INS_RL1000GW_REV– 15 Jul 2016 PAGE 68
INSTALLATION AND OPERATION MANUAL
RL1000GW
TECH SUPPORT: 1.888.678.9427
Example
Following example will explain the ACL inspection flow.
The PC is sending udp packets. At the interface eth1, ACGs are intercepting the packets and
examine them.
ACG with priority 10 will take effect first, examine the packet with ACL 1050 rules. Rule 2, which
has priority 50, will be the first to be examined. As the rule addresses TCP packets, the condition
is not met. The packet will then be examined with rule 1 which addresses ICMP and thus as well
the rule is not met. The packet will now be examined with ACL 1010 rule 2 (priority 30). As the rule
condition of ICMP is not met, the packet is examined by the next rule (priority 80). The condition
of UDP is met and the packet is permitted.
ACL Commands Hierarchy
+ root
+ ip access-list extended
- create {acl-num <1001-65535>} [acl-name <>] [redirect <off| on>]
- delete {acl-num <1001-65535>}
- permit tcp {acl-num <1001-65535>} [rule-name <>] [priority <1-256>] {src-ip [any|
<a.b.c.d>]| <a.b.c.d/e>} {dst-ip [any| <a.b.c.d>]| <a.b.c.d/e>} [src-port <1-65535>] [dst-port
<1-65535>] [src-port-range <(1-65535):(1-65535)>] [dst-port-range <(1-65535):(1-65535)>]
- deny tcp {acl-num <1001-65535>} [rule-name <>] [priority <1-256>] {src-ip [any| <a.b.c.d>]|
<a.b.c.d/e>} {dst-ip [any| <a.b.c.d>]| <a.b.c.d/e>} [src-port <1-65535>] [dst-port <1-65535>]
[src-port-range <(1-65535):(1-65535)>] [dst-port-range <(1-65535):(1-65535)>]
- permit udp {acl-num <1001-65535>} [rule-name <>] [priority <1-256>] {src-ip [any|
<a.b.c.d>]| <a.b.c.d/e>} {dst-ip [any| <a.b.c.d>]| <a.b.c.d/e>} [src-port <1-65535>] [dst-port
<1-65535>] [src-port-range <(1-65535):(1-65535)>] [dst-port-range <(1-65535):(1-65535)>]
