ACL Configuration
show acl table
[Command] show acl table [ table_name ]
[Purpose] Show existing ACL tables
[Parameter]
Parameter | Description |
|---|---|
table_name | Specify the table name |
[View] System view
[Use Cases]
sonic# show acl table
Name Type Binding Description Stage
------- ----------- --------- ------------- -------
TABLE_2 L3 Ethernet8 TABLE_2 ingressshow acl rule
[Command] show acl rule [ table_name ] [ rule_id ]
[Purpose] Show existing ACL rules
[Parameter]
Parameter | Description |
|---|---|
table_name | Specify the table name |
rule_id | Specify the rule name |
[View] System view
[Use Cases]
sonic# show acl rule
Table Rule Priority Action Match
------- ------------ ---------- -------- -----------------------
DATAACL RULE_1 9999 DROP SRC_IP: 10.0.0.2/32
DATAACL RULE_2 9998 DROP DST_IP: 192.168.0.16/32
DATAACL RULE_3 9997 DROP L4_SRC_PORT: 4661
DATAACL RULE_4 9996 DROP IP_PROTOCOL: 126
DATAACL RULE_13 9987 DROP IP_PROTOCOL: 1
sonic# show acl rule TABLE_1 RULE_1
Table Rule Priority Action Match
------- ------ ---------- -------- --------------------
TABLE_1 RULE_1 100 DROP SRC_IP: 200.0.0.2/24show counters acl
[Command] show counters acl [ acl_table_name ] [ rule_id ]
[Purpose] Show ACL hit count
[Parameter]
Parameter | Description |
|---|---|
acl_table_name | ACL Table Name |
rule_id | rule id |
[View] System view
[Notes] Allows multiple tables and rules to be entered, either as individual tables or as table + rule. Table and table are separated by ",", rule and rule are separated by ","; table and rule are separated by spaces.
[Use Cases]
sonic# show counters acl TABLE_1,TABLE_2
RULE NAME TABLE NAME PRIO PACKETS COUNT BYTES COUNT
----------- ------------ ------ --------------- -------------
RULE_1 TABLE_1 100 N/A N/A
rule_2 TABLE_2 2 N/A N/A
rule_1 TABLE_2 1 N/A N/Aclear counters acl
[Command] clear counters acl
[Purpose] Clear ACL hit count
[Use Cases]
sonic# clear counters aclaccess-list
[Command] access-list { table_type } { table_name } { table_stage } no access-list { table_name }
[Purpose] Create ACL table and enter ACL view
[Parameter]
Parameter | Description |
|---|---|
table_type | ACL table type, optional L3, L3v6, CTRLPLANE |
table_name | ACL Table Name |
table_stage | Specify the inbound/outbound direction, ingress/egress |
[View] System configuration view
[Use Cases]
sonic# configure terminal
sonic(config)# access-list l3 TABLE_1 ingressrule
[Command] rule {rule_id rule_id } [{packet-action {deny|permit|trap-to-cpu|copy-to-cpu}|redirect-action}] [src-mac src_mac ] [ethernet-type ethernet_type ] [vlan-pri vlan_pri ] [src-ip src_ip ] [dst-ip dst_ip ] [icmp-type icmp_type ] [icmp-code icmp_code ] [icmp-name icmp_name ] [src-port src_port ] [dst-port dst_port ] [ip-type ip_type ] no rule { rule_id }
[Purpose] Add ACL rules
[Parameter]
Parameter | Description |
|---|---|
rule_id | Rule ID, value range: 0-500; simultaneously indicates rule priority (higher numbers indicate higher priority), values must be unique |
packet_action | Packet processing actions for matched rules: deny- Discard permit- Allow passage trap-to-cpu - Forward to CPU for processing copy-to-cpu - Allow passage while simultaneously copying the packet to the CPU for processing |
ethernet_type | Ethertype, format: hexadecimal number |
vlan_pri | VLAN priority, value range: 0-7 |
src_ip | Source IP address, format: A.B.C.D/M |
dst_ip | Destination IP address, format: A.B.C.D/M |
icmp_type | ICMP message type, value range: 0-16 |
icmp_code | ICMP message code, value range: 0-5 |
icmp_name | ICMP message name |
src_port | Source L4 port |
dst_port | Destination L4 port |
ip_type | Ip type |
[View] ACL view
[Notes] Multiple ACL rules can exist per table. rule_id The higher the value, the higher the priority, the same table does not allow the configuration of the same priority rules.
[Use Cases]
sonic# configure terminal
sonic(config)# access-list l3 TABLE_1 ingress
sonic(config-l3-acl-table_1)# rule 1 source-ip 10.0.0.3/24 packet-action permitacl
[Command]
acl acl_name no acl acl_name
[Purpose]
Bind ACL table on Interface
[Parameter]
Parameter | Description |
|---|---|
acl_name | ACL table name |
[View]
System Configuration View,Interface Configuration View,VLANIF View,LAG View
[Comment]
The ACL table is bound to ports. After binding to a port, it means that the ACL table takes effect on the traffic on these ports. One ACL table can be bound to multiple ports, and one port can also have multiple ACL tables, representing a "many-to-many" relationship. The ACL table is bound in the global View, meaning it takes effect on all physical interfaces of the device's panels.
[Use Cases]
sonic# configure terminal
sonic(config)# acl test
sonic(config)# interface ethernet 1
sonic(config-if-1)# acl test1