Operation Manual – ACLH3C S3100 Series Ethernet Switches Chapter 1 ACL Configuration1-1Chapter 1 ACL Configuration1.1 ACL OverviewAs the network scale and network traffic are increasingly growing, security control andbandwidth assignment play a more and more important role in network management.Filtering data packets can prevent a network from being accessed by unauthorizedusers efficiently while controlling network traffic and saving network resources. Accesscontrol lists (ACL) are often used to filter packets with configured matching rules.Upon receiving a packet, the switch compares the packet with the rules of the ACLapplied on the current port to permit or discard the packet.The rules of an ACL can be referenced by other functions that need traffic classification,such as QoS.ACLs classify packets using a series of conditions known as rules. The conditions canbe based on source addresses, destination addresses and port numbers carried in thepackets.According to their application purposes, ACLs fall into the following four types.z Basic ACL. Rules are created based on source IP addresses only.z Advanced ACL. Rules are created based on the Layer 3 and Layer 4 informationsuch as the source and destination IP addresses, type of the protocols carried byIP, protocol-specific features, and so on.z Layer 2 ACL. Rules are created based on the Layer 2 information such as sourceand destination MAC addresses, VLAN priorities, type of Layer 2 protocol, and soon.z User-defined ACL. An ACL of this type matches packets by comparing the stringsretrieved from the packets with specified strings. It defines the byte it begins toperform “and” operation with the mask on the basis of packet headers.1.1.1 ACL Matching OrderAn ACL can contain multiple rules, each of which matches specific type of packets. Sothe order in which the rules of an ACL are matched needs to be determined.The rules in an ACL can be matched in one of the following two ways:z config: where rules in an ACL are matched in the order defined by the user.z auto: where rules in an ACL are matched in the order determined by the system,namely the “depth-first” rule.For depth-first rule, there are two cases:
