How is the ACL Template of S9500

S9500 provides two sets of flow templates: the default flow template and the user defined flow template. The default flow template is bound with each physical port by default. A flow template contains a quintuplet of sip, dip, sport, dport and ip-protocol. If the rule it configured within these fields, it does not require the user defined flow template. If the rule it configured is not within these fields, it requires the user defined flow template. At this time, the user defined flow templated must be bind to the physical port before deliver the corresponding rule.

While configuring the user defined flow template, you need notice that the flow template length supported is only 16 bytes and no field of the flow template should exceed 16 bytes. The length of each field is defined by the protocol, for example, sip address is 4 bytes and smac address is 6 bytes. You need pay attention to the following problems: the fragments field does not occupy field length, the ethernet-protocol field is 6 bytes rather 2 bytes as defined in the protocol, and as icmp-code/icmp-type and sport/dport/tcp-flag overlap each other, and only the longest one is counted if both are configured at the same time. For example, if the flow template is configured with icmp-code, icmp-type, sport and dport, as the two types of fields are 2 bytes and 4 bytes long respectively, the length counted by the flow template is 4 bytes rather than 6 bytes. While configuring the user defined flow template, the length of each field is shown in the command line.

Each LPU can have its own user defined flow template.

You can query the fields contained in the default flow template with the display flow-template default command, and the fields contained in the stream template with the display flow-template user-defined command.