Table of Contents

1. Configure ACL Tables Using ConfigDB

1.1 Configuration example

2. SONiC CLI commands (how to add and remove rules)

2.1 How to delete rules in SONiC

3. MAC ACL

4. Control Plane ACL

5. Notes

This section describes the commands you use to configure IP Access Control List (ACL) settings. IP ACLs ensure that only authorized users have access to specific resources and block any unwarranted attempts to reach network resources.

Example model & SONiC version:

• Aurora 721
• Netberg SONiC: sonic-broadcom-202311.n0

You configure ACLs in SONiC using:

• The SONiC ConfigDB, defined in /etc/sonic/config_db.json.
• The SONiC CLI – with limited capabilities.

There is no direct CLI command to add or delete or modify the ACL table and ACL rule. Existing ACL tables and ACL rules can be updated by specifying the ACL rules in json file formats and configure those files using this CLI command.

Different platforms have different supported ACL actions.

Configure ACL Tables Using ConfigDB

The following table contains the ConfigDB schema. The schema is defined according to ABNF RFC 5234 syntax; refer to RFC 5234 for more information about the schema definition.

The TYPE field can be one of the following:

ACL support table

ETHER_TYPE map

IP_PROTOCOL map

IP_TYPE map

Configuration example

Create a JSON file “acl.json”:

admin@nba721:~$sudo nano acl.json
   {
   "ACL_TABLE": {
           "UPSTREAMS": {
           "policy_desc" : "Block ssh traffic from upstreams",
           "type" : "L3",
           "stage": "ingress",
           "ports" : [
                           "Ethernet0",
                           "Ethernet4",
                           "Ethernet8"
                       ] # physical port names
           }
       },
       "ACL_RULE": {
       "UPSTREAMS|Rule10": {
           "DST_IP": "192.168.1.1/32",
           "IP_TYPE": "IP",
           "L4_DST_PORT": "22",
           "PACKET_ACTION": "DROP",
           "priority": "10"
           }
       }
   }

Apply it by:

admin@nba721:~$ sudo config load acl.json -y
admin@nba721:~$ sudo config save -y

Check ACL:

admin@nba721:~$ show acl table
Name       Type       Binding    Description                       Stage    Status
---------  ---------  ---------  --------------------------------  -------  --------
UPSTREAMS  L3         Ethernet0  Block ssh traffic from upstreams  ingress  Active
                      Ethernet4
                      Ethernet8
admin@nba721:~$ show acl rule
Table      Rule        Priority    Action    Match                    Status
---------  ----------  ----------  --------  -----------------------  --------
UPSTREAMS  Rule10      10          DROP      DST_IP: 192.168.1.1/32   Active
                                             IP_TYPE: IP
                                             L4_DST_PORT: 22

value annotations
port_num      = 1*5DIGIT   ; a number between 0 and 65535
port_num_L    = 1*5DIGIT   ; a number between 0 and 65535,
                           ; port_num_L < port_num_H
port_num_H    = 1*5DIGIT   ; a number between 0 and 65535,
                           ; port_num_L < port_num_H
ipv6_prefix   =                 6( h16 ":" ) ls32
   /                       "::" 5( h16 ":" ) ls32
   / [               h16 ] "::" 4( h16 ":" ) ls32
   / [ *1( h16 ":" ) h16 ] "::" 3( h16 ":" ) ls32
   / [ *2( h16 ":" ) h16 ] "::" 2( h16 ":" ) ls32
   / [ *3( h16 ":" ) h16 ] "::"    h16 ":"   ls32
   / [ *4( h16 ":" ) h16 ] "::"              ls32
   / [ *5( h16 ":" ) h16 ] "::"              h16
   / [ *6( h16 ":" ) h16 ] "::"
h8          = 1*2HEXDIG
h16         = 1*4HEXDIG
ls32        = ( h16 ":" h16 ) / IPv4address
ipv4_prefix = dec-octet "." dec-octet "." dec-octet "." dec-octet “/” %d1-32
dec-octet   = DIGIT                     ; 0-9
                / %x31-39 DIGIT         ; 10-99
                / "1" 2DIGIT            ; 100-199
                / "2" %x30-34 DIGIT     ; 200-249

TCP_FLAGS example: "TCP_FLAGS": "16/255"
Note:
FIN =   0x01     "TCP_FLAGS": "0x01/63"
SYN = 0x02      "TCP_FLAGS": "0x02/63"
RST = 0x04      "TCP_FLAGS": "0x04/63"
PSH = 0x08      "TCP_FLAGS": "0x08/63"
ACK = 0x10      "TCP_FLAGS": "0x10/63"
URG = 0x20     "TCP_FLAGS": "0x20/63"

VLAN_ID example: "VLAN_ID": "20"

SONiC CLI (how to add and delete rules)

config acl add table

This command is used to create new ACL tables.

Usage:

config acl add table [OPTIONS] <table_name> <table_type> [-d <description>] [-p <ports>] [-s (ingress | egress)]

Parameters:
    table_name: The name of the ACL table to create.
    table_type: The type of ACL table to create (e.g. "L3", "L3V6", "MIRROR")
    description: A description of the table for the user. (default is the table_name)
    ports: A comma-separated list of ports/interfaces to add to the table. The behavior is as follows:
        Physical ports will be bound as physical ports
        Portchannels will be bound as portchannels - passing a portchannel member is invalid
        VLANs will be expanded into their members (e.g. "Vlan1000" will become "Ethernet0,Ethernet2,Ethernet4...")
    stage: The stage this ACL table will be applied to, either ingress or egress. (default is ingress)

Examples:

admin@nba721:~$ sudo config acl add table EXAMPLE_1 L3 -p Ethernet4,Ethernet8 -s ingress
admin@nba721:~$ sudo config acl add table EXAMPLE_2 L3V6 -p Vlan1000,Ethernet124 -s egress
admin@nba721:~$ show acl table
Name       Type    Binding      Description    Stage
---------  ------  -----------  -------------  -------
EXAMPLE    L3      Ethernet4    EXAMPLE_1      ingress
                   Ethernet8
EXAMPLE_2  L3V6    Ethernet0    EXAMPLE_2      egress
                   Ethernet124

config acl update full

This command is to update the rules in all the tables or in one specific table in full. If a table_name is provided, the operation will be restricted in the specified table. All existing rules in the specified table or all tables will be removed. New rules loaded from file will be installed.

If the table_name is specified, only rules within that table will be removed and new rules in that table will be installed. If the table_name is not specified, all rules from all tables will be removed and only the rules present in the input file will be added.

This command updates only the ACL rules, and it does not disturb the ACL tables; i.e., the output of the “show acl table” is not altered by using this command; only the output of the “show acl rule” will be changed after this command.

might be replaced with “acl-loader update full”

admin@nba721:~$ config acl update full [--table_name <table_name>] [--session_name <session_name>] [--mirror_stage (ingress | egress)] [--max_priority <priority_value>] <acl_json_file_name>

Parameters:

“–table_name”: Specify the name of the ACL table to load.

config acl update full "--table_name DT_ACL_T1 /etc/sonic/acl_table_1.json"

“–mirror_stage” optional argument sets the mirror action to ingress/egress based on this parameter. By default, command sets ingress mirror action in case argument is not specified.

“–session_name” optional argument sets the session_name for the ACL table with this mirror session name. It fails if the specified mirror session name does not exist.

config acl update full "--session_name mirror_ses1 /etc/sonic/acl_table_1.json"

“–max_priority” optional argument make each rule’s priority calculation by subtracting its “sequence_id” value from the “max_priority”. If this value is not passed, the default “max_priority 10000” is used.

config acl update full "--max-priority 100 /etc/sonic/acl_table_1.json"

All these optional parameters should be inside double quotes. If none of the options are provided, double quotes are not required for specifying filename alone.

Any number of optional parameters can be configured in the same command.

Examples:

admin@nba721:~$ sudo config acl update full /etc/sonic/acl_full_snmp_1_2_ssh_4.json
admin@nba721:~$ sudo config acl update full "--table_name UPSTREAMS /etc/sonic/acl_full.json"
admin@nba721:~$ sudo config acl update full "--session_name everflow0 /etc/sonic/acl_full_snmp_1_2_ssh_4.json"

Refer the example file acl_full_snmp_1_2_ssh_4.json that adds two rules for SNMP (Rule1 and Rule2) and one rule for SSH (Rule4).

config acl update incremental

This command is used to perform incremental update of ACL rule table. This command gets existing rules from Config DB and compares with rules specified in input file and performs corresponding modifications.

With respect to DATA ACLs, the command does not assume that new dataplane ACLs can be inserted in between by shifting existing ACLs in all ASICs. Therefore, this command performs a full update on dataplane ACLs. With respect to control plane ACLs, this command performs an incremental update. If we assume that “file1.json” is the already loaded ACL rules file, and if “file2.json” is the input file that is passed as a parameter for this command, the following requirements are valid for the input file.

1. First copy the file1.json to file2.json.
2. Remove the unwanted ACL rules from file2.json
3. Add the newly required ACL rules into file2.json.
4. Modify the existing ACL rules (that require changes) in file2.json.

might be replaced with “acl-loader update incremental”

config acl update incremental [--session_name <session_name>] [--mirror_stage (ingress | egress)] [--max_priority <priority_value>] <acl_json_file_name>

Parameters are the same with the “acl update full” command.

Examples:

admin@nba721:~$ sudo config acl update incremental /etc/sonic/acl_incremental_snmp_1_3_ssh_4.json
admin@nba721:~$ sudo config acl update incremental "--session_name everflow0 /etc/sonic/acl_incremental_snmp_1_3_ssh_4.json"

Refer to the example file acl_incremental_snmp_1_3_ssh_4.json that adds two rules for SNMP (Rule1 and Rule3) and one rule for SSH (Rule4). When this “incremental” command is executed after the”full” command, SNMP Rule2 is removed and SNMP Rule3 is added. File “acl_full_snmp_1_2_ssh_4.json” has got SNMP Rule1, SNMP Rule2, and SSH Rule4. File “acl_incremental_snmp_1_3_ssh_4.json” has got SNMP Rule1, SNMP Rule3 and SSH Rule4. This file is created by copying the file “acl_full_snmp_1_2_ssh_4.json” to “acl_incremental_snmp_1_3_ssh_4.json” and then removing SNMP Rule2 and adding SNMP Rule3.

How to delete rules in SONiC

The same “config acl update full” command can remove unused or obsolete rules.

Omit the unused/obsolete rule from the update file and execute the command.

admin@nba721:~$ sudo config acl update incremental /etc/sonic/netberg_sonic_acl_full_snmp_1_remove_2_ssh_4.json

This example removes SNMP Rule2 by omitting it in the netberg_sonic_acl_full_snmp_1_remove_2_ssh_4.json

A simple example that removes all existing rules – acl_remove_all_rules.json

An alternative method that removes all existing rules:

acl-loader delete

aclshow

This command displays ACL rules, tables and their priority, ACL packet counters, and bytes counters.

Might be bugged in SONiC itself.

admin@nba721:~$ aclshow -h
usage: aclshow [-h] [-a] [-c] [-r RULES] [-t TABLES] [-v] [-vv]
Display SONiC switch Acl Rules and Counters
optional arguments:
 -h, --help            show this help message and exit
 -a, --all             Show all ACL counters
 -c, --clear           Clear ACL counters statistics
 -r RULES, --rules RULES
                       action by specific rules list: Rule1_Name,Rule2_Name
 -t TABLES, --tables TABLES
                       action by specific tables list: Table1_Name,Table2_Name
 -v, --version         show program's version number and exit
 -vv, --verbose        Verbose output

admin@nba721:~$ aclshow -a -vv
Reading ACL info...
Total number of ACL Tables: 4
Total number of ACL Rules: 2
RULE NAME    TABLE NAME      PRIO  PACKETS COUNT    BYTES COUNT
-----------  ------------  ------  ---------------  -------------
ADM_ACCEPT   CTRL               1  N/A              N/A
Rule10       UPSTREAMS         10  N/A              N/A

MAC ACL

Netberg SONiC supports ACL actions based on MAC addresses.

Only PACKET_ACTION actions are supported.

Example:

Create a JSON file “acl_mac.json”:

 admin@nba721:~$sudo nano acl_mac.json
 {
   "ACL_TABLE": {
           "MAC_ACL_IPv4": {
           "policy_desc" : "Block MAC",
           "type" : "L3",
           "stage": "ingress",
           "ports" : [
                           "Ethernet0"
                       ]
           }
       },
       "ACL_RULE": {
       "MAC_ACL_IPv4|Rule101": {
           "PACKET_ACTION": "DROP",
           "PRIORITY": "1",
           "SRC_MAC": "b4:96:91:b3:c7:c9",
           "IP_TYPE": "IP"
           }
       }
   }

Apply it by:

admin@nba721:~$ sudo config load acl_mac.json -y
admin@nba721:~$ sudo config save -y

Check ACL:

 admin@nba721:~$ show acl table
 Name          Type    Binding    Description    Stage    Status
 ------------  ------  ---------  -------------  -------  --------
 MAC_ACL_IPv4  L3      Ethernet0  Block MAC      ingress  Active
 admin@nba721:~$ show acl rule
 Table         Rule     Priority    Action    Match                       Status
 ------------  -------  ----------  --------  --------------------------  --------
 MAC_ACL_IPv4  Rule101  1           DROP      IP_TYPE: IP                 Active
                                              SRC_MAC: b4:96:91:b3:c7:c9

Control Plane ACL

There is no CLI command for that.

First, create a table for the control plane:

admin@nba721:~$sudo nano service_table.json
{
"ACL_TABLE": {
        "CTRL": {
            "policy_desc": "CTRLPLN ACL",
            "services": [
                    "SSH",
                    "SNMP"
            ],
            "type": "CTRLPLANE"
        }
    }
}
admin@nba721:~$ sudo config load service_table.json -y
admin@nba721:~$ show acl table
Name    Type       Binding    Description    Stage    Status
------  ---------  ---------  -------------  -------  --------
CTRL    CTRLPLANE  SNMP       CTRLPLN ACL    ingress  Active
                   SSH

Second, create rules for it:

admin@nba721:~$sudo nano CTRL_ACL.json
{
    "ACL_RULE": {
        "CTRL|ADM_ACCEPT": {
            "PACKET_ACTION": "ACCEPT",
            "PRIORITY": "1",
            "SRC_IP": "192.168.0.10/24"
        }
    }
}
admin@nba721:~$ sudo config load CTRL_ACL.json -y
Running command: /usr/local/bin/sonic-cfggen -j CTRL_ACL.json --write-to-db
admin@nba721:~$ show acl rule
Table    Rule          Priority  Action    Match                    Status
-------  ----------  ----------  --------  -----------------------  --------
CTRL     ADM_ACCEPT           1  ACCEPT    SRC_IP: 192.168.0.10/24  N/A

The N/A value means that the ACL rule is a control plane ACL, and those counters are created in Linux, not in SONiC COUNTERS_DB and the iptables utility should be used to view those counters.

Notes

1. TCP_FLAGS doesn’t support filtering Congestion Window Reduced (CWR) and ECN-Echo (ECE)
2. Egress doesn’t support L4_SRC_PORT_RANGE
3. Egress doesn’t support L4_DST_PORT_RANGE
4. If any matching field has an IPv6 parameter – the table type should be changed to IPv6