Operation Manual – ACL
H3C S3610&S5510 Series Ethernet Switches
Chapter 1 ACL Overview
1-4
3) If the protocol ranges are the same, look at source IP address wildcard. Then,
compare packets against the rule configured with more zeros in the source IP
address wildcard prior to the other.
4) If the numbers of zeros in the source IP address wildcards are the same, look at
the destination IP address wildcards. Then, compare packets against the rule
configured with more zeros in the destination IP address wildcard prior to the
other.
5)
If the numbers of zeros in the destination IP address wildcards are the same, look
at the Layer 4 port number (TCP/UDP port number). Then compare packets
against the rule configured with the lower port number prior to the other.
6) If the port numbers are the same, compare packets against the rule configured
first prior to the other.
III. Depth-first match for an Ethernet frame header ACL
The following shows how your device performs depth-first match in an Ethernet frame
header ACL:
1) Sort rules by source MAC address mask first and compare packets against the
rule configured with more ones in the source MAC address mask prior to other
rules.
2) If two rules are present with the same number of ones in their source MAC
address masks, look at the destination MAC address masks. Then, compare
packets against the rule configured with more ones in the destination MAC
address mask prior to the other.
3) If the numbers of ones in the destination MAC address masks are the same, the
one configured first is compared prior to the other.
Note:
The match order for a user-defined ACL can only be
config
.
The comparison of a packet against an ACL stops once a match is found. The packet is
then processed as per the rule.
1.2.4 IP Fragments Filtering with IPv4 ACL
Traditional packet filtering does not perform match operation on all IP fragments but
first ones. All subsequent non-first fragments are handled the way the first fragments
are handled. This causes security risk as attackers may fabricate non-first fragments to
attack your network.
