H3C S5500-SI Series, Operation Manual

Page: 770 / 1217

1-3
The name of an IPv4 ACL must be unique among IPv4 ACLs. However, an IPv4 ACL and an IPv6 ACL
can share the same name.
IPv4 ACL Match Order
An ACL may consist of multiple rules, which specify different matching criteria. These criteria may have
overlapping or conflicting parts. The match order is for determining how packets should be matched
against the rules.
Two match orders are available for IPv4 ACLs:
z
config : Packets are compared against ACL rules in the order the rules are configured.
z
auto : Packets are compared against ACL rules in the depth-first match order.
The term depth-first match has different meanings for different types of ACLs:
Depth-first match for a basic IPv4 ACL
The following shows how your device performs depth-first match in a basic IPv4 ACL:
1) Sort rules by source IP address wildcard and compare packets against the rule configured with
more zeros in the source IP address wildcard.
2) If two rules are present with the same number of zeros in their source IP address wildcards,
compare packets against the rule configured first.
Depth-first match for an advanced IPv4 ACL
The following shows how your device performs depth-first match in an advanced IPv4 ACL:
1) Look at the protocol carried over IP. A rule with no limit to the protocol type (that is, configured with
the ip keyword) has the lowest precedence. Rules each of which has a single specified protocol
type are of the same precedence level.
2) If the protocol types have the same precedence, look at the source IP address wildcards. Then,
compare packets against the rule configured with more zeros in the source IP address wildcard.
3) If the numbers of zeros in the source IP address wildcards are the same, look at the destination IP
address wildcards. Then, compare packets against the rule configured with more zeros in the
destination IP address wildcard.
4) If the numbers of zeros in the destination IP address wildcards are the same, look at the Layer 4
port number ranges, namely the TCP/UDP port number ranges. Then compare packets against the
rule configured with the smaller port number range.
5) If the port number ranges are the same, compare packets against the rule configured first.
Depth-first match for an Ethernet frame header ACL
The following shows how your device performs depth-first match in an Ethernet frame header ACL:
1) Sort rules by source MAC address mask first and compare packets against the rule configured with
more ones in the source MAC address mask.
2) If two rules are present with the same number of ones in their source MAC address masks, look at
the destination MAC address masks. Then, compare packets against the rule configured with more
ones in the destination MAC address mask.