user-defined ] counter { acl-number | all | name acl-name }
