DocsICP FilingConsole
官方文档
首页

Configure access control for SAG CPE instances

更新时间：
复制 MD 格式
产品详情
我的收藏

Configure access control on a Smart Access Gateway (SAG) CPE instance to manage its network traffic.

Background

SAG CPE instances can match traffic by application type. When you specify an Application Group or an Application in an access control rule, you create an application-based rule. Application-based rules apply only to SAG CPE instances that have deep packet inspection (DPI) enabled. To enable DPI for an SAG CPE instance, see Enable deep packet inspection (DPI).

Step 1: Create an ACL

  1. Log on to the SAG console.

  2. In the top navigation bar, select the region.

  3. In the left-side navigation pane, click ACL.

  4. On the ACL page, click Create access control.

  5. In the Create access control dialog box, set the following parameters and click OK.

    Parameter

    Description

    Resource Group

    Select the resource group to which the ACL belongs.

    Instance Name

    Enter a name for the ACL.

    Instance Type

    Select the type of SAG instance to associate with the ACL. Valid values:

    • SAG Device

    • SAG App

    For this guide, select SAG Device.

Step 2: Add an access control rule

  1. On the ACL page, find the ACL that you want to manage and click Configure Rules in the Actions column.

  2. On the details page of the ACL, click the Rules tab and then click Add Rule.

  3. In the Add Rule dialog box, set the following parameters and click OK.

    Parameter

    Description

    Instance Name

    Enter a name for the access control rule.

    Type

    Select the network type for the rule.

    • Private Network: For traffic to or from private IP addresses.

    • Public Network: For traffic to or from public IP addresses.

    Rule Direction

    Select the traffic direction for the rule.

    • Outbound: traffic that flows from the on-premises network where the SAG instance is deployed to an external network.

    • Inbound: traffic that flows from an external network to the on-premises network where the SAG instance is deployed.

    Permission Policy

    Select whether to Allow or Deny traffic.

    Protocol Type

    Select the protocol for the rule.

    For information about the supported protocols, see the console.

    Source CIDR Block

    The meaning of the source CIDR block depends on the rule direction:

    • If the rule direction is Outbound, the source CIDR block is the CIDR block of the on-premises network that initiates requests.

    • If the rule direction is Inbound, the source CIDR block is the CIDR block of the external network that initiates requests.

    Source Port Range

    The source port range.

    The valid source port range depends on the protocol that you select. Examples:

    • If you select All (All Protocols Supported), the source port range is -1/-1 and cannot be changed.

    • If you select HTTP, the source port range defaults to 1/65535 and can be changed.

    For the valid source port range of each protocol, see the console. The following formats are supported:

    • 1/200: ports 1 through 200.

    • 80/80: port 80.

    • -1/-1: all ports.

    Destination CIDR Block

    The meaning of the destination CIDR block depends on the rule direction:

    • If the rule direction is Outbound, the destination CIDR block is the CIDR block of the external network to be accessed.

    • If the rule direction is Inbound, the destination CIDR block is the CIDR block of the on-premises network to be accessed.

    Destination Port Range

    The destination port range.

    The valid destination port range depends on the protocol that you select. Examples:

    • If you select All (All Protocols Supported), the destination port range is -1/-1 and cannot be changed.

    • If you select TELNET, the destination port range is 23/23 and cannot be changed.

    For the valid destination port range of each protocol, see the console. The following formats are supported:

    • 1/200: ports 1 through 200.

    • 80/80: port 80.

    • -1/-1: all ports.

    Priority

    Set the priority of the access control rule.

    The valid range is 1 to 100. A smaller value indicates a higher priority.

    Application Group

    Select the application group for access control.

    Each application group contains multiple applications. If you select an application group, the rule applies to all applications in the group.

    For information about the supported application groups, see the console.

    Application

    Select the application for access control.

    You can select one or more applications from a specified application group.

    For information about the supported applications, see the console.

    If you select both Application Group and Application, the rule applies to all applications in the selected group and any individual applications you select from the Application list.

Step 3: Associate the ACL with an instance

  1. On the ACL details page, click the Associated Instances tab.

  2. On the Associated SAG Instances tab, click Associate with Instance.

  3. In the Associate with Instance dialog box, select one or more SAG CPE instances and click OK.

    In the Associate with Instance dialog box, you can search for the SAG CPE instance by resource group, instance name, or instance ID.

More operations

Actions

Steps

Clone an ACL

Clone an ACL and its rules, then associate the new ACL with an SAG CPE instance.

  1. On the ACL page, find the ACL that you want to clone. In the Operation column, choose 更多操作 > Clone.

  2. In the Clone ACL dialog box, confirm the instance information and click OK.

Edit an access control rule

  1. On the details page of the ACL, click the Rules tab and find the access control rule that you want to edit.

  2. In the Operation column, click Edit.

  3. In the Edit Rule dialog box, modify the rule information and click OK.

Delete an access control rule

  1. On the details page of the ACL, click the Rules tab and find the access control rule that you want to delete.

  2. In the Operation column, click Remove.

  3. In the Delete Rule dialog box, click OK.

Disassociate an SAG CPE instance

  1. On the details page of the ACL, click the Associated SAG Instances tab.

  2. On the Associated SAG Instances tab, find the SAG CPE instance that you want to disassociate and click Remove in the Operation column.

  3. In the Disassociate Instance dialog box, confirm the details and click OK.

Delete an ACL

  1. On the ACL page, find the ACL that you want to delete. In the Operation column, choose 更多操作 > Delete.

  2. In the Delete ACL dialog box, confirm the details and click OK.

API reference

Previous：Configure an ACL for a SAG app instanceNext：Flow logs