1-2z config: where rules in an ACL are matched in the order defined by the user.z auto: where rules in an ACL are matched in the order determined by the system,namely the “depth-first” rule (Layer 2 ACLs and user-defined ACLs do not support thisfeature).For depth-first rule, there are two cases:Depth-first match order for rules of a basic ACL1) Range of source IP address: The smaller the source IP address range (that is, the morethe number of zeros in the wildcard mask), the higher the match priority.2) Fragment keyword: A rule with the fragment keyword is prior to others.3) If the above two conditions are identical, the earlier configured rule applies.Depth-first match order for rules of an advanced ACL1) Protocol range: A rule which has specified the types of the protocols carried by IP isprior to others.2) Range of source IP address: The smaller the source IP address range (that is, the morethe number of zeros in the wildcard mask), the higher the match priority.3) Range of destination IP address. The smaller the destination IP address range (that is,the more the number of zeros in the wildcard mask), the higher the match priority.4) Range of Layer 4 port number, that is, TCP/UDP port number. The smaller the range,the higher the match priority.5) Number of parameters: the more the parameters, the higher the match priority.If rule A and rule B are still the same after comparison in the above order, the weightingprinciples will be used in deciding their priority order. Each parameter is given a fixedweighting value. This weighting value and the value of the parameter itself will jointlydecide the final matching order. Involved parameters with weighting values from high tolow are icmp-type, established, dscp, tos, precedence, fragment. Comparison rules arelisted below.z The smaller the weighting value left, which is a fixed weighting value minus theweighting value of every parameter of the rule, the higher the match priority.z If the types of parameter are the same for multiple rules, then the sum of parameters’weighting values of a rule determines its priority. The smaller the sum, the higher thematch priority.Ways to Apply an ACL on a SwitchBeing applied to the hardware directlyIn the switch, an ACL can be directly applied to hardware for packet filtering and trafficclassification. In this case, the rules in an ACL are matched in the order determined by thehardware instead of that defined in the ACL. For Switch 5500-EI series, the later the ruleapplies, the higher the match priority.ACLs are directly applied to hardware when they are used for:z Implementing QoS
