# 网络ACL组、网络ACL策略、网络ACL规则之间的关系是什么？
#### 三者关系
网络ACL资源分为网络ACL组、网络ACL策略和网络ACL规则。
三者的关系是：
- 一个网络ACL策略可以绑定多个网络ACL规则，
- 一个网络ACL组可以绑定两个网络ACL策略，分别是入方向网络ACL策略和出方向网络ACL策略，
- 网络ACL策略需要绑定到网络ACL组使用。
登录网络控制台，查看网络ACL的基本信息，可以看到网络ACL组的名称和ID。
![](https://support.huaweicloud.com/api-vpc/zh-cn_image_0000001487966354.png "点击放大")
在入方向规则或出方向规则界面，可以添加、修改、删除网络ACL规则，这些规则均绑定在同一个入方向策略或出方向策略中。
![](https://support.huaweicloud.com/api-vpc/zh-cn_image_0000001538445301.png "点击放大")
#### 示例
举例描述创建网络ACL资源的过程，理解三者之间的关系。
- 创建网络ACL规则
```
POST /v2.0/fwaas/firewall_rules
```
请求体
```
{
    "firewall_rule": {
        "name": "fw-rule-ingress-1",
        "description": "create a ingress firewall rule ",
        "protocol": "TCP",
        "action": "ALLOW",
        "ip_version": 4,
        "destination_ip_address": "192.168.22.0/24",
        "source_ip_address": "0.0.0.0/0",
        "enabled": true
    }
}
```
响应体，获取到firewall_rule_id：84d10f4a-9f8b-41b8-bdfa-5a0f18736f12
```
{
    "firewall_rule": {
        "protocol": "tcp",
        "description": "create a ingress firewall rule ",
        "source_ip_address": "0.0.0.0/0",
        "destination_ip_address": "192.168.22.0/24",
        "source_port": null,
        "destination_port": null,
        "id": "84d10f4a-9f8b-41b8-bdfa-5a0f18736f12",
        "name": "fw-rule-ingress-1",
        "tenant_id": "5f6387106c2048b589b369d96c2f23a2",
        "project_id": "5f6387106c2048b589b369d96c2f23a2",
        "enabled": true,
        "action": "allow",
        "ip_version": 4,
        "public": false
    }
}
```
- 创建网络ACL策略
```
POST /v2.0/fwaas/firewall_policies
```
请求体，绑定网络ACL规则
```
{
    "firewall_policy": {
        "description": "create a ingress firewall policy",
        "firewall_rules": [
          "84d10f4a-9f8b-41b8-bdfa-5a0f18736f12"
        ],
        "name": "fw-policy-ingress"
    }
}
```
响应体，获取到firewall_policy_id：da037721-b895-4e07-bbcc-f5f6ac2759fb
```
{
    "firewall_policy": {
        "id": "da037721-b895-4e07-bbcc-f5f6ac2759fb",
        "name": "fw-policy-ingress",
        "project_id": "5f6387106c2048b589b369d96c2f23a2",
        "tenant_id": "5f6387106c2048b589b369d96c2f23a2",
        "description": "create a ingress firewall policy",
        "firewall_rules": [
          "84d10f4a-9f8b-41b8-bdfa-5a0f18736f12"
        ],
        "audited": false,
        "public": false
    }
}
```
- 创建网络ACL组
```
POST /v2.0/fwaas/firewall_groups
```
请求体，绑定入方向网络ACL策略
```
{
    "firewall_group": {
        "name": "fw-group-example",
        "description": "create a firewall group",
        "ingress_firewall_policy_id": "da037721-b895-4e07-bbcc-f5f6ac2759fb",
        "admin_state_up": true
    }
}
```
响应体，获取到firewall_group_id：102493e8-fc6d-4f0d-b57f-55c5be86f5c0
```
{
    "firewall_group": {
        "id": "102493e8-fc6d-4f0d-b57f-55c5be86f5c0",
        "name": "fw-group-example",
        "project_id": "5f6387106c2048b589b369d96c2f23a2",
        "tenant_id": "5f6387106c2048b589b369d96c2f23a2",
        "admin_state_up": true,
        "egress_firewall_policy_id": null,
        "ingress_firewall_policy_id": "da037721-b895-4e07-bbcc-f5f6ac2759fb",
        "description": "create a firewall group",
        "created_at": "2023-03-09T08:54:40",
        "updated_at": "2023-03-09T08:54:40",
        "status": "INACTIVE",
        "ports": [],
        "public": false
    }
}
```
登录网络控制台，可以查看到创建的网络ACL资源。
![](https://support.huaweicloud.com/api-vpc/zh-cn_image_0000001538800281.png "点击放大")