Zte ZXR10 8900 Series - Chapter 9 ACL Configuration; ACL Overview

Chapter9
ACLConfiguration
TableofContents
ACLOverview...................................................................77
NP-BasedACLOverview.....................................................78
ConguringACLs...............................................................79
ConguringEventLinkageACLRule.....................................85
ApplyingNP-BasedACL......................................................87
ACLCongurationExample.................................................88
ACLMaintenanceandDiagnosis...........................................89
ACLOverview
Packetlteringcanhelplimitnetworktrafcandrestrictnetwork
usebycertainusersordevices.ACLcanltertrafcasitpasses
througharouterandpermitordenypacketsatspeciedinter-
faces.
AnACLisasequentialcollectionofpermitanddenyconditionsthat
applytopackets.Whenapacketisreceivedonaninterface,the
switchcomparestheeldsinthepacketagainstanyappliedACL
toverifythatthepackethastherequiredpermissionstobefor-
warded,basedonthecriteriaspeciedintheaccesslists.Ittests
packetsagainsttheconditionsinanaccesslistonebyone.The
rstmatchdetermineswhethertheswitchacceptsorrejectsthe
packetsbecausetheswitchstopstestingconditionsaftertherst
match.Theorderofconditionsinthelistiscritical.Whenthere
arenoconditionsmatched,theswitchrejectsthepackets.Ifthere
arenorestrictions,theswitchforwardsthepacket;otherwise,the
switchdropsthepacket.
PacketmatchingrulesdenedbytheACLarealsousedinother
conditionswheredistinguishingtrafcisneeded.Forinstance,the
matchingrulescandenethetrafcclassicationruleintheQoS.
ZXR108900seriesswitchprovidesseventypesofACLs:
�StandardACL
OnlysourceIPaddressesarematchedagainsttheACL.
�ExtendedACL
Source/destinationIPaddress,IPprotocoltype,TCP
source/destinationportnumber ,TCP-control,UDPsource/des-
tinationportnumber ,ICMPtype,ICMPcode,DiffServCode
Point(DSCP),ToSandprecedencearematchedagainstthe
ACL.
CondentialandProprietaryInformationofZTECORPORATION77