Ipv4 Acl Naming; Ipv4 Acl Match Order - H3C S5500-EI series Operation Manual

Hide thumbs Also See for S5500-EI series:
Table of Contents

Advertisement

Operation Manual – ACL
H3C S5500-EI Series Ethernet Switches

1.2.2 IPv4 ACL Naming

When creating an IPv4 ACL, you can specify a unique name for it. Afterwards, you can
identify the ACL by its name.
An IPv4 ACL can have only one name. Whether to specify a name for an ACL is up to
you. After creating an ACL, you cannot specify a name for it, nor can you change or
remove the name of the ACL.
Note:
The name of an IPv4 ACL must be unique among IPv4 ACLs. However, an IPv4 ACL
and an IPv6 ACL can share the same name.

1.2.3 IPv4 ACL Match Order

An ACL consists of multiple rules, each of which specifies different matching criteria.
These criteria may have overlapping or conflicting parts. This is where the order in
which a packet is matched against the rules comes to rescue.
Two match orders are available for IPv4 ACLs:
config: where packets are compared against ACL rules in the order in which they
are configured.
auto: where depth-first match is performed. The term depth-first match has
different meanings for different types of ACLs.
I. Depth-first match for a basic IPv4 ACL
The following shows how your switch performs depth-first match in a basic IPv4 ACL:
1)
Sort rules by source IP address wildcard first and compare packets against the
rule configured with more zeros in the source IP address wildcard prior to other
rules.
2)
If two rules are present with the same number of zeros in their source IP address
wildcards, compare packets against the rule configured first prior to the other.
II. Depth-first match for an advanced IPv4 ACL
The following shows how your switch performs depth-first match in an advanced IPv4
ACL:
1)
Sort rules by protocol range and compare packets against the rule with the
protocol carried on IP specified prior to the other.
2)
If the protocol ranges are the same, look at source IP address wildcard. Then,
compare packets against the rule configured with more zeros in the source IP
address wildcard prior to the other.
1-3
Chapter 1 ACL Overview

Advertisement

Table of Contents
loading

Table of Contents