H3C S5820X Series Configuration Manual

Also see for s5800 series: Installation manual Instruction manual Command reference Quick start Troubleshooting guide

Contents

H3C S5820X Series Configuration Manual Manual pdf 12 page image

1-2z Hardware-based application: An ACL is assigned to a piece of hardware. For example, an ACL isapplied to an Ethernet interface or VLAN interface for packet filtering or is referenced by a QoSpolicy for traffic classification. Note that when an ACL is referenced to implement QoS, the actionsdefined in the ACL rules, deny or permit, do not take effect; actions to be taken on packetsmatching the ACL depend on the traffic behavior definition in QoS. For details about trafficbehavior, see QoS Configuration Approaches in the ACL and QoS Configuration Guide.z Software-based application: An ACL is referenced by a piece of upper layer software. Forexample, an ACL can be referenced to configure login user control behavior, thus controllingTelnet, SNMP and Web users. Note that when an ACL is reference by the upper layer software,actions to be taken on packets matching the ACL depend on those defined by the ACL rules. Fordetails about login user control, see User Login Control in the Fundamentals Configuration Guide.z When an ACL is assigned to a piece of hardware and referenced by a QoS policy for trafficclassification, the switch does not take action according to the traffic behavior definition on apacket that does not match the ACL.z When an ACL is referenced by a piece of software to control Telnet, SNMP, and Web login users,the switch denies all packets that do not match the ACL.z For details of ACL application for packet filtering, see Applying an ACL for Packet Filtering.ACL ClassificationACLs fall into three categories, as shown in Table 1-1.Table 1-1 ACL categoriesCategory ACL number IP version Match criteriaIPv4 Source IPv4 addressBasic ACLs 2000 to 2999IPv6 Source IPv6 addressIPv4Source/destination IPv4 address, protocols overIPv4, and other Layer 3 and Layer 4 headerfieldsAdvanced ACLs 3000 to 3999IPv6Source/destination IPv6 address, protocols overIPv6, and other Layer 3 and Layer 4 headerfieldsEthernet frameheader ACLs 4000 to 4999 IPv4 and IPv6Layer 2 header fields, such as source anddestination MAC addresses, 802.1p priority, andlink layer protocol type