DocsICP FilingConsole
官方文档
首页

Configure an ACL for a SAG app instance

更新时间：
复制 MD 格式
产品详情
我的收藏

This topic describes how to configure an Access Control List (ACL) for a Smart Access Gateway (SAG) app instance to control its network traffic.

Step 1: Create an ACL instance

  1. Log on to the SAG console.

  2. In the top navigation bar, select the region.

  3. In the left-side navigation pane, click ACL.

  4. On the ACL page, click Create access control.

  5. In the Create access control dialog box, set the following parameters and click OK.

    Parameter

    Description

    Resource Group

    Select the resource group to which the ACL instance belongs.

    Instance Name

    Enter a name for the ACL instance.

    Instance Type

    Select the type of SAG instance to associate with the ACL. Valid values:

    • SAG Device

    • SAG App

    This example uses SAG App.

Step 2: Add an ACL rule

  1. On the ACL page, find the ACL that you want to manage and click Configure Rules in the Actions column.

  2. On the details page of the ACL instance, click the Rules tab, and then click Add Rule.

  3. In the Add Rule dialog box, set the following parameters and click OK.

    Parameter

    Description

    Instance Name

    Enter a name for the ACL rule.

    Direction

    Select the direction of traffic to which the ACL rule applies.

    • Outbound: traffic from the client to external networks.

    • Inbound: traffic from external networks to the client.

    Authorization Policy

    Select Allow or Block to specify whether to permit or deny traffic.

    Protocol

    Select the protocol to which the ACL rule applies.

    For a list of supported protocols, see the options in the console.

    Source network segment

    The rule direction determines the source CIDR block:

    • If the rule direction is Outbound, the source CIDR block is the CIDR block of the client that initiates requests.

    • If the rule direction is Inbound, the source CIDR block is the CIDR block of the external service that initiates requests.

    Source port range

    Source port range.

    The valid source port range depends on the protocol that you select. Examples:

    • If you select All (All Protocols Supported), the source port range is -1/-1 and cannot be changed.

    • If you select HTTP, the source port range defaults to 1/65535 and can be changed.

    For the valid source port range of each protocol, see the console. The following formats are supported:

    • 1/200: ports 1 through 200.

    • 80/80: port 80.

    • -1/-1: all ports.

    Destination Network segment

    The rule direction determines the destination CIDR block:

    • If the rule direction is Outbound, the destination CIDR block is the CIDR block of the external service being accessed.

    • If the rule direction is Inbound, the destination CIDR block is the CIDR block of the client being accessed.

    Destination port range

    Destination port range.

    The valid destination port range depends on the protocol that you select. Examples:

    • If you select All (All Protocols Supported), the destination port range is -1/-1 and cannot be changed.

    • If you select TELNET, the destination port range is 23/23 and cannot be changed.

    For the valid destination port range of each protocol, see the console. The following formats are supported:

    • 1/200: ports 1 through 200.

    • 80/80: port 80.

    • -1/-1: all ports.

    Priority

    Select the priority of the ACL rule.

    Valid values: 1 to 100. A smaller value indicates a higher priority.

    Auto Generation of Reverse Direction Rule

    If enabled, a corresponding ACL rule is automatically generated for traffic in the reverse direction.

    For example, if you create an inbound ACL rule, the system automatically creates a corresponding outbound ACL rule.

    Important

    • We recommend enabling this feature. An ACL rule in only one direction may cause request failures because responses cannot be returned.

    • If the ACL rule's protocol is not UDP or TCP, the protocol of the automatically generated reverse-direction rule is TCP by default.

Step 3: Associate the ACL

  1. On the ACL details page, click the Associated Instances tab.

  2. On the Associated Instances tab, click Associate with Instance.

  3. In the Associate with Instance dialog box, select one or more SAG app instances and click OK.

    In the Associate with Instance dialog box, you can search for the SAG app instance by resource group, instance name, or instance ID.

More operations

Actions

Steps

Clone an ACL instance

You can clone an ACL instance to copy its rules. Then, you can associate the new ACL instance with an SAG app instance.

  1. On the ACL page, find the ACL that you want to clone. In the Operation column, choose 更多操作 > Clone.

  2. In the Clone ACL dialog box, confirm the instance information and click OK.

Edit an ACL rule

  1. On the details page of the ACL, click the Rules tab and find the access control rule that you want to edit.

  2. In the Operation column, click Edit.

  3. In the Edit Rule dialog box, modify the rule information and click OK.

Delete an ACL rule

  1. On the details page of the ACL, click the Rules tab and find the access control rule that you want to delete.

  2. In the Operation column, click Remove.

  3. In the Delete Rule dialog box, click OK.

Disassociate an ACL from an SAG app instance

  1. On the details page of the ACL instance, click the Associated Instances tab.

  2. On the Associated Instances tab, find the SAG app instance, and in the Actions column, click Delete.

  3. In the Disassociate Instance dialog box, confirm the instance information and click OK.

Delete an ACL instance

  1. On the ACL page, find the ACL that you want to delete. In the Operation column, choose 更多操作 > Delete.

  2. In the Delete ACL dialog box, confirm the details and click OK.

API reference

Previous：ACL overviewNext：Configure access control for SAG CPE instances