Acl Classification; Acl Numbering And Naming; Match Order - H3C S5120-SI Series Configuration Manual

Software-based application: An ACL is referenced by a piece of upper layer software. For example,
an ACL can be referenced to configure login user control behavior, thus controlling Telnet, SNMP
and Web users. Note that when an ACL is reference by the upper layer software, actions to be
taken on packets matching the ACL depend on those defined by the ACL rules. For details about
login user control, refer to the Login Configuration.
When an ACL is assigned to a piece of hardware and referenced by a QoS policy for traffic
classification, the switch does not take action according to the traffic behavior definition on a
packet that does not match the ACL.
When an ACL is referenced by a piece of software to control Telnet, SNMP, and Web login users,
the switch denies all packets that do not match the ACL.
For details of ACL application for packet filtering, refer to

ACL Classification

ACLs fall into three categories, as shown in
Table 1-1 ACL categories
Category
Basic ACLs
Advanced ACLs
Ethernet frame
header ACLs

ACL Numbering and Naming

Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a
number for identification, and in addition, you can also assign the ACL a name for the ease of
identification. After creating an ACL with a name, you can neither rename it nor delete its name.
The ACL number and name must be globally unique.

Match Order

The rules in an ACL are sorted in a certain order. When a packet matches a rule, the device stops the
match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting
rules, the matching result and action to take depend on the rule order.
Two ACL match orders are available:
config: Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a
rule with a higher ID. If you use this approach, check the rules and their order carefully.
ACL number
2000 to 2999 Source IPv4 address
Source/destination IPv4 address, protocols over IPv4, and other
3000 to 3999
Layer 3 and Layer 4 header fields
Layer 2 header fields, such as source and destination MAC
4000 to 4999
addresses, 802.1p priority, and link layer protocol type
Applying an ACL for Packet
Table 1-1.
Match criteria
1-2
Filtering.