3Com Switch 8800 Configuration Guide Chapter 32 ACL Configuration
32-2
Note:
Depth first principle means putting the statement with smaller packet range in the front.
You can know the packet range by comparing IP address wildcards: The smaller the
wildcard is, the smaller host range is. For example, the address 129.102.1.1 0.0.0.0
specifies the host 129.102.1.1 and address 129.102.1.1 0.0.255.255 specifies the
segment 129.102.1.1 to 129.102.255.255. Then 129.102.1.1 is surely put in the front.
Specifically, for the statements of basic ACL rules, directly compare the wildcards of
source addresses and follow config order if the wildcards are equal; for the ACL rules
used in port packet filtering, the rules configured with any are put to the end and other
rules follow config order; for advanced ACL rules, first compare the wildcards of source
addresses, then the wildcards of destination addresses if those of source addresses
are equal, then the port IDs if the wildcards of destination addresses are still equal.
Follow config order if port IDs are also equal.
Note:
The user-defined ACL matching order takes effect only when multiple rules of one ACL
are applied at the same time. For example, an ACL has two rules. If the two rules are
not applied simultaneously, even if you configure the matching order to be depth first,
the switch still matches them according to their application order.
If one rule is a subset of another rule in an ACL, it is recommended to apply the rules
according to the range of the specified packets. The rule with the smallest range of the
specified data packets is applied first, and then other rules are applied based on this
principle.
The switch supports these types of ACLs:
z Number-based basic ACLs
z Name-based basic ACLs
z Number-based advanced ACLs
z Name-based advanced ACLs
z Number-based L2 ACLs
z Name-based L2 ACLs
z Number-based user ACLs
z Name-based user ACLs
The requirements for the various ACLs available on the switch are listed in the following
table.