ACL

An ACL classifies packets according to matching rules. The rules can be source addresses, destination addresses, or the port numbers of the packets.

Context

ACLs are classified into the following types:

Basic ACL: matching packets based on source IP addresses at Layer 3
Advanced ACL: matching packets based on the Layer 3 or Layer 4 information of packets, such as source IP addresses, destination IP addresses, type of the protocol over IP, and the protocol feature
Layer 2 ACL: matching packets based on Layer 2 information of packets, such as source MAC addresses, destination MAC addresses, 802.1P priorities, and the Layer 2 protocol type

Procedure

Query an ACL.
1. Choose ACL > ACL in the navigation tree to open the ACL page.
2. Set the search criteria.
3. Click Query to display all matching records.

Create an ACL.

Choose ACL > ACL in the navigation tree to open the ACL page.
Click Create to open the Create ACL page.

Click the ACL tab.

Table 1 describes the parameters on the page.

**Table 1** Parameters for creating an ACL
Parameter		Description
ACL type		Indicates the ACL type, including: Basic ACL Advanced ACL Layer 2 ACL
IP version		To create an IPv4 or IPv6 ACL, click the IPv4 or IPv6 check box. NOTE: If you select Layer 2 ACL, the IP version cannot be set.
ACL ID	ACL number	Indicates the number of an ACL. It identifies an ACL. The value of the ACL number is an integer, including: 2000-2999: basic ACL 3000-3999: advanced ACL 4000-4999: Layer 2 ACL NOTE: When you modify an ACL, the ACL number cannot be changed. An ACL number or ACL name is required to identify an ACL.
ACL ID	ACL name	Indicates the name of an ACL. The ACL name must be unique. NOTE: The ACL name is a string starting with a letter. Spaces are not allowed. An ACL number or ACL name is required to identify an ACL. When you modify an ACL, the ACL name cannot be changed.
Step		Indicates the interval between two rule IDs. NOTE: The Step text box is unavailable after you set IP version to IPv6.
ACL description		Indicates the description of an ACL. This parameter is optional. NOTE: The ACL description text box of the ACL is unavailable after you set IP version to IPv6.

Click Apply.

Click the Rules tab.

Table 2 describes the parameters for creating a basic ACL.

**Table 2** Parameters for creating a basic ACL
Parameter		Description
Rule number		Indicates the number of a rule. NOTE: If you do not specify a rule number, the system automatically allocates a number for the rule. The rule number cannot be changed.
Action		Indicates whether to permit or deny packets. The default action is to permit.
Log		Indicates whether to record logs when packets are permitted. To record logs when packets are permitted, click the check box.
Match IP	All source IP	Indicates that packets from any source IP address are permitted.
Match IP	Specify source IP	Enter the specified IP address and the wildcard. By default, all source IP addresses are specified. NOTE: To create an IPv4 ACL, enter the wildcard. To create an IPv6 ACL, enter the prefix length.
Time range name		Click Select to set the time range name. NOTE: The time range name is displayed on the configuration result page.
Fragment		Indicates that the rule is valid for only non-initial fragments.

NOTE:

The rule page displays all the rules of the ACL. Click a record to view the details about the record or modify the record. To deselect a record, click it again. You can add rules on the rule page.
When you modify the ACL rule, the ACL ID and rule number cannot be modified.

Table 3 describes the parameters for creating an advanced ACL.

**Table 3** Parameters for creating an advanced ACL
Parameter		Description
Rule number		Indicates the number of a rule. NOTE: If you do not specify a rule number, the system automatically allocates a number for the rule. The rule number cannot be changed.
Action		Indicates whether to permit or deny packets. The default action is to permit.
Log		Indicates whether to record logs when packets are permitted.
Protocol type		Indicates the type of the protocol. This parameter is mandatory. The advanced IPv4 ACL supports the following protocols: IGMP GRE IP IPINIP OSPF TCP UDP ICMP Custom NOTE: The text box is valid only when the protocol type can be defined by users. The advanced IPv6 ACL supports the following protocols: GRE ICMPv6 IPv6 OSPF TCP UDP Custom NOTE: The text box is valid only when the protocol type can be defined by users.
ICMP parameters (Type/Code) ICMPv6 parameters (Type/Code)		Indicates the type and code of ICMP/ICMPv6 packets, which are valid only when the protocol of packets is ICMP/ICMPv6. If this parameter is not specified, all types of ICMP/ICMPv6 packets are matched. The ICMP/ICMPv6 packets can be matched based on: Type: filters packets based on ICMP/ICMPv6 message type. Code: indicates the message code of the ICMP/ICMPv6 message type.
Match IP	All source IP	Indicates that packets from any source IP address are permitted.
	Specify source IP	Enter the specified IP address and the wildcard. By default, all source IP addresses are specified. NOTE: To create an IPv4 ACL, enter the wildcard. To create an IPv6 ACL, enter the prefix length.
	All destination IP addresses	Indicates that packets from any destination IP address are permitted.
	Point destination IP	Enter the specified IP address and the wildcard. By default, all destination IP addresses are specified. NOTE: To create an IPv4 ACL, enter the wildcard. To create an IPv6 ACL, enter the prefix length.
Match Port	Source port	This parameter is valid only when the protocol type is TCP or UDP. If this parameter is not specified, TCP or UDP packets with any source port are matched. Select a matching source port from the drop-down list box. The value can be equal, greater, smaller, or in the range. Enter the TCP or UDP port number in the text box.
Match Port	Destination port	This parameter is valid only when the protocol type is TCP or UDP. If this parameter is not specified, TCP or UDP packets with any destination port are matched. Select a matching destination port from the drop-down list box. The value can be equal, greater, smaller, or in the range. Enter the TCP or UDP port number in the text box.
Match Priority	IP precedence	Indicates that packets are filtered based on the precedence field. By default, this parameter is empty.
	DSCP value	Specifies the Differentiated Services Code Point (DSCP). NOTE: If you set the IP precedence or TOS, the DSCP priority cannot be set. If you set the DSCP priority, the IP precedence or TOS cannot be set.
	TOS	Indicates that packets are filtered based on the type field.
Time range name		Click Select to set the time range name. NOTE: The time range name is displayed on the configuration result page.
Fragment		Indicates that the rule is valid for only non-initial fragments.

NOTE:

The rule page displays all the rules of the ACL. Click a record to view the details about the record or modify the record. To deselect a record, click it again. You can add rules on the rule page.
When you modify the ACL rule, the ACL ID and rule number cannot be modified.

Table 4 describes the parameters for creating a Layer 2 ACL.

**Table 4** Parameters for creating a Layer 2 ACL rule
Parameter		Description
Rule number		Indicates the number of a rule. NOTE: If you do not specify a rule number, the system automatically allocates a number for the rule. The rule number cannot be changed.
Action		Indicates whether to permit or deny packets. The default action is to permit.
Match MAC	Source MAC	Indicates the source MAC address used by the ACL rule. The value is in H-H-H format.
	Mask	Indicates the mask of the source MAC address used by the ACL rule. The value is in the format H-H-H. The default value contains only Fs.
	Destination MAC	Indicates the destination MAC address used by the ACL rule. The value is in H-H-H format.
	Mask	Indicates the mask of the destination MAC address used by the ACL rule. The value is in the format H-H-H. The default value contains only Fs.
Match Protocol Type	Packet encapsulation format	Indicates the encapsulation format of protocol packets. The value can be Ethernet II, 802.3, or SNAP.
	Layer 2 protocol	Indicates the type of Layer 2 protocols.
	Layer 2 protocol mask	Indicates the mask of the Layer 2 protocol.
Source VLAN ID		Indicates the source VLAN ID.
Source VLAN ID mask		Indicates the mask of the source VLAN ID. The value is in hexadecimal notation. It ranges from 0 to 0xFFF. The default value is 0xFFF.
802.1p priority		Indicates the 802.1p priority of the ACL. By default, this parameter is empty.
Time range name		Click Select to set the time range name. NOTE: The time range name is displayed on the configuration result page.

NOTE:

The rule page displays all the rules of the ACL. Click a record to view the details about the record or modify the record. To deselect a record, click it again. You can add rules on the rule page.
When you modify the ACL rule, the ACL ID and rule number cannot be modified.

Set parameter on each tab page.
Click OK.
NOTE:
- If the ACL is not created, the system prompts you to create the ACL when you click Apply on the Rules tab page.

Edit an ACL.
1. Choose ACL > ACL in the navigation tree to open the ACL page.
2. Click the icon to open the Edit ACL page.
3. Click the ACL tab.
  NOTE:
  - Table 1 describes the parameters on the page.
  - The ACL type and ACL identifier cannot be modified.
  - The IPv6 ACL cannot be modified.
4. Click the Rules tab. The procedure for modifying a rule is similar to the procedure for creating a rule.
5. Modify the configuration parameter on the tab page.
6. Click OK.
Delete an ACL.
1. Choose ACL > ACL in the navigation tree to open the ACL page.
2. Select a record that you want to delete and click Delete. The system asks you whether to delete the record.
  NOTE:
  - To select a record, click the check box of the record.
  - To delete records in batches, click the check boxes of the records.
3. Click OK. If the operation succeeds, the system returns to the ACL page; otherwise, an error message is displayed.