Adding a Network ACL Rule

Scenarios

You can add inbound and outbound rules to a network ACL to control the traffic in and out of a subnet. Network ACL rules are matched in an ascending order, either by the system-generated rule numbers or those you define.

• Adding a Network ACL Rule (Default Rule Numbers): Rules are matched in order of their number, starting with the lowest. The rule number is automatically assigned.
  As shown in Table 1, there are two custom inbound rules (rule A and rule B) and one default rule. The priority of rule A is 1 and that of rule B is 2. The default rule has the lowest priority. If rule C is added, the system sets its priority to 3, which has lower priority than rules A and B and higher priority than the default rule.

  Table 1 Default priorities

  Priority (Rules A and B)		Priority (Rules A, B, and C)
  Custom rule A	1	Custom rule A	1
  --	--	Custom rule B	2
  Custom rule B	2	Custom rule C	3
  Default rule	*	Default rule	*

• Adding a Network ACL Rule (Custom Rule Numbers): If you want a rule to be matched earlier or later than a specific rule, you can insert the rule above or below the specific rule.
  In Table 2, there are two custom inbound rules (rule A and rule B) and one default rule. The priority of rule A is 1 and that of rule B is 2. The default rule has the lowest priority. If you want rule C to be matched earlier than rule B, you can insert rule C above rule B. After rule C is added, the priority of rule C is 2, and that of rule B is 3.

  Table 2 Custom priorities

  Priority (Rules A and B)		Priority (Rules A, B, and C)
  Custom rule A	1	Custom rule A	1
  --	--	Custom rule C	2
  Custom rule B	2	Custom rule B	3
  Default rule	*	Default rule	*

Notes and Constraints

A network ACL can contain up to 100 rules in one direction, or performance will deteriorate.