Hello, friend!
Currently, the device supports the following ACL implementation modes:
Software ACL: matches packets exchanged with the local device (packets that must be sent to the CPU for processing), such as the ACL referenced by FTP, TFTP, Telnet, SNMP, HTTP, routing protocols, and multicast protocols.
Hardware-based ACL: applies to all packets (generally forwarded data packets) and delivers hardware-based ACL resources to match the ACLs of packets, such as the ACL referenced in the traffic policy, ACL-based simplified traffic policy, user group, and outer tag adding function.
The main difference between the two modes is that they process different types of packets.
The former is implemented by software. The latter is implemented by hardware. Matching packets using the former consumes CPU resources.
Thank you!