Routing Policy and Routing Control-Route Control Tool-Route Matching Tool-ACL

Routing Control Tool - Route Matching Tool - ACL

OBJECTIVE

The purpose of this post is to present an introduction to Routing Policy and Routing Control - Route Control Tool.

Route Matching Tool 1: ACL

• An access control list (ACL) is a matching tool that can match and distinguish packets and routes.

• An ACL consists of multiple permit, deny, or both clauses. Each statement is a rule of the ACL. The permit or deny action in each statement is an action bound to the rule.

• An ACL consists of the following elements:

▫ ACL number: Each ACL configured on a device is assigned a number, which is called an ACL number and is used to identify the ACL. The ACL number range varies according to the ACL type.

▫ Rule: As mentioned above, an ACL is usually consists of multiple permit, deny, or both clauses, and each clause is a rule of the ACL.

▫ Rule number: Each rule has a rule number. which identifies and ACL rule. The value can be user-defined or automatically allocated by the system. The number of an ACL rule is an integer ranging from 0 to 4294967294. All ACL rules are numbered in ascending order.

▫ Action: "Permit" or "Deny" in each rule is an action bound to a rule. ACLs are usually used together with other technologies. The meanings of actions vary according to the scenarios.

▪ For example, if and ACL is used together with a traffic filtering technology (the ACL is applied to the traffic filtering function), "permit" indicates that traffic is allowed to pass, and "deny" indicates that traffic is rejected.

▫ Item to be matched against: The ACL defines abundant items to be matched against. In this example, the source IP address is used. The ACL also supports many other items. For instance, the items can be Layer 2 Ethernet frame header information (such as a source MAC address, destination MAC address, and Ethernet frame protocol type), Layer 3 packet information (such as a destination address and protocol type), or Layer 4 packet information (such as a TCP/UDP port number).

• Question: What does the rule 5 permit source 1.1.1.0 0.0.0.255 command meanh This will be introduced later.

Wildcard

Matching rule:

0: match; 1: no match

• For an IP address to be matched against a matching rule, the address is followed by a 32-bit mask. The 32-bit mask is called a wildcard.

• The wilcard is in dotted decimal notation. After it is converted into the binary format, value 0 indicates a "match" and value 1 indicates "no match". 1s or 0s in the wildcard may be discontinuous.

• There are two examples:

▫ rule 5: rejects packets with source IP address 10.1.1.1. The all-0 wilcard indicates that each bit must be exactly matched. Therefore, the host IP address 10.1.1.1 matches the rule.

▫ rule 15: permits packets whose source IP address belong to network segment 10.1.1.0/24. The wildcard is 0.0.0.111111111, and the right-most 8 bits are 1, which indicates that these bits in packets can be ignored. As such, the right-most 8 bits in 10.1.xxxxxxxx can be any value, and the network segment 10.1.1.0/24 matches this rule.

• Example: To exactly match the network segment address of 192.168.1.1/24, which wildcard can be used?

▫ It can be concluded that network bits must be exactly matched and host bits can be ignored. Therefore, the wildcard is 0.0.0.255.

• Two special wildcards:

▫ The all-0 wildcard is used to exactly match a specific IP address.

▫ When the all-1 wilcard is used to match 0.0.0.0, it indicates that all IP addresses are matched.

ACL Classification and Basic ACLs

• Classification based on the ACL rule definition mode

• Basic ACL

• Only basic ACLs can be used to match routes.

ACL Fundamentals

• The ACL matching mechanism is as follows:

▪ After a device configured with an ACL receives a packet, the device matches the packey against ACL rules one by one. If the packet does not match an ACL rule, the device attempts to match the packet against a next rule.

▪ Once the packet matches a rule, the device performs the action defined in the rule on the packet and no longer matches the packet against other rules.

• Matching process:

• The device checks whether an ACL is configured.

• If no ACL is configured, the device returns the result "negative match".

• If an ACL is configured, the device checks whether the ACL contains rules.

▫ If the ACL does not contatin rules, the device returns the result "negative match".

▫ If the ACL contains rules, the device matches the packets against the rules in ascending order of rule IDs.

When the packets match a permit rule, the device stops matching and returns the result "positive match (permit)".

When the packets match a deny rule, the device stops matching and returns the result "positive match (deny)"

If the packets do not match any rule in the ACL, the device returns the result "negative match."

Matching Order and Result of ACL Rules

Configuration sequence (config mode)

▫ The system matches packets against ACL rules in ascending order by rule ID. A rule with a smaller ID is earlier to be matched.

• An ACL consists of multiple deny | permit clauses, each of which describes a rule. These rules may repeat or conflict . In this situation, the matching order decides the matching result.

• Huawei devices support two matching orders: automatic order (auto mode) and configured order (config mode). The configured mode is used by default.

▫ Automatic order: The system arranges rules according to precision degree of the rules (depth first principle), and matches packets against the rules in descending order of precision. A rule with the highest precision defines strictest conditions, and has the highest priority. This process is complex, so we will not go into details here. Anyone interested in this can read materials after class.

▫ Configured order: The system matches packets againsta ACL rules in ascending order of rule IDs. That is, the rule with the smallest ID is processed first. This is the matching order we mentioned earlier.

If another rule is added, the rule is added to a corresponding position, and packets are still matched against the rules in ascending order by rule ID.

ACLs are always used together with other technologies. The actual functions of "permit" and "deny" vary with technologies. For example, when an ACL is used together with route filtering, "permit" means that a route is a match, and "deny" means that a route is not a match.