网络ACL组、网络ACL策略、网络ACL规则之间的关系是什么？

三者关系

网络ACL资源分为网络ACL组、网络ACL策略和网络ACL规则。

三者的关系是：

一个网络ACL策略可以绑定多个网络ACL规则，
一个网络ACL组可以绑定两个网络ACL策略，分别是入方向网络ACL策略和出方向网络ACL策略，
网络ACL策略需要绑定到网络ACL组使用。

登录网络控制台，查看网络ACL的基本信息，可以看到网络ACL组的名称和ID。

点击放大

在入方向规则或出方向规则界面，可以添加、修改、删除网络ACL规则，这些规则均绑定在同一个入方向策略或出方向策略中。

点击放大

示例

举例描述创建网络ACL资源的过程，理解三者之间的关系。

创建网络ACL规则

POST /v2.0/fwaas/firewall_rules

请求体

{
    "firewall_rule": {
        "name": "fw-rule-ingress-1",
        "description": "create a ingress firewall rule ",
        "protocol": "TCP",
        "action": "ALLOW",
        "ip_version": 4,
        "destination_ip_address": "192.168.22.0/24",
        "source_ip_address": "0.0.0.0/0",
        "enabled": true
    }
}

响应体，获取到firewall_rule_id：84d10f4a-9f8b-41b8-bdfa-5a0f18736f12

{
    "firewall_rule": {
        "protocol": "tcp",
        "description": "create a ingress firewall rule ",
        "source_ip_address": "0.0.0.0/0",
        "destination_ip_address": "192.168.22.0/24",
        "source_port": null,
        "destination_port": null,
        "id": "84d10f4a-9f8b-41b8-bdfa-5a0f18736f12",
        "name": "fw-rule-ingress-1",
        "tenant_id": "5f6387106c2048b589b369d96c2f23a2",
        "project_id": "5f6387106c2048b589b369d96c2f23a2",
        "enabled": true,
        "action": "allow",
        "ip_version": 4,
        "public": false
    }
}

创建网络ACL策略

POST /v2.0/fwaas/firewall_policies

请求体，绑定网络ACL规则

{
    "firewall_policy": {
        "description": "create a ingress firewall policy",
        "firewall_rules": [
          "84d10f4a-9f8b-41b8-bdfa-5a0f18736f12"
        ],
        "name": "fw-policy-ingress"
    }
}

响应体，获取到firewall_policy_id：da037721-b895-4e07-bbcc-f5f6ac2759fb

{
    "firewall_policy": {
        "id": "da037721-b895-4e07-bbcc-f5f6ac2759fb",
        "name": "fw-policy-ingress",
        "project_id": "5f6387106c2048b589b369d96c2f23a2",
        "tenant_id": "5f6387106c2048b589b369d96c2f23a2",
        "description": "create a ingress firewall policy",
        "firewall_rules": [
          "84d10f4a-9f8b-41b8-bdfa-5a0f18736f12"
        ],
        "audited": false,
        "public": false
    }
}

创建网络ACL组

POST /v2.0/fwaas/firewall_groups

请求体，绑定入方向网络ACL策略

{
    "firewall_group": {
        "name": "fw-group-example",
        "description": "create a firewall group",
        "ingress_firewall_policy_id": "da037721-b895-4e07-bbcc-f5f6ac2759fb",
        "admin_state_up": true
    }
}

响应体，获取到firewall_group_id：102493e8-fc6d-4f0d-b57f-55c5be86f5c0

{
    "firewall_group": {
        "id": "102493e8-fc6d-4f0d-b57f-55c5be86f5c0",
        "name": "fw-group-example",
        "project_id": "5f6387106c2048b589b369d96c2f23a2",
        "tenant_id": "5f6387106c2048b589b369d96c2f23a2",
        "admin_state_up": true,
        "egress_firewall_policy_id": null,
        "ingress_firewall_policy_id": "da037721-b895-4e07-bbcc-f5f6ac2759fb",
        "description": "create a firewall group",
        "created_at": "2023-03-09T08:54:40",
        "updated_at": "2023-03-09T08:54:40",
        "status": "INACTIVE",
        "ports": [],
        "public": false
    }
}

登录网络控制台，可以查看到创建的网络ACL资源。

点击放大