Configuring an Advanced ACL Rule
Context
An advanced ACL classifies packets by matching packet information against its rules. After an advanced ACL is created, configure rules in the advanced ACL.
When the device receives a packet, it matches the packet against ACL rules one by one based on the configuration order. Once the packet matches a rule in an ACL rule group, the device stops the matching process and performs the action specified in the matching rule on the packet.
Procedure
- Run system-view
The system view is displayed.
- Run acl { [ number ] acl-number | name acl-name [ [ number ] acl-number | advance ] }
An advanced ACL is created, and the advanced ACL view is displayed.
The parameter acl-number specifies the number of an advanced ACL. The value ranges from 3000 to 3999.
By default, no ACL is created.
- Configure an advanced ACL rule based on the protocol type.
When the UDP protocol is used, run:
rule [ rule-id ] [ name rule-name ] { deny | permit } protocol [ [ dscp dscp | [ precedence precedence | tos tos ] * ] | { destination { destination-ip-address { destination-wildcard | 0 | des-netmask } | any } | destination-pool destination-pool-name } | { destination-port { eq port | gt port | lt port | range port-start port-end } | destination-port-pool destination-port-pool-name } | fragment-type fragment | { source { source-ip-address { source-wildcard | 0 | src-netmask } | any } | source-pool source-pool-name } | { source-port { eq port | gt port | lt port | range port-start port-end } | source-port-pool source-port-pool-name } | time-range time-name | vpn-instance vpn-instance-name | ttl-expired | logging ] *
The ACL can match the packets with UDP port number 65535 only when VXLAN is configured. If VXLAN is not configured, the ACL does not take effect.
When the TCP protocol is used, run:
rule [ rule-id ] [ name rule-name ] { deny | permit } protocol [ [ dscp dscp | [ precedence precedence | tos tos ] * ] | { destination { destination-ip-address { destination-wildcard | 0 | des-netmask } | any } | destination-pool destination-pool-name } | { destination-port { eq port | gt port | lt port | range port-start port-end } | destination-port-pool destination-port-pool-name } | fragment-type fragment | { source { source-ip-address { source-wildcard | 0 | src-netmask } | any } | source-pool source-pool-name } | { source-port { eq port | gt port | lt port | range port-start port-end } | source-port-pool source-port-pool-name } | tcp-flag { tcp-flag [ mask mask-value ] | established } | time-range time-name | vpn-instance vpn-instance-name | ttl-expired | logging ] *
When the ICMP protocol is used, run:
rule [ rule-id ] [ name rule-name ] { deny | permit } protocol [ [ dscp dscp | [ precedence precedence | tos tos ] * ] | { destination { destination-ip-address { destination-wildcard | 0 | des-netmask } | any } | destination-pool destination-pool-name } | fragment-type fragment | icmp-type { icmp-name | icmp-type [ icmp-code ] } | { source { source-ip-address { source-wildcard | 0 | src-netmask } | any } | source-pool source-pool-name } | time-range time-name | vpn-instance vpn-instance-name | ttl-expired | logging ] *
When the IGMP protocol is used, run:
rule [ rule-id ] [ name rule-name ] { deny | permit } protocol [ [ dscp dscp | [ precedence precedence | tos tos ] * ] | { destination { destination-ip-address { destination-wildcard | 0 | des-netmask } | any } | destination-pool destination-pool-name } | fragment-type fragment | igmp-type igmp-type | { source { source-ip-address { source-wildcard | 0 | src-netmask } | any } | source-pool source-pool-name } | time-range time-name | vpn-instance vpn-instance-name | ttl-expired | logging ] *
When other protocols are used, run:
rule [ rule-id ] [ name rule-name ] { deny | permit } [ [ dscp dscp | [ precedence precedence | tos tos ] * ] | { destination { destination-ip-address { destination-wildcard | 0 | des-netmask } | any } | destination-pool destination-pool-name } | fragment-type fragment | { source { source-ip-address { source-wildcard | 0 | src-netmask } | any } | source-pool source-pool-name } | time-range time-name | vpn-instance vpn-instance-name | ttl-expired | logging ] *
When you configure an advanced ACL rule:
If all destination IP addresses and source IP addresses are specified (any in Step 3), the system will not check packets' destination IP addresses or source IP addresses.
When you specify the parameter time-range to reference a time range to the ACL, the ACL cannot be bound to the specified time range if the specified time-name does not exist.
- (Optional) Run rule rule-id description description
The description of an advanced ACL rule is configured.
By default, no description is configured for an ACL rule.
You are not allowed to configure the description for a rule that has not been created.
- Run commit
The configuration is committed.