ACL Overview

An Access Control List (ACL) is a set of rules permitting or denying access based on source and destination IP addresses or subnets, protocol, and application ports. You create a list using the accessList command and add match statements using one of the accessList rule commands. When you specify a list name for either command, if the named list does not exist, the system creates it.

Note:Although the accessList rule command is technically a single command with parameters that vary depending on the arguments supplied (a type-based view), for clarity it is presented as multiple commands here, based on the protocol type.

Setting rule precedence

When you create a rule for an ACL, you associate a "precedence" with the rule using the ruleIndex argument. When more than one rule applies to an individual packet, the rule with the lowest ruleIndex is selected. It is a good idea to position more specific rules with a lower ruleIndex value, otherwise they could be ineffective. For example, if rule #1 denies all ICMP traffic, and rule #2 permits ICMP echo requests, echo requests will be dropped because rule #1, with higher precedence, denied ICMP. Every access list ends with an implicit "deny all" rule. In the case that traffic does not match any of the configured rules, it is handled by the implicit deny, and the traffic is dropped. This rule cannot be deleted or modified.

Working with ACLs

Once an ACL is created, it is applied to one or more IP interfaces with the accessGroup command. Every IP interface can support one inbound and one outbound ACL and a single ACL can be applied to many interfaces. Each vRouter can support up to four lists, and each list can support up to 256 rules. Rules within an access list can be added, deleted, modified, enabled, and disabled. Access control lists are enabled by default.

Entering source and destination addresses

Both source and destination addresses are optional filters, and each can be entered in any of the forms below. That is, you can use either the same or different formats. Use the following formats to enter the ruleSrcAddrs or ruleDstAddrs arguments to define match criteria for permitting or denying traffic.

ACL protocol types

The following protocols can be specified as a match for filtering. Any of these values can be used with the ruleProto argument to define match criteria for permitting or denying traffic. For well-known protocols, you can supply a name or integer (names are listed in the table below). For less common protocols, you can use the protocol number, as defined by the Internet assigned numbers authority http://www.iana.org/numbers.html