Configuring Access Control Rules; Access Control Rule Overview; Configuring Access Control Rule - Zte ZXR10 8900 Series User Manual

ZXR10 8900 Series User Manual (FW Volume)
Configuring Access Control
Rules

Access Control Rule Overview

As for access control rule, FW card permits or denies the packets
matching access control rule to pass through.
After receiving one packet, FW will match it with all rules in ACL se-
quentially. Once matched rule is found, FW processes this packet
according to operation (permit or drop) specified by this policy and
not check default area attribute. In case matched access rule is
unavailable, FW card will process this packet according to default
attribute (permit or deny) of the area where destination interface
locates.
Before querying access control rule, FW card will query if the
packet matches destination address translation rule. If the packet
matches destination address translation rule, FW card will trans-
late destination IP address of received packet to preset IP address
(actual IP address in usual cases). Therefore, when setting
access control rule, system uses actual source and destination
addresses (destination address after translation) to set access
rule; meanwhile, system supports to set access rule according to
destination address before translation. In this case, packet will
match access control rule according to destination address before
translation.
By defining access control rule, that is defining match rule of
packet, FW card can identify and match packet from various
aspects such as area, VLAN, address, user, connection and time.
Source and destination of access control rule can be preset
VLAN/area or one or more address resources and user group
resources.

Configuring Access Control Rule

This topic describes configuration commands and configuration ex-
amples of access control rule.
User can control L3-L7 access flexibly and powerfully by setting
access control rule. FW card can identify and match packet from
various aspects such as area, VLAN, address, user, connection and
time. What's more, FW card can perform deep data detection and
filtering for various application layer protocols. Similar to packet
filtering policy, packet matches access control rules sequentially.
However, there is no default rule for access control rule. That's to
say, if no Deny All rule is attached to the end of ACL, system will
process this packet according to default attribute (permit or deny)
of area where destination interface locates.
To access this command module, execute the following command:
#firewall
76 Confidential and Proprietary Information of ZTE CORPORATION