All Products
Search
Document Center

Smart Access Gateway:AddACLRule

Last Updated:Mar 29, 2024

Creates an access control list (ACL) rule.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
smartag:AddACLRuleWrite
  • Acl
    acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}
    none
none

Request parameters

ParameterTypeRequiredDescriptionExample
RegionIdstringYes

The ID of the region where the ACL is deployed.

You can call the DescribeRegions operation to query the most recent region list.

cn-shanghai
AclIdstringYes

The ID of the ACL.

acl-xhwhyuo43l0n*****
DescriptionstringNo

The description of the ACL rule.

The description must be 1 to 512 characters in length.

desctest
DirectionstringYes

The direction of traffic in which the ACL rule is applied. Valid values:

  • in: The ACL rule controls inbound network traffic of the on-premises network that is associated with the Smart Access Gateway (SAG) instance.
  • out: The ACL rule controls outbound network traffic of the on-premises network that is associated with the SAG instance.
in
SourceCidrstringYes

The range of the source IP addresses.

Specify the value of this parameter in CIDR notation. Example: 192.168.1.0/24.

192.168.20.0/24
DestCidrstringYes

The range of the destination IP addresses.

Specify the value of this parameter in CIDR notation. Example: 192.168.10.0/24.

192.168.10.0/24
IpProtocolstringYes

The protocol used by the ACL rule.

The protocols that are provided in this topic are for reference only. The protocols available in the SAG console may vary. The value of the parameter is not case-sensitive.

tcp
SourcePortRangestringYes

The source port range.

Valid values: 1 to 65535 and -1.

Set the source port range in one of the following formats: 1/200 or 80/80. A value of -1/-1 indicates all ports.

1/200
DestPortRangestringYes

The destination port range.

Valid values: 1 to 65535 and -1.

Set the destination port range in one of the following formats: 1/200 or 80/80. A value of -1/-1 indicates all ports.

1/200
PolicystringYes

The action policy of the ACL rule. Valid values:

  • accept: allows network traffic.
  • drop: blocks the network traffic.
accept
PriorityintegerNo

The priority of the ACL rule.

A smaller value indicates a higher priority. If rules have the same priority, whichever applied to the SAG devices earlier takes effect.

Valid values: 1 to 100. Default value: 1.

12
TypestringNo

The type of the ACL rule: Valid values:

  • LAN: The ACL rule controls network traffic transmitted through private IP addresses.
  • WAN: The ACL rule controls network traffic transmitted through public IP addresses.
LAN
NamestringNo

The name of the ACL rule.

The name must be 2 to 100 characters in length, and can contain letters, digits, periods (.), underscores (_), and hyphens (-). It must start with a letter.

doctest
DpiSignatureIdsarrayNo
stringNo

The ID of the application.

You can enter at most 100 application IDs in each call.

1
DpiGroupIdsarrayNo
stringNo

The ID of the application group.

You can enter at most 100 application group IDs in each call.

20

Response parameters

ParameterTypeDescriptionExample
object
Policystring

The action policy of the ACL rule.

  • accept: allows the network traffic.
  • drop: blocks the network traffic.
drop
Descriptionstring

The description of the ACL rule.

test
RequestIdstring

The ID of the request.

880F84CB-9B54-4413-A8A3-8832C82D1BC4
SourcePortRangestring

The source port range.

1/65535
SourceCidrstring

The source CIDR block.

The value of this parameter is specified in CIDR notation. Example: 192.168.1.0/24.

192.168.20.0/24
Priorityinteger

The priority of the ACL rule.

A smaller value indicates a higher priority. If rules have the same priority, whichever applied to the SAG devices earlier takes effect.

1
AclIdstring

The ID of the ACL.

acl-xhwhyuo43l0*******
AcrIdstring

The ID of the ACL rule.

acr-c1hkd054qywi******
DestPortRangestring

The destination port range.

1/65535
Directionstring

The direction of traffic in which the ACL rule is applied. Valid values:

  • in: The ACL rule controls inbound network traffic of the on-premises network that is associated with the SAG instance.
  • out: The ACL rule controls outbound network traffic of the on-premises network that is associated with the SAG instance.
out
DpiGroupIdsarray

The IDs of the application groups that match the current ACL rule.

string
20
Namestring

The name of the ACL rule.

doctest
Typestring

The type of the ACL rule:

  • LAN: The ACL rule controls network traffic transmitted through private IP addresses.
  • WAN: The ACL rule controls network traffic transmitted through public IP addresses.
LAN
GmtCreatelong

The timestamp when the ACL rule was created.

The timestamp is of the Long data type. If multiple ACL rules have the same priority, the rule with the earliest timestamp takes effect.

1553766882689
DestCidrstring

The destination CIDR block.

The value of this parameter is specified in CIDR notation. Example: 192.168.10.0/24.

192.168.10.0/24
DpiSignatureIdsarray

The IDs of the applications that match the current ACL rule.

string
1
IpProtocolstring

The protocol used by the ACL rule.

TCP

Examples

Sample success responses

JSONformat

{
  "Policy": "drop",
  "Description": "test",
  "RequestId": "880F84CB-9B54-4413-A8A3-8832C82D1BC4",
  "SourcePortRange": "1/65535",
  "SourceCidr": "192.168.20.0/24",
  "Priority": 1,
  "AclId": "acl-xhwhyuo43l0*******",
  "AcrId": "acr-c1hkd054qywi******",
  "DestPortRange": "1/65535",
  "Direction": "out",
  "DpiGroupIds": {
    "DpiGroupId": [
      "20"
    ]
  },
  "Name": "doctest",
  "Type": "LAN",
  "GmtCreate": 1553766882689,
  "DestCidr": "192.168.10.0/24",
  "DpiSignatureIds": {
    "DpiSignatureId": [
      "1"
    ]
  },
  "IpProtocol": "TCP"
}

Error codes

HTTP status codeError codeError messageDescription
400ACL.NoSupportWanTypeAn SAG 1000 device does not support a WAN ACL.An SAG 1000 device does not support a WAN ACL.
400ACL.InvalidTypeThe specified ACL type is invalid.The specified ACL type is invalid.
403ForbiddenUser not authorized to operate on the specified resource.You do not have permissions to manage the specified resource.
403MissingParameterThe input parameter is missing, please check your input.Missing parameters. Check whether all required parameters are set.
403InvalidDescriptionDescription not valid.The length of the description has exceeded the upper limit.
403InvalidParameterThe specified parameter is invalid.Invalid parameters.
403FeatureNotSupportThe current edition of the smart access gateway does not support this feature.The current version of Smart Access Gateway does not support this feature.
403FeatureNotSupportForActiveSmartAGThe current edition of the active smart access gateway does not support this feature.The current edition of the active SAG instance does not support this feature.
403FeatureNotSupportForStandBySmartAGThe current edition of the standby smart access gateway does not support this feature.The current version of Smart Access Gateway does not support this feature.
403NotSupportedProtocolThe specified protocol of the ACL rule is not supported.The specified protocol of the ACL rule is not supported.
403InvalidId.ACLThe specified ACL ID is invalid.The specified ACL group ID is invalid.
403InvalidPortRangeThe specified port range is invalid.The specified port range is invalid.
403AcrPerAclAmountLimitThe maximum number of rules in an ACL is exceeded. You can open a ticket to increase the quota.The number of ACL rules has reached the upper limit of ACL rules that you can create under each ACL group. You can submit a ticket to request a quota increase.
403InternalErrorAn internal server error occurred.An internal server error occurred.

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
No change history