Chapter 1 Acl Configuration; Brief Introduction To Acl; Acl Overview - Huawei Quidway S5000 Series Operation Manual

Operation Manual - QoS/ACL
Quidway S5000 Series Ethernet Switches

Chapter 1 ACL Configuration

1.1 Brief Introduction to ACL

1.1.1 ACL Overview

A series of matching rules are required for the network devices to identify the packets to
be filtered. After identifying the packets, the switch can permit or deny them to pass
through according to the defined policy. Access Control List (ACL) is used to implement
such functions.
ACL classifies the data packets with a series of matching rules, including source
address, destination address and port number, etc. The switch verifies the data packets
with the rules in ACL and determines to forward or discard them.
The data packet matching rules defined by ACL can also be called in some other cases
requiring traffic classification, such as defining traffic classification for QoS.
An access control rule includes several statements. Different statements specify
different ranges of packets. When matching a data packet with the access control rule,
the issue of match-order arises.
I. The case of filter or classify the data transmitted by the hardware
ACL can be used to filter or classify the data transmitted by the hardware of switch. In
this case, the match order of ACL's sub-rules is determined by the switch hardware.
The match order defined by the user can't be effective.
The case includes: ACL cited by QoS function, ACL used for filter the packet
transmitted by the hardware. etc.
II. The case of filter or classify the data transmitted by the software
ACL can be used to filter or classify the data treated by the software of switch. In this
case, the match order of ACL's sub-rules can be determined by the user. There are two
match-orders: config (by following the user-defined configuration order when matching
the rule) and auto (according to the system sorting automatically when matching the
rule, i.e. in depth-first order). Once the user specifies the match-order of an access
control rule, he cannot modify it later, unless he deletes all the content and specifies the
match-order again.
1-1
Chapter 1 ACL Configuration