QTECH
Software Configuration Manual
13-171
Chapter 13
ACL Configuration
13.1 ACL Overview
An access control list (ACL) is used primarily to identify traffic flows. In order to filter data packets, a series
of match rules must be configured on the network device to identify the packets to be filtered. After the specific
packets are identified, and based on the predefined policy, the network device can permit/prohibit the corresponding
packets to pass.
ACLs classify packets based on a series of match conditions, which can be the source addresses, destination
addresses and port numbers carried in the packets.
The packet match rules defined by ACLs can be referenced by other functions that need to differentiate traffic
flows, such as the definition of traffic
classification rules in QoS
,
policy-based vlan
,
selective QinQ
and others.
According to the application purpose, ACLs fall into the following four types :
·
Standard ACL : rules are made based on the Layer 3 source IP addresses only.
·
Extended ACL : rules are made based on the Layer 3 and Layer 4 information such as the source and
destination IP addresses of the data packets, the type of protocol over IP, protocol-specific features, and
so on.
·
Link-based ACL : rules are made based on the Layer 2 information such as the source and
destination MAC address, VLAN priority, Layer 2 protocol, and so on.
·
User-based ACL : such rules specify a byte in the packet, by its offset from the packet header, as the
starting point to perform logical AND operations, and compare the extracted string with the user-defined
string to find the matching packets for processing.
13.1.1
ACL Match Order
An ACL may contain a number of rules, which specify different packet ranges. This brings about the issue of
match order when these rules are used to filter packets.
An ACL supports the following two types of match orders :
·
Configured order : ACL rules are matched according to the configured order.
·
Automatic ordering : ACL rules are matched according to the “depth-first” order.
13.1.1.1
IP ACL depth-first order
With the depth-first rule adopted, the rules of an IP ACL (standard and extended) are matched in the following
order :
1) Protocol range of ACL rules. The range of IP protocol is 1 to 255 and those of other protocols over IP are
the same as the corresponding protocol numbers. The smaller the protocol range, the higher the priority.
2) Range of source IP address. The smaller the source IP address range (that is, the longer the mask), the
higher the priority.
3) Range of destination IP address. The smaller the destination IP address range (that is, the longer the mask),
the higher the priority.
4) Range of Layer 4 port number, that is, of TCP/UDP port number. The smaller the range, the higher the
priority.
If rule A and rule B are the same in all the four ACEs (access control elements) above, and also in their
