Adding a Network ACL Rule

Scenarios

You can add inbound and outbound rules to a network ACL to control the traffic in and out of a subnet. Network ACL rules are matched in ascending order, either by the system-generated rule numbers or those you define.

• Adding a Network ACL Rule (Default Rule Numbers): Rules are matched in order of their number, starting with the lowest. The rule number is automatically assigned based on the time when the rule is added.

  In Table 1, there are two custom inbound rules (rule A and rule B) and one default rule. The rule A number is 1 and rule B number is 2. The default rule is the last rule that is used for matching traffic. When you add rule C, the rule number will be 3, which will be matched later than rules A and B but earlier than the default rule.

  Table 1 Default rule numbers

  Rule Number (Rules A and B)		Rule Number (Rules A, B, and C)
  Custom rule A	1	Custom rule A	1
  --	--	Custom rule B	2
  Custom rule B	2	Custom rule C	3
  Default rule	*	Default rule	*

• Adding a Network ACL Rule (Custom Rule Numbers): If you want a rule to be matched earlier or later than a specific rule, you can insert the rule above or below the specific rule.

  In Table 2, there are two custom inbound rules (rule A and rule B) and one default rule. The rule A number is 1 and rule B number is 2. The default rule is the last rule that is used for matching traffic. If you want rule C to be matched earlier than rule B, you can insert rule C above rule B. After rule C is added, the rule C number is 2, and rule B number is 3.

  Table 2 Custom rule numbers

  Rule Number (Rules A and B)		Rule Number (Rules A, B, and C)
  Custom rule A	1	Custom rule A	1
  --	--	Custom rule C	2
  Custom rule B	2	Custom rule B	3
  Default rule	*	Default rule	*

Constraints

A network ACL can contain up to 100 rules in one direction, or performance will deteriorate.