ACL Fundamentals and Configuration

What it is

An ACL (access control list) is an ordered list of rules that match packets by fields such as source address, destination address, protocol and port. Each rule has an action, permit or deny.

An ACL only classifies traffic. What happens to matched packets depends on the feature that calls the ACL, such as packet filtering (traffic-filter), NAT, routing policy, QoS or limiting who may log in through VTY.

How it works

ACL types and numbers

An ACL can also be created with a name instead of only a number, with acl name, to make its purpose clear.

Rules, rule IDs and step

Each rule has an ID. If you do not give one, VRP assigns IDs using a step of 5 by default, so rules become 5, 10, 15 and so on. The gaps let you insert a new rule, such as rule 7, between existing ones later.

Wildcard masks

ACLs use a wildcard mask after the address. A 0 bit must match and a 1 bit is ignored.

Unlike a subnet mask, a wildcard does not need contiguous bits. That is how the last example matches only odd addresses.

Match order and the default action

The default match order is config: rules are checked from the lowest rule ID upward. The first rule that matches decides, and checking stops. With match-order auto, VRP orders rules by depth first, so more specific rules are checked first.

If no rule matches, the result depends on the calling feature. With traffic-filter on Huawei routers and switches, a packet that matches no rule is permitted. That is why a filter that should block one source must still be written carefully, and why a rule that should allow only one network needs an explicit deny afterward.

Inbound and outbound

traffic-filter inbound checks packets as they enter the interface. traffic-filter outbound checks packets as they leave it.

A general guide: place an advanced ACL close to the source, so unwanted traffic is dropped early. Place a basic ACL close to the destination, because it matches only the source address and could block more than intended if placed near the source.

Configuration example: basic ACL

Block the 192.168.1.0/24 network from reaching the server LAN behind GigabitEthernet0/0/2, and allow everything else.

[R1] acl 2000
[R1-acl-basic-2000] rule 5 deny source 192.168.1.0 0.0.0.255
[R1-acl-basic-2000] rule 10 permit
[R1-acl-basic-2000] quit
[R1] interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] traffic-filter outbound acl 2000

Configuration example: advanced ACL

Allow 192.168.1.0/24 to reach web server 10.1.1.10 on TCP port 80 only, and stop it reaching that server any other way.

[R1] acl 3000
[R1-acl-adv-3000] rule 5 permit tcp source 192.168.1.0 0.0.0.255 destination 10.1.1.10 0 destination-port eq 80
[R1-acl-adv-3000] rule 10 deny ip source 192.168.1.0 0.0.0.255 destination 10.1.1.10 0
[R1-acl-adv-3000] quit
[R1] interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1] traffic-filter inbound acl 3000

Check the rules and their match counts with display acl 3000.

A worked example

An administrator writes rule 5 permit source 10.1.0.0 0.0.255.255 and then rule 10 deny source 10.1.1.0 0.0.0.255, expecting 10.1.1.0/24 to be blocked.

A packet from 10.1.1.5 matches rule 5 first and is permitted. Rule 10 is never reached. The fix is to put the more specific deny at a lower rule ID, for example rule 3.

How the exam asks about this

• "Which ACL number range is used for advanced ACLs on Huawei devices?" → 3000 to 3999.
• "With the default config match order, which rule is checked first?" → The rule with the smallest rule ID.
• "Which wildcard mask matches exactly one host?" → 0.0.0.0, written as 0 in a VRP rule.