H3C S5120-EI series Configuration Manual

Also see for S5120-EI Series: Configuration guide Installation manual Configuration guide Configuration guide Operation manual

Contents

H3C S5120-EI series Configuration Manual Manual pdf 11 page image

1Configuring ACLsUnless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document.OverviewAn access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based oncriteria such as source IP address, destination IP address, and port number.ACLs are primarily used for packet filtering. A packet filter drops packets that match a deny rule andpermits packets that match a permit rule. ACLs are also used by many modules, QoS and IP routing forexample, for traffic classification and identification.Applications on the switchAn ACL is implemented in hardware or software, depending on the module that uses it. If the module, thepacket filter or QoS module for example, is implemented in hardware, the ACL is applied to hardwareto process traffic. If the module, the routing or user interface access control module (Telnet, SNMP, or web)for example, is implemented in software, the ACL is applied to software to process traffic.The user interface access control module denies packets that do not match any ACL. Some modules, QoSfor example, ignore the permit or deny action in ACL rules and do not base their drop or forwardingdecisions on the action set in ACL rules. See the specified module for information about ACL application.ACL categoriesCategory ACL number IP version Match criteriaBasic ACLs 2000 to2999IPv4 Source IPv4 addressIPv6 Source IPv6 addressAdvanced ACLs 3000 to3999IPv4Source IPv4 address, destination IPv4 address, packetpriority, protocols over IPv4, and other Layer 3 and Layer 4header fieldsIPv6Source IPv6 address, destination IPv6 address, packetpriority, protocols over IPv6, and other Layer 3 and Layer 4header fieldsEthernet frameheader ACLs4000 to4999IPv4 andIPv6Layer 2 header fields, such as source and destination MACaddresses, 802.1p priority, and link layer protocol typeNumbering and naming ACLsEach ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it anumber. In addition, you can assign the ACL a name for ease of identification. After creating an ACL witha name, you cannot rename it or delete its name.For an Ethernet frame header ACL, the ACL number and name must be globally unique. For an IPv4 basicor advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and for an IPv6