After an ACL is configured, it must be applied to a service module so that the ACL rules can be delivered and take effect.
In most cases, an ACL is applied to a traffic policy or simplified traffic policy. This enables the device to deliver ACL rules globally, in a VLAN, or on an interface to filter packets to be forwarded. An ACL can be applied to service modules such as Telnet, FTP, and routing.
Service |
Usage Scenario |
How ACLs Are Used |
Supported ACL Type |
|---|---|---|---|
Filtering packets to be forwarded |
The device filters received packets globally, on an interface, or in a VLAN, and then discards, modifies priorities of, or redirects the filtered packets. For example, you can apply ACLs to filter packets between different network segments, prohibit specified hosts from accessing the network during a specified time, or reduce the service level for bandwidth-consuming services (such as P2P downloading and online video). When network congestion occurs, these bandwidth-consuming service packets are discarded first. |
|
|
Filtering packets to be sent to the CPU |
If too many protocol packets are sent to the CPU, the CPU usage increases and CPU performance may be degraded. The device needs to restrict the packets to be sent to the CPU. For example, when a user sends a large number of ARP attack packets to the device, the CPU becomes busy and service is interrupted. You can apply an ACL to the local attack defense service, and add the user to the blacklist so that the CPU discards the packets from this user. |
|
|
Login control |
The device controls access permission of users. Only authorized users can log in to the device, and other users cannot log in without permission. This ensures network security. |
|
|
Route filtering |
ACLs can be applied to various dynamic routing protocols to filter advertised and received routes and multicast groups. For example, you can apply an ACL to a routing policy to filter routing information and prevent the device from sending routes of a network segment to the neighboring router. |
|
|