Now if you're already good at Cisco ACLs then this might just be a piece of cake for you to understand. There's just a little bit more to it but its pretty easy to digest. First up, there's three new terms you would need to know – Traffic Classifier, Traffic Behavior & Traffic policy. Now let me introduce you to these terms (actually they're already the exact commands lol).
Traffic Classifier – This where we match/catch our traffic using our acl. Under this command we specify the acl no. we would like to filter
Traffic Behavior – Under this command we tell how our filtered traffic will be treated e.g. permit/deny.
Traffic Policy – As the name tells this will be our actual policy. You may think of this as a route-map or a QoS policy as I have mentioned. Under this command you will specify what traffic are we interested in and what are we going to do with it.
Does it all come together now? Yes we will calling the Traffic Classifier and Traffic Behavior we configured to basically tell our policy WHAT traffic are we going to look at and HOW are we going to treat it.
Now that we are already familiar with the terms lets get to know how ACLs are done. Its almost the same as in Cisco however with a few better syntaxes.
First create the ACL. Now in Cisco if standard ACLs are from 1-99, in Huawei they are 2000-2999. They are also termed as basic ACLs. And for extended ACLs which is 100-199 in Cisco, in Huawei its 3000-3999 and referred to as advanced ACLs. The command for these are as follows:
[Router]acl acl-number
As for our first example lets have a basic ACL. Under this command you may already start entering the ACL lines, or rules rather. The syntax will be:
rule rule-number {permit | deny} source source-ip source-mask destination destination-ip destination-mask
Lets say we would want to deny 110.100.174.0/24 and 110.100.175.0/25 from getting to a server 115.128.85.93.
acl 2100
rule 1 permit source 110.100.174.0 0.0.0.255 destination 115.128.85.93 0
rule 2 permit source 110.100.175.0 0.0.0.255 destination 115.128.85.93 0
Now notice how easy it is know what's going on with this ACL? The source and destination addresses are explicitly defined as compared to Cisco ACLs. And also there's a bit of difference when it comes to specifying a single host. In Cisco when its a single host then you specify the parameter host, and then its IP address. Here we specify the address then specify in its mask that it is a host but instead of putting in 0.0.0.0 instead you only put in 0 which is much shorter, to understand that its a host.
How about we make our example into an advanced ACL. Lets say we just want to deny ssh access to this server. Also let’s do some summarization just for example. The syntax would be as follows:
acl 3100
rule 1 permit tcp source 110.100.174.0 0.0.1.255 destination 115.128.85.93 0 destination-port eq 22
As you can see its not that hard to figure out. The options are well defined and you won’t go wrong unless you put in the wrong values or mistyped it. But look..haven’t you guys noticed? I’ve been putting in permit rules wherein the purpose of our ACL is to deny/block. This where the 3 commands we discussed earlier comes in. So to complete our configuration lets go through those one by one.
traffic classifier c300
if-match acl 3100
traffic behavior b300
deny
traffic policy p300
classifier c300 behavior b300
As you can see above we have configured traffic classifier c300 to match our acl (acl 3100). Please note that the words in italics (e.g.c300) are just names and I just labeled them for easy identification. For our traffic behavior b300 we specified it to deny. So whatever we match with this behavior will be blocked. Finally for our traffic policy p300 we called on our traffic classifier and traffic behavior to complete our overall policy. In essence, what this policy will do is DENY whatever is permitted or matched in our classifier, in this case c300 and so which ever interface we apply this to will start filtering traffic according to this policy.
So to finalize the whole configuration let's put them altogether and apply it to an interface, plus I'll show you how its done from that start!
Telnet into Huawei device
super
system-view
acl 3100
rule 1 permit tcp source 110.100.174.0 0.0.1.255 destination 115.128.85.93 0 destination-port eq 22
quit
traffic classifier c300
if-match acl 3100
traffic behavior b300
deny
traffic policy p300
classifier c300 behavior b300
quit
interface GigabitEthernet0/1/1
traffic-policy p300 inbound
return
save
Let me give you the equivalent of the unfamiliar commands here in Cisco
super – enable
system-view – config terminal
quit – exit
return – end
save - write
See? It's not that bad right? If you already know Cisco its not hard to learn Huawei or vice versa.
Note: There's actually an old way to this. Previously Huawei uses the same way how Cisco uses ACLs (the basic way) however in newer devices this is already the standard.
And does this configuration remind you of route-maps? Yes it did not take me that long to figure out ACLs in Huawei as they're not that far from the concepts which we have in Cisco. Yes I am aware of the controversy which happened between them but then its not really our problem. I guess one important thing to keep in mind here is that its not just a Cisco world out there. I am experiencing that first hand in my current company and really you got to be open into handling devices from other vendors and embracing this truth. We even have Linux routers to add to that and its running OSPF(Zebra), handling PPPoE sessions and all that. I'd be grinning if someday we'll eventually be ordering hardware from Juniper. Be a cross-platform Network Engineer if you can because you'll never know what you may encounter at work. Until my next topic hope you guys picked up something:)
.bmp){kind=spacer}
