(Optional) Configuring an ACL IP Address Pool
An ACL IP address pool is applicable to the scenario in which multiple IP addresses need to be matched and reduces the configuration workload.
Context
In typical ACL usage scenarios, for example, in the policy-based routing scenario, multiple IP addresses need to be matched. To implement policy-based routing using ACL rules to match both source and destination IP addresses carried in packets, specify all possible combinations of source IP addresses and destination IP addresses when configuring ACL rules. However, these combinations are over 10 thousands on a large-scale network. It is unreasonable to configure manually all ACL rules that match both source and destination IP addresses carried in packets.
In scenarios in which ACL rules are used to match both source and destination IP addresses carried in packets, run the acl ip-pool command to create an ACL source IP address pool (which includes all needed IP addresses) and an ACL destination IP address pool (which includes all needed destination IP addresses), respectively.
If you need to filter packets with the source address being the IP address of a BGP peer, run the apply bgp-peer command to associate the IP address of the BGP peer with the ACL address pool. Then configure QoS or security services to reference the ACL to filter traffic of the BGP peer.
Procedure
- Run system-view
The system view is displayed.
- Run acl ip-pool pool-name
An ACL IP address pool is created and the IP address pool view is displayed.
- Add an IP address to the ACL IP address pool, associate IP addresses of BGP peers with the address pool, or associate interface IP addresses with the address pool.
Run the ip address ip-address { mask | mask-length } command to add IP addresses to the ACL IP address pool.
If the ip address command is run more than once, all configurations take effect.
- Run the apply bgp-peer [ public-vpn | all-private-vpn | vpn-instance vpn-instance-name ] command to associate IP addresses of BGP peers with the address pool.
This command is applicable only to QoS or device security services.
- Run the apply interface-address { main-interface | sub-interface | all-interface } [ public-vpn | all-private-vpn | vpn-instance VpnInstanceName ] command to associate interface IP addresses with the address pool.
- Run commit
The configuration is committed.