一、目前ACL配置需要用到openconfig.json格式去操作；
ACL full update: an ACL rule definition file will be provided in openconfig json format；
All existing ACLs will be removed, and new ACLs will be configured according to the file.
二、之前关于ACL-TABLE,ACL-RULE-TABLE和port-mirror-table都从app_db放到了config_db
<从源码也可以看出来>
Move ACL_TABLE, ACL_RULE_TABLE, and PORT_MIRROR_TABLE to config DB, rename to ACL_TABLE, ACL_RULE and MIRROR_SESSION correspondingly.
三、具体步骤：
1、minigraph.xml中绑定到应用和端口
Minigraph文件绑定ACL规则到具体端口或者应用：
Vim /etc/sonic/minigraph
…….
<AclInterfaces>
<AclInterface>
<AttachTo>Ethernet16</AttachTo>
<InAcl>everflow</InAcl>
</AclInterface>
</AclInterfaces>
……
这里我将定义的everflow table绑定到了端口Ethernet16,当然，这里也可以是ERSPAN,portchanel之类的应用。
其流程如下：
2.
通过acl-load update full ../../acl.json加载acl规则到configdb中。
参考目录：这里定义的参考文件
https://github.com/Azure/sonic-buildimage/blob/023a5b9714c8d2c41ab4469beae3569c0e43933a/src/sonic-config-engine/tests/t0-sample-acl.json
Acl.json文件定义如下：
| { |
|
| "acl": { |
|
| "acl-sets": { |
|
| "acl-set": { |
|
| "dataacl": { |
|
| "acl-entries": { |
|
| "acl-entry": { |
|
| "1": { |
|
| "actions": { |
|
| "config": { |
|
| "forwarding-action": "ACCEPT" |
|
| } |
|
| }, |
|
| "config": { |
|
| "sequence-id": 1 |
|
| }, |
|
| "ip": { |
|
| "config": { |
|
| "protocol": "IP_UDP", |
|
| "source-ip-address": "10.0.0.0/8" |
|
| } |
|
| } |
|
| }, |
|
| "2": { |
|
| "actions": { |
|
| "config": { |
|
| "forwarding-action": "ACCEPT" |
|
| } |
|
| }, |
|
| "config": { |
|
| "sequence-id": 2 |
|
| }, |
|
| "ip": { |
|
| "config": { |
|
| "protocol": "IP_UDP", |
|
| "source-ip-address": "100.64.0.0/10" |
|
| } |
|
| } |
|
| }, |
|
| "3": { |
|
| "actions": { |
|
| "config": { |
|
| "forwarding-action": "ACCEPT" |
|
| } |
|
| }, |
|
| "config": { |
|
| "sequence-id": 3 |
|
| }, |
|
| "ip": { |
|
| "config": { |
|
| "protocol": "IP_UDP", |
|
| "source-ip-address": "25.0.0.0/8" |
|
| } |
|
| } |
|
| }, |
|
| "4": { |
|
| "actions": { |
|
| "config": { |
|
| "forwarding-action": "ACCEPT" |
|
| } |
|
| }, |
|
| "config": { |
|
| "sequence-id": 4 |
|
| }, |
|
| "ip": { |
|
| "config": { |
|
| "protocol": "IP_TCP" |
|
| } |
|
| }, |
|
| "transport": { |
|
| "config": { |
|
| "tcp-flags": [ |
|
| "TCP_ACK" |
|
| ] |
|
| } |
|
| } |
|
| } |
|
| } |
|
| }, |
|
| "config": { |
|
| "name": "dataacl" |
|
| } |
|
| }, |
|
| "everflow": { |
|
| "acl-entries": { |
|
| "acl-entry": { |
|
| "1": { |
|
| "actions": { |
|
| "config": { |
|
| "forwarding-action": "ACCEPT" |
|
| } |
|
| }, |
|
| "config": { |
|
| "sequence-id": 1 |
|
| }, |
|
| "ip": { |
|
| "config": { |
|
| "destination-ip-address": "127.0.0.1/32", |
|
| "protocol": "IP_TCP", |
|
| "source-ip-address": "127.0.0.1/32" |
|
| } |
|
| }, |
|
| "transport": { |
|
| "config": { |
|
| "destination-port": "0", |
|
| "source-port": "0" |
|
| } |
|
| } |
|
| } |
|
| } |
|
| }, |
|
| "config": { |
|
| "name": "everflow" |
|
| } |
|
| } |
|
| } |
|
| } |
|
| } |
|
| } |
