10
ACL category
Depth-first rule sorting procedures
IPv4 advanced
ACL
1.
The rule configured with a VPN instance takes precedence.
2.
The rule configured with a specific protocol is prior to a rule with the
protocol type set to IP. IP represents any protocol over IP.
3.
The rule with more 0s in the source IP address wildcard mask takes
precedence. More 0s means a narrower IP address range.
4.
The rule with more 0s in the destination IP address wildcard mask takes
precedence.
5.
The rule with a narrower TCP/UDP service port number range takes
precedence.
6.
The rule with a smaller ID takes precedence.
IPv6 basic ACL
1.
The rule configured with a longer prefix for the source IP address takes
precedence. A longer prefix means a narrower IP address range.
2.
The rule with a smaller ID takes precedence.
IPv6 advanced
ACL
1.
The rule configured with a specific protocol is prior to a rule with the
protocol type set to IP. IP represents any protocol over IPv6.
2.
The rule configured with a longer prefix for the source IPv6 address has a
higher priority.
3.
The rule configured with a longer prefix for the destination IPv6 address
takes precedence.
4.
The rule with a narrower TCP/UDP service port number range takes
precedence.
5.
The rule with a smaller ID takes precedence.
Ethernet frame
header ACL
1.
The rule with more 1s in the source MAC address mask takes precedence.
More 1s means a smaller MAC address.
2.
The rule with more 1s in the destination MAC address mask takes
precedence.
3.
The rule with a smaller ID takes precedence.
NOTE:
Currently, the AC does not support ACL rules with the VPN instance attribute.
A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted
decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent ‗do
care‘ bits, while the 1 bits represent 'don‘t care bits.' If the 'do care' bits in an IP address are
identical to the 'do care' bits in an IP address criterion, the IP address matches the criterion. All
'don‘t care' bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For
example, 0.255.0.255 is a valid wildcard mask.
