No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

NE20E-S2 V800R010C10SPC500 Configuration Guide - IP Services 01

This is NE20E-S2 V800R010C10SPC500 Configuration Guide - IP Services
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Overview of ACL6s

Overview of ACL6s

An access control list (ACL) is a set of sequential packet filtering rules. After an ACL is configured on a router, the router permits or denies packets based on the matched rules defined in the ACL. ACL6s are the ACLs that support IPv6, and can be applied to various services, such as routing policies, traffic management, and QoS.

Introduction

As the name indicates, an Access Control List (ACL) is a list. The list contains matching clauses, which are actually matching rules and used to tell the device to perform action on the packet or not. ACL6s are the ACLs that support IPv6, and can be applied to various services, such as routing policies, traffic management, and QoS.

Device communication networks need to provide reliable data transmission. To this end, ACL6s can be used on access or core devices to achieve network security and stability.

  • Defend against various network attacks, such as attacks by using IPv6, TCP, and ICMPv6 packets.
  • Control network access. For example, ACL6s can be used to control enterprise network user access to external networks, to specify the network resources accessible to users, and to define the time ranges in which users can access networks.
  • Limit network traffic and improve network performance. For example, ACL6s can be used to limit bandwidth for upstream and downstream traffic and to apply charging rules to user requested bandwidth, therefore achieving efficient utilization of network resources.
NOTE:

An ACL6 classifies packets only based on its predefined rules. ACL6s can be used to filter packets only after they are applied to a specific service during device management, policy-based routing, unicast packet filtering, routing policies, traffic management, or multicast packet filtering.

ACL6 Classification

The following table outlines ACL6 classification based on functions.
Table 11-1 ACL6 types

ACL6 Type

Function

ACL6 Number

Interface-based ACL6

Defines rules based on packets' inbound interfaces.

1000 to 1999

Basic ACL6

Defines rules based on packets' source addresses.

2000 to 2999

Advanced ACL6

Defines rules based on packets' source or destination addresses, source or destination port numbers, and protocol types.

3000 to 3999

User ACL6 (UCL6)

Defines rules based on the source/destination IP address, source/destination service group, source/destination user group, source/destination port number, and protocol type.

6000 to 9999

Validity Period of ACL6 Rules

To control a type of traffic in a specified period of time, users can configure the validity period of an ACL rule to determine the time during which that traffic type is allowed to pass through. For example, to ensure reliable transmission of video services in prime time in the evening, restrict the traffic volume of common online users. The validity period can be an absolute or cyclic time range.
  • An absolute time range start from yyyy-mm-dd to yyyy-mm-dd. This time range is effective once and does not repeat.
  • A cyclic time range is cyclic, with a one week cycle. For example, an ACL rule takes effect from 8:00 to 12:00 every Sunday.

ACL6 Description

Configuring the description for a created ACL6 helps you learn about the ACL6 quickly.

ACL6 Rules

ACL6 rules are configured for each ACL6 and used to classify packets in different scenarios. Table 11-2 lists ACL6 rules and their functions.

Table 11-2 ACL6 rules

ACL6 Rule

ACL6 Type

Function

Validity period

Interface-based ACL6, basic ACL6, advanced ACL6, user ACL6

Sets a validity period in which ACL6 rules take effect. This rule is used for:
  • Flow control
  • Access time control

Inbound interface

Interface-based ACL6

Classifies packets based on their inbound interfaces. This rule is used for:
  • Flow control
  • Access authority control

Non-first fragment

Basic ACL6, advanced ACL6, user ACL6

Classifies packets based on whether a packet is the first packet fragment. This rule is used for:
  • Attack defense
  • Flow control

Source IPv6 address

Basic ACL6, advanced ACL6, user ACL6

Classifies packets based on their source IPv6 addresses. This rule is used for:
  • Flow control
  • Access authority control
  • Route filtering
  • Multicast packet filtering

VPN instance

Basic ACL6 and advanced ACL6

Classifies packets based on the VPN instances to which the packets belong. This rule is used for:
  • Flow control
  • Access authority control

Destination IPv6 address

Advanced ACL6, user ACL6

Classifies packets based on their destination IPv6 addresses. This rule is used for:
  • Flow control
  • Access authority control
  • Route filtering
  • Multicast packet filtering

Protocol type

Advanced ACL6, user ACL6

Classifies packets based on their protocol types.

Source port number

Advanced ACL6, user ACL6

Classifies packets based on source TCP or UDP port numbers. This rule is used for:
  • Flow control
  • Access authority control
  • Route filtering

Destination port number

Advanced ACL6, user ACL6

Classifies packets based on destination TCP or UDP port numbers. This rule is used for:
  • Flow control
  • Access authority control
  • Route filtering

IPv6 DSCP value

Advanced ACL6, user ACL6

Classifies IPv6 packets based on their DSCP values. This rule is used for route filtering.

IPv6 precedence value

Advanced ACL6, user ACL6

Classifies IPv6 packets based on the IPv6 precedence. This rule is used for flow control.

IPv6 ToS value

Advanced ACL6, user ACL6

Classifies IPv6 packets based on their ToS values. This rule is used for flow control.

Source/destination service group, or source/destination user group

User ACL6

Classifies IPv6 packets based on source/destination service group, or source/destination user group. This rule is used for flow control.

Matching Order of ACL6 Rules

A device configured with ACL6s matches the received packets against ACL6 rules according to the matching order of rules.

The rule sequence in an ACL6 depends on ACL6 rule-matching orders and ACL6 rule numbers.

Rule matching orders include the configuration order and the automatic order.

  • Automatic order: The system sequences rules automatically and places the most precise rule in the front of the ACL6 based on the depth-first principle.

    NOTE:
    • ACL6 rules are sequenced based on rule precision. For an ACL6 rule (where a protocol type, a source IPv6 address range, or a destination IPv6 address range is specified), the stricter the rule, the more precise it is. For example, an ACL6 rule can be configured based on the wildcard of an IPv6 address. The smaller the wildcard, the smaller the specified network segment and the stricter the ACL6 rule.
    • If rules have the same precision, they are matched based on the configuration order.
  • Configuration order: The system sequences ACL6 rules based on the rules' configuration order.

    NOTE:

    The mechanism in which ACL6 rules are matched based on their configuration order applies only when rule numbers are not specified. If rule numbers are specified, the ACL6 rules are matched based on their numbers in ascending order.

Translation
Download
Updated: 2019-01-02

Document ID: EDOC1100055376

Views: 15901

Downloads: 33

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Share
Previous Next