云计算百科
云计算领域专业知识百科平台
当前位置：网硕互联帮助中心 > 服务器百科 > 正文

华为 S5735 ACL 访问控制列表：包过滤与放行规则实战

2026-11-04 分类：服务器百科 阅读(9) 评论(0)

一、ACL 基础概念与华为 S5735 支持

1.1 什么是访问控制列表（ACL）

访问控制列表（Access Control List，ACL）是网络设备中用于控制数据包流量的重要工具。ACL 通过定义一系列规则，根据数据包的源地址、目的地址、协议类型、端口号等特征来决定是否允许或拒绝数据包通过。华为 S5735 交换机支持标准 ACL 和扩展 ACL 两种类型，能够满足不同场景下的网络访问控制需求。

1.2 华为 S5735 交换机 ACL 特性

华为 S5735 交换机提供了丰富的 ACL 功能，包括：

  • 支持标准 ACL（基于源 IP 地址过滤）
  • 支持扩展 ACL（基于源/目的 IP、协议、端口等过滤）
  • 支持 IPv4 和 IPv6 ACL
  • 支持时间 ACL（基于时间段的访问控制）
  • 支持用户自定义 ACL（基于用户组或用户）
  • 支持 ACL 在接口上的应用（入方向和出方向）

#publish-mermaid-0-1793425811661{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-0-1793425811661 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-0-1793425811661 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-0-1793425811661 .error-icon{fill:#552222;}#publish-mermaid-0-1793425811661 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-0-1793425811661 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-0-1793425811661 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-0-1793425811661 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-0-1793425811661 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-0-1793425811661 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-0-1793425811661 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-0-1793425811661 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-0-1793425811661 .marker.cross{stroke:#333333;}#publish-mermaid-0-1793425811661 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-0-1793425811661 p{margin:0;}#publish-mermaid-0-1793425811661 .pieCircle{stroke:black;stroke-width:2px;opacity:0.7;}#publish-mermaid-0-1793425811661 .pieCircle.highlighted{scale:1.05;opacity:1;}#publish-mermaid-0-1793425811661 .pieCircle.highlightedOnHover:hover{transition-duration:250ms;scale:1.05;opacity:1;}#publish-mermaid-0-1793425811661 .pieOuterCircle{stroke:black;stroke-width:2px;fill:none;}#publish-mermaid-0-1793425811661 .pieTitleText{text-anchor:middle;font-size:25px;fill:black;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}#publish-mermaid-0-1793425811661 .slice{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;fill:#333;font-size:17px;}#publish-mermaid-0-1793425811661 .legend text{fill:black;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:17px;}#publish-mermaid-0-1793425811661 .node .neo-node{stroke:#9370DB;}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].node rect,#publish-mermaid-0-1793425811661 [data-look=\”neo\”].cluster rect,#publish-mermaid-0-1793425811661 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793425811661 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793425811661 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}30%50%10%10%华为 S5735 ACL 类型分布标准 ACL扩展 ACL时间 ACL用户自定义 ACL

该饼图显示了华为 S5735 交换机支持的 ACL 类型分布，其中扩展 ACL 占比最高，说明其在实际应用中更为常用。

二、ACL 规则匹配原理

2.1 ACL 匹配流程

ACL 规则的匹配遵循"自上而下"的原则，设备从第一条规则开始依次检查，一旦找到匹配的规则就立即执行相应的动作（允许或拒绝），不再继续检查后续规则。如果所有规则都不匹配，则默认拒绝。

#publish-mermaid-1-1793425811672{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-1-1793425811672 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-1-1793425811672 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-1-1793425811672 .error-icon{fill:#552222;}#publish-mermaid-1-1793425811672 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-1-1793425811672 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-1-1793425811672 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-1-1793425811672 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-1-1793425811672 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-1-1793425811672 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-1-1793425811672 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-1-1793425811672 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-1-1793425811672 .marker.cross{stroke:#333333;}#publish-mermaid-1-1793425811672 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-1-1793425811672 p{margin:0;}#publish-mermaid-1-1793425811672 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-1-1793425811672 .cluster-label text{fill:#333;}#publish-mermaid-1-1793425811672 .cluster-label span{color:#333;}#publish-mermaid-1-1793425811672 .cluster-label span p{background-color:transparent;}#publish-mermaid-1-1793425811672 .label text,#publish-mermaid-1-1793425811672 span{fill:#333;color:#333;}#publish-mermaid-1-1793425811672 .node rect,#publish-mermaid-1-1793425811672 .node circle,#publish-mermaid-1-1793425811672 .node ellipse,#publish-mermaid-1-1793425811672 .node polygon,#publish-mermaid-1-1793425811672 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-1-1793425811672 .rough-node .label text,#publish-mermaid-1-1793425811672 .node .label text,#publish-mermaid-1-1793425811672 .image-shape .label,#publish-mermaid-1-1793425811672 .icon-shape .label{text-anchor:middle;}#publish-mermaid-1-1793425811672 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-1-1793425811672 .rough-node .label,#publish-mermaid-1-1793425811672 .node .label,#publish-mermaid-1-1793425811672 .image-shape .label,#publish-mermaid-1-1793425811672 .icon-shape .label{text-align:center;}#publish-mermaid-1-1793425811672 .node.clickable{cursor:pointer;}#publish-mermaid-1-1793425811672 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-1-1793425811672 .arrowheadPath{fill:#333333;}#publish-mermaid-1-1793425811672 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-1-1793425811672 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-1-1793425811672 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-1-1793425811672 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-1-1793425811672 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-1-1793425811672 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-1-1793425811672 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-1-1793425811672 .cluster text{fill:#333;}#publish-mermaid-1-1793425811672 .cluster span{color:#333;}#publish-mermaid-1-1793425811672 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-1-1793425811672 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-1-1793425811672 rect.text{fill:none;stroke-width:0;}#publish-mermaid-1-1793425811672 .icon-shape,#publish-mermaid-1-1793425811672 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-1-1793425811672 .icon-shape p,#publish-mermaid-1-1793425811672 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-1-1793425811672 .icon-shape .label rect,#publish-mermaid-1-1793425811672 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-1-1793425811672 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-1-1793425811672 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-1-1793425811672 .node .neo-node{stroke:#9370DB;}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].node rect,#publish-mermaid-1-1793425811672 [data-look=\”neo\”].cluster rect,#publish-mermaid-1-1793425811672 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793425811672 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793425811672 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}匹配不匹配匹配不匹配匹配不匹配

数据包到达

检查 ACL 规则

规则 1: 源 IP 192.168.1.0/24

执行动作: 允许/拒绝

规则 2: 源 IP 10.0.0.0/8

执行动作: 允许/拒绝

规则 3: 源 IP 172.16.0.0/16

执行动作: 允许/拒绝

默认动作: 拒绝

上图展示了 ACL 规则的匹配流程，数据包依次匹配每条规则，直到找到匹配项或到达默认动作。

2.2 ACL 规则优先级

在华为 S5735 交换机中，ACL 规则的优先级可以通过 sequence-number（序列号）来控制。序列号越小，优先级越高。当多条规则具有相同的匹配条件时，序列号较小的规则会先被匹配。

#publish-mermaid-2-1793425811727{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-2-1793425811727 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-2-1793425811727 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-2-1793425811727 .error-icon{fill:#552222;}#publish-mermaid-2-1793425811727 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-2-1793425811727 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-2-1793425811727 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-2-1793425811727 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-2-1793425811727 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-2-1793425811727 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-2-1793425811727 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-2-1793425811727 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-2-1793425811727 .marker.cross{stroke:#333333;}#publish-mermaid-2-1793425811727 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-2-1793425811727 p{margin:0;}#publish-mermaid-2-1793425811727 defs [id$=\”-barbEnd\”]{fill:#333333;stroke:#333333;}#publish-mermaid-2-1793425811727 g.stateGroup text{fill:#9370DB;stroke:none;font-size:10px;}#publish-mermaid-2-1793425811727 g.stateGroup text{fill:#333;stroke:none;font-size:10px;}#publish-mermaid-2-1793425811727 g.stateGroup .state-title{font-weight:bolder;fill:#131300;}#publish-mermaid-2-1793425811727 g.stateGroup rect{fill:#ECECFF;stroke:#9370DB;}#publish-mermaid-2-1793425811727 g.stateGroup line{stroke:#333333;stroke-width:1;}#publish-mermaid-2-1793425811727 .transition{stroke:#333333;stroke-width:1;fill:none;}#publish-mermaid-2-1793425811727 .stateGroup .composit{fill:white;border-bottom:1px;}#publish-mermaid-2-1793425811727 .stateGroup .alt-composit{fill:#e0e0e0;border-bottom:1px;}#publish-mermaid-2-1793425811727 .state-note{stroke:#aaaa33;fill:#fff5ad;}#publish-mermaid-2-1793425811727 .state-note text{fill:black;stroke:none;font-size:10px;}#publish-mermaid-2-1793425811727 .stateLabel .box{stroke:none;stroke-width:0;fill:#ECECFF;opacity:0.5;}#publish-mermaid-2-1793425811727 .edgeLabel .label rect{fill:#ECECFF;opacity:0.5;}#publish-mermaid-2-1793425811727 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-2-1793425811727 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793425811727 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793425811727 .edgeLabel .label text{fill:#333;}#publish-mermaid-2-1793425811727 .label div .edgeLabel{color:#333;}#publish-mermaid-2-1793425811727 .stateLabel text{fill:#131300;font-size:10px;font-weight:bold;}#publish-mermaid-2-1793425811727 .node circle.state-start{fill:#333333;stroke:#333333;}#publish-mermaid-2-1793425811727 .node .fork-join{fill:#333333;stroke:#333333;}#publish-mermaid-2-1793425811727 .node circle.state-end{fill:#9370DB;stroke:white;stroke-width:1.5;}#publish-mermaid-2-1793425811727 .end-state-inner{fill:white;stroke-width:1.5;}#publish-mermaid-2-1793425811727 .node rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793425811727 .node polygon{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793425811727 [id$=\”-barbEnd\”]{fill:#333333;}#publish-mermaid-2-1793425811727 .statediagram-cluster rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793425811727 .cluster-label,#publish-mermaid-2-1793425811727 .nodeLabel{color:#131300;}#publish-mermaid-2-1793425811727 .statediagram-cluster rect.outer{rx:5px;ry:5px;}#publish-mermaid-2-1793425811727 .statediagram-state .divider{stroke:#9370DB;}#publish-mermaid-2-1793425811727 .statediagram-state .title-state{rx:5px;ry:5px;}#publish-mermaid-2-1793425811727 .statediagram-cluster.statediagram-cluster .inner{fill:white;}#publish-mermaid-2-1793425811727 .statediagram-cluster.statediagram-cluster-alt .inner{fill:#f0f0f0;}#publish-mermaid-2-1793425811727 .statediagram-cluster .inner{rx:0;ry:0;}#publish-mermaid-2-1793425811727 .statediagram-state rect.basic{rx:5px;ry:5px;}#publish-mermaid-2-1793425811727 .statediagram-state rect.divider{stroke-dasharray:10,10;fill:#f0f0f0;}#publish-mermaid-2-1793425811727 .note-edge{stroke-dasharray:5;}#publish-mermaid-2-1793425811727 .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#publish-mermaid-2-1793425811727 .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#publish-mermaid-2-1793425811727 .statediagram-note text{fill:black;}#publish-mermaid-2-1793425811727 .statediagram-note .nodeLabel{color:black;}#publish-mermaid-2-1793425811727 .statediagram .edgeLabel{color:red;}#publish-mermaid-2-1793425811727 [id$=\”-dependencyStart\”],#publish-mermaid-2-1793425811727 [id$=\”-dependencyEnd\”]{fill:#333333;stroke:#333333;stroke-width:1;}#publish-mermaid-2-1793425811727 .statediagramTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].statediagram-cluster rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1;}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].statediagram-cluster rect.outer{rx:5px;ry:5px;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793425811727 .node .neo-node{stroke:#9370DB;}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].node rect,#publish-mermaid-2-1793425811727 [data-look=\”neo\”].cluster rect,#publish-mermaid-2-1793425811727 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793425811727 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793425811727 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}规则1

匹配条件1

动作1

规则2

匹配条件2

动作2

规则3

匹配条件3

动作3

该状态图展示了 ACL 规则的优先级顺序，规则 1 具有最高优先级，规则 3 优先级最低。

三、标准 ACL 配置实战

3.1 基本配置步骤

标准 ACL 基于源 IP 地址进行过滤，配置步骤如下：

  • 进入系统视图：system-view
  • 创建 ACL：acl number 2000
  • 配置规则：rule [sequence-number] permit/deny source source-ip source-wildcard
  • 在接口上应用 ACL：interface interface-type interface-number
  • 配置 ACL 方向：packet-filter 2000 inbound/outbound

    • 3.2 实际案例

    假设我们需要允许 192.168.1.0/24 网段的用户访问互联网，拒绝其他网段访问。配置如下：

    互联网交换机用户互联网交换机用户#publish-mermaid-3-1793425811809{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-3-1793425811809 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-3-1793425811809 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-3-1793425811809 .error-icon{fill:#552222;}#publish-mermaid-3-1793425811809 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-3-1793425811809 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-3-1793425811809 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-3-1793425811809 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-3-1793425811809 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-3-1793425811809 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-3-1793425811809 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-3-1793425811809 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793425811809 .marker.cross{stroke:#333333;}#publish-mermaid-3-1793425811809 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-3-1793425811809 p{margin:0;}#publish-mermaid-3-1793425811809 .actor{stroke:#9370DB;fill:#ECECFF;stroke-width:1;}#publish-mermaid-3-1793425811809 rect.actor.outer-path[data-look=\”neo\”]{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793425811809 rect.note[data-look=\”neo\”]{stroke:#aaaa33;fill:#fff5ad;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793425811809 text.actor>tspan{fill:black;stroke:none;}#publish-mermaid-3-1793425811809 .actor-line{stroke:#9370DB;}#publish-mermaid-3-1793425811809 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#publish-mermaid-3-1793425811809 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#publish-mermaid-3-1793425811809 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#publish-mermaid-3-1793425811809 [id$=\”-arrowhead\”] path{fill:#333;stroke:#333;}#publish-mermaid-3-1793425811809 .sequenceNumber{fill:white;}#publish-mermaid-3-1793425811809 [id$=\”-sequencenumber\”]{fill:#333;}#publish-mermaid-3-1793425811809 [id$=\”-crosshead\”] path{fill:#333;stroke:#333;}#publish-mermaid-3-1793425811809 .messageText{fill:#333;stroke:none;}#publish-mermaid-3-1793425811809 .labelBox{stroke:#9370DB;fill:#ECECFF;filter:none;}#publish-mermaid-3-1793425811809 .labelText,#publish-mermaid-3-1793425811809 .labelText>tspan{fill:black;stroke:none;}#publish-mermaid-3-1793425811809 .loopText,#publish-mermaid-3-1793425811809 .loopText>tspan{fill:black;stroke:none;}#publish-mermaid-3-1793425811809 .sectionTitle,#publish-mermaid-3-1793425811809 .sectionTitle>tspan{fill:black;stroke:none;}#publish-mermaid-3-1793425811809 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:#9370DB;fill:#9370DB;}#publish-mermaid-3-1793425811809 .note{stroke:#aaaa33;fill:#fff5ad;}#publish-mermaid-3-1793425811809 .noteText,#publish-mermaid-3-1793425811809 .noteText>tspan{fill:black;stroke:none;font-weight:normal;}#publish-mermaid-3-1793425811809 .activation0{fill:#f4f4f4;stroke:#666;}#publish-mermaid-3-1793425811809 .activation1{fill:#f4f4f4;stroke:#666;}#publish-mermaid-3-1793425811809 .activation2{fill:#f4f4f4;stroke:#666;}#publish-mermaid-3-1793425811809 .actorPopupMenu{position:absolute;}#publish-mermaid-3-1793425811809 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#publish-mermaid-3-1793425811809 .actor-man circle,#publish-mermaid-3-1793425811809 line{fill:#ECECFF;stroke-width:2px;}#publish-mermaid-3-1793425811809 g rect.rect{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));stroke:#9370DB;}#publish-mermaid-3-1793425811809 .node .neo-node{stroke:#9370DB;}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].node rect,#publish-mermaid-3-1793425811809 [data-look=\”neo\”].cluster rect,#publish-mermaid-3-1793425811809 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793425811809 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793425811809 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}alt[源 IP 为192.168.1.x][源 IP 为其他网段]发起访问请求检查源 IP 地址转发请求返回响应转发响应拒绝访问

    该时序图展示了标准 ACL 的实际应用场景，交换机根据源 IP 地址决定是否允许访问互联网。

    四、扩展 ACL 配置实战

    4.1 基本配置步骤

    扩展 ACL 基于源/目的 IP、协议、端口等特征进行过滤，配置步骤如下：

  • 进入系统视图：system-view
  • 创建 ACL：acl number 3000
  • 配置规则：rule [sequence-number] permit/deny protocol source source-ip source-wildcard destination destination-ip destination-wildcard [destination-port destination-port]
  • 在接口上应用 ACL：interface interface-type interface-number
  • 配置 ACL 方向：packet-filter 3000 inbound/outbound

    • 4.2 实际案例

    假设我们需要允许内网用户访问外部 Web 服务器（80 端口），但禁止访问 FTP 服务器（21 端口）。配置如下：

    #publish-mermaid-4-1793425811829{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-4-1793425811829 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-4-1793425811829 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-4-1793425811829 .error-icon{fill:#552222;}#publish-mermaid-4-1793425811829 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-4-1793425811829 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-4-1793425811829 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-4-1793425811829 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-4-1793425811829 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-4-1793425811829 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-4-1793425811829 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-4-1793425811829 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-4-1793425811829 .marker.cross{stroke:#333333;}#publish-mermaid-4-1793425811829 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-4-1793425811829 p{margin:0;}#publish-mermaid-4-1793425811829 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-4-1793425811829 .cluster-label text{fill:#333;}#publish-mermaid-4-1793425811829 .cluster-label span{color:#333;}#publish-mermaid-4-1793425811829 .cluster-label span p{background-color:transparent;}#publish-mermaid-4-1793425811829 .label text,#publish-mermaid-4-1793425811829 span{fill:#333;color:#333;}#publish-mermaid-4-1793425811829 .node rect,#publish-mermaid-4-1793425811829 .node circle,#publish-mermaid-4-1793425811829 .node ellipse,#publish-mermaid-4-1793425811829 .node polygon,#publish-mermaid-4-1793425811829 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-4-1793425811829 .rough-node .label text,#publish-mermaid-4-1793425811829 .node .label text,#publish-mermaid-4-1793425811829 .image-shape .label,#publish-mermaid-4-1793425811829 .icon-shape .label{text-anchor:middle;}#publish-mermaid-4-1793425811829 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-4-1793425811829 .rough-node .label,#publish-mermaid-4-1793425811829 .node .label,#publish-mermaid-4-1793425811829 .image-shape .label,#publish-mermaid-4-1793425811829 .icon-shape .label{text-align:center;}#publish-mermaid-4-1793425811829 .node.clickable{cursor:pointer;}#publish-mermaid-4-1793425811829 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-4-1793425811829 .arrowheadPath{fill:#333333;}#publish-mermaid-4-1793425811829 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-4-1793425811829 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-4-1793425811829 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-4-1793425811829 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-4-1793425811829 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-4-1793425811829 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-4-1793425811829 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-4-1793425811829 .cluster text{fill:#333;}#publish-mermaid-4-1793425811829 .cluster span{color:#333;}#publish-mermaid-4-1793425811829 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-4-1793425811829 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-4-1793425811829 rect.text{fill:none;stroke-width:0;}#publish-mermaid-4-1793425811829 .icon-shape,#publish-mermaid-4-1793425811829 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-4-1793425811829 .icon-shape p,#publish-mermaid-4-1793425811829 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-4-1793425811829 .icon-shape .label rect,#publish-mermaid-4-1793425811829 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-4-1793425811829 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-4-1793425811829 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-4-1793425811829 .node .neo-node{stroke:#9370DB;}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].node rect,#publish-mermaid-4-1793425811829 [data-look=\”neo\”].cluster rect,#publish-mermaid-4-1793425811829 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793425811829 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793425811829 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}匹配不匹配匹配不匹配匹配

    内网用户

    检查扩展 ACL 规则

    规则 1: 允许 TCP 80 端口

    允许访问 Web 服务器

    规则 2: 拒绝 TCP 21 端口

    拒绝访问 FTP 服务器

    规则 3: 允许其他流量

    允许访问其他服务

    该流程图展示了扩展 ACL 的实际应用，通过协议和端口号的组合过滤实现精细化的访问控制。

    五、ACL 应用场景

    5.1 流量过滤

    ACL 可以用于过滤特定类型的流量，如：

    应用场景配置示例
    限制特定 IP 访问 rule 5 deny source 192.168.1.100 0
    允许特定网段访问 rule 10 permit source 192.168.1.0 0.0.0.255
    拒绝特定端口访问 rule 15 deny tcp destination-port eq 21

    5.2 安全防护

    ACL 在网络安全防护中发挥重要作用，如：

    • 防止未经授权的访问
    • 限制敏感服务的访问
    • 防止网络扫描和攻击
    • 实现网络分段和隔离

    #publish-mermaid-5-1793425811875{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-5-1793425811875 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-5-1793425811875 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-5-1793425811875 .error-icon{fill:#552222;}#publish-mermaid-5-1793425811875 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-5-1793425811875 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-5-1793425811875 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-5-1793425811875 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-5-1793425811875 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-5-1793425811875 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-5-1793425811875 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-5-1793425811875 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-5-1793425811875 .marker.cross{stroke:#333333;}#publish-mermaid-5-1793425811875 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-5-1793425811875 p{margin:0;}#publish-mermaid-5-1793425811875 g.classGroup text{fill:#9370DB;stroke:none;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:10px;}#publish-mermaid-5-1793425811875 g.classGroup text .title{font-weight:bolder;}#publish-mermaid-5-1793425811875 .cluster-label text{fill:#333;}#publish-mermaid-5-1793425811875 .cluster-label span{color:#333;}#publish-mermaid-5-1793425811875 .cluster-label span p{background-color:transparent;}#publish-mermaid-5-1793425811875 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-5-1793425811875 .cluster text{fill:#333;}#publish-mermaid-5-1793425811875 .cluster span{color:#333;}#publish-mermaid-5-1793425811875 .nodeLabel,#publish-mermaid-5-1793425811875 .edgeLabel{color:#131300;}#publish-mermaid-5-1793425811875 .noteLabel .nodeLabel,#publish-mermaid-5-1793425811875 .noteLabel .edgeLabel{color:black;}#publish-mermaid-5-1793425811875 .edgeLabel .label rect{fill:#ECECFF;}#publish-mermaid-5-1793425811875 .label text{fill:#131300;}#publish-mermaid-5-1793425811875 .labelBkg{background:#ECECFF;}#publish-mermaid-5-1793425811875 .edgeLabel .label span{background:#ECECFF;}#publish-mermaid-5-1793425811875 .classTitle{font-weight:bolder;}#publish-mermaid-5-1793425811875 .node rect,#publish-mermaid-5-1793425811875 .node circle,#publish-mermaid-5-1793425811875 .node ellipse,#publish-mermaid-5-1793425811875 .node polygon,#publish-mermaid-5-1793425811875 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1;}#publish-mermaid-5-1793425811875 .divider{stroke:#9370DB;stroke-width:1;}#publish-mermaid-5-1793425811875 g.clickable{cursor:pointer;}#publish-mermaid-5-1793425811875 g.classGroup rect{fill:#ECECFF;stroke:#9370DB;}#publish-mermaid-5-1793425811875 g.classGroup line{stroke:#9370DB;stroke-width:1;}#publish-mermaid-5-1793425811875 .classLabel .box{stroke:none;stroke-width:0;fill:#ECECFF;opacity:0.5;}#publish-mermaid-5-1793425811875 .classLabel .label{fill:#9370DB;font-size:10px;}#publish-mermaid-5-1793425811875 .relation{stroke:#333333;stroke-width:1;fill:none;}#publish-mermaid-5-1793425811875 .dashed-line{stroke-dasharray:3;}#publish-mermaid-5-1793425811875 .dotted-line{stroke-dasharray:1 2;}#publish-mermaid-5-1793425811875 [id$=\”-compositionStart\”],#publish-mermaid-5-1793425811875 .composition{fill:#333333!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-compositionEnd\”],#publish-mermaid-5-1793425811875 .composition{fill:#333333!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-dependencyStart\”],#publish-mermaid-5-1793425811875 .dependency{fill:#333333!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-dependencyEnd\”],#publish-mermaid-5-1793425811875 .dependency{fill:#333333!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-extensionStart\”],#publish-mermaid-5-1793425811875 .extension{fill:transparent!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-extensionEnd\”],#publish-mermaid-5-1793425811875 .extension{fill:transparent!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-aggregationStart\”],#publish-mermaid-5-1793425811875 .aggregation{fill:transparent!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-aggregationEnd\”],#publish-mermaid-5-1793425811875 .aggregation{fill:transparent!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-lollipopStart\”],#publish-mermaid-5-1793425811875 .lollipop{fill:#ECECFF!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 [id$=\”-lollipopEnd\”],#publish-mermaid-5-1793425811875 .lollipop{fill:#ECECFF!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-5-1793425811875 .edgeTerminals{font-size:11px;line-height:initial;}#publish-mermaid-5-1793425811875 .classTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-5-1793425811875 .edgeLabel[data-look=\”neo\”]{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-5-1793425811875 .edgeLabel[data-look=\”neo\”] p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-5-1793425811875 .edgeLabel[data-look=\”neo\”] rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-5-1793425811875 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-5-1793425811875 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-5-1793425811875 .node .neo-node{stroke:#9370DB;}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].node rect,#publish-mermaid-5-1793425811875 [data-look=\”neo\”].cluster rect,#publish-mermaid-5-1793425811875 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793425811875 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793425811875 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

    ACL

    +number: int

    +type: string

    +rules: list

    +apply_interface: string

    +direction: string

    Standard_ACL

    +source_ip: string

    +wildcard: string

    Extended_ACL

    +protocol: string

    +source_ip: string

    +destination_ip: string

    +source_port: int

    +destination_port: int

    该类图展示了 ACL 的继承关系，标准 ACL 和扩展 ACL 都继承自基础 ACL 类。

    六、ACL 调试与维护

    6.1 常见问题排查

    当 ACL 配置出现问题时，可以通过以下命令进行调试：

  • 显示 ACL 配置：display acl all
  • 显示接口 ACL 应用：display interface interface-type interface-number
  • 显示 ACL 统计信息：display acl counter
  • 跟踪 ACL 匹配过程：debugging acl packet

    • 6.2 性能优化

    为了提高 ACL 性能，建议：

    • 合理规划 ACL 规则顺序，将最常用的规则放在前面
    • 避免过于复杂的 ACL 规则
    • 定期清理无效的 ACL 规则
    • 使用时间 ACL 减少不必要的规则匹配

    #publish-mermaid-6-1793425811928{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-6-1793425811928 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-6-1793425811928 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-6-1793425811928 .error-icon{fill:#552222;}#publish-mermaid-6-1793425811928 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-6-1793425811928 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-6-1793425811928 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-6-1793425811928 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-6-1793425811928 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-6-1793425811928 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-6-1793425811928 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-6-1793425811928 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-6-1793425811928 .marker.cross{stroke:#333333;}#publish-mermaid-6-1793425811928 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-6-1793425811928 p{margin:0;}#publish-mermaid-6-1793425811928 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-6-1793425811928 .cluster-label text{fill:#333;}#publish-mermaid-6-1793425811928 .cluster-label span{color:#333;}#publish-mermaid-6-1793425811928 .cluster-label span p{background-color:transparent;}#publish-mermaid-6-1793425811928 .label text,#publish-mermaid-6-1793425811928 span{fill:#333;color:#333;}#publish-mermaid-6-1793425811928 .node rect,#publish-mermaid-6-1793425811928 .node circle,#publish-mermaid-6-1793425811928 .node ellipse,#publish-mermaid-6-1793425811928 .node polygon,#publish-mermaid-6-1793425811928 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-6-1793425811928 .rough-node .label text,#publish-mermaid-6-1793425811928 .node .label text,#publish-mermaid-6-1793425811928 .image-shape .label,#publish-mermaid-6-1793425811928 .icon-shape .label{text-anchor:middle;}#publish-mermaid-6-1793425811928 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-6-1793425811928 .rough-node .label,#publish-mermaid-6-1793425811928 .node .label,#publish-mermaid-6-1793425811928 .image-shape .label,#publish-mermaid-6-1793425811928 .icon-shape .label{text-align:center;}#publish-mermaid-6-1793425811928 .node.clickable{cursor:pointer;}#publish-mermaid-6-1793425811928 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-6-1793425811928 .arrowheadPath{fill:#333333;}#publish-mermaid-6-1793425811928 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-6-1793425811928 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-6-1793425811928 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-6-1793425811928 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-6-1793425811928 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-6-1793425811928 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-6-1793425811928 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-6-1793425811928 .cluster text{fill:#333;}#publish-mermaid-6-1793425811928 .cluster span{color:#333;}#publish-mermaid-6-1793425811928 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-6-1793425811928 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-6-1793425811928 rect.text{fill:none;stroke-width:0;}#publish-mermaid-6-1793425811928 .icon-shape,#publish-mermaid-6-1793425811928 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-6-1793425811928 .icon-shape p,#publish-mermaid-6-1793425811928 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-6-1793425811928 .icon-shape .label rect,#publish-mermaid-6-1793425811928 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-6-1793425811928 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-6-1793425811928 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-6-1793425811928 .node .neo-node{stroke:#9370DB;}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].node rect,#publish-mermaid-6-1793425811928 [data-look=\”neo\”].cluster rect,#publish-mermaid-6-1793425811928 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-6-1793425811928 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-6-1793425811928 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

    性能问题

    分析原因

    规则过多

    规则顺序不合理

    接口负载过高

    优化建议: 合并规则

    优化建议: 调整顺序

    优化建议: 升级硬件

    实施优化

    验证效果

    该流程图展示了 ACL 性能优化的步骤，从问题分析到实施优化再到效果验证。

    通过本文的介绍，读者应该能够掌握华为 S5735 交换机 ACL 的配置和应用技巧，在实际网络环境中灵活运用 ACL 实现流量控制和安全防护。

    赞(0)
    未经允许不得转载：网硕互联帮助中心 » 华为 S5735 ACL 访问控制列表：包过滤与放行规则实战
    分享到： 更多 (0)
    标签：

    相关推荐

    评论 抢沙发

    评论前必须登录！

     

    热门标签

    服务器(6323)运维(4212)人工智能(4168)linux(2203)java(1833)开发语言(1734)python(1597)网络(1358)c++(1158)数据库(1140)算法(1103)前端(945)大数据(882)ai(719)学习(694)安全(648)深度学习(562)后端(547)spring boot(539)笔记(530)windows(474)架构(474)C语言(472)机器学习(444)ubuntu(403)嵌入式硬件(396)经验分享(382)docker(377)单片机(376)javascript(341)

    置顶推荐

    热门文章

    最新文章