Chapter 8 Acl Configuration - Zte ZXA10 C300 Configuration Manual

Chapter 8
ACL Configuration
The network devices use the Access Control List (ACL) to filter the data packets and control
the policy routes and special flows. ACL sets a series of matching rules to identify the
objects to be filtered, and permits or denies the corresponding data packet to pass through
according to the preset policies.
An ACL can contain one or more rules. These rules enable the device to permit or deny
the matching traffic according to specific parameters. An ACL compares the traffic with
each rule till it finds a matched rule. The last rule in an ACL is an implicit deny rule.
One interface supports only one ACL.
The ZXA10 C300 supports the following four types of ACLs:
l
Standard ACL
The standard ACL is only matched by the source
l
Extended ACL
The extended ACL is matched by the source IP address, destination IP address,
IP protocol type, TCP/UDP source/destination port number,
DSCP, ToS, and IP priority.
l
Layer-2 ACL
The layer-2 ACL is matched by the source MAC address, destination MAC address,
source
l
Hybrid ACL
The hybrid ACL is matched by the source MAC address, destination MAC
address, source VLAN ID, source IP address, destination IP address, TCP/UDP
source/destination port number, including all the matching fields of the preceding
three types.
l
IPv6 hybrid ACL
It is the IPv6-based hybrid ACL.
Table of Contents
Configuring a Standard ACL.......................................................................................8-2
Configuring an Extended ACL ....................................................................................8-3
Configuring a Layer-2 ACL .........................................................................................8-4
Configuring a Hybrid ACL...........................................................................................8-6
Configuring an IPv6 Hybrid ACL .................................................................................8-7
SJ-20130520164529-007|2013-06-30 (R1.0)
VLAN ID, layer-2 Ethernet protocol type, and 802.1p priority value.
IP address.
8-1
ZTE Proprietary and Confidential
ICMP type, IGMP type,