All Products
Search

This Product

    Smart Access Gateway:ModifyACLRule

    Document Center

    Smart Access Gateway:ModifyACLRule

    Last Updated:Mar 29, 2024

    Modifies an access control list (ACL) rule.

    Debugging

    OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

    Authorization information

    The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

    • Operation: the value that you can use in the Action element to specify the operation on a resource.
    • Access level: the access level of each operation. The levels are read, write, and list.
    • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
      • The required resource types are displayed in bold characters.
      • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
    • Condition Key: the condition key that is defined by the cloud service.
    • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
    OperationAccess levelResource typeCondition keyAssociated operation
    smartag:ModifyACLRuleWrite
    • Acl
      acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}
      none
    		none

    Request parameters

    ParameterTypeRequiredDescriptionExample
    RegionIdstringYes

    The ID of the region where the ACL is deployed.

    		cn-shanghai
    AclIdstringYes

    The ID of the ACL.

    		acl-xhwhyuo43l0n*******
    AcrIdstringYes

    The ID of the ACL rule.

    You can call the DescribeACLAttribute operation to query the ID of the ACL rule that is added to the ACL.

    		acr-u98qztgtgvhb********
    DescriptionstringNo

    The description of the ACL rule.

    The description must be 1 to 512 characters in length.

    		test
    DirectionstringNo

    The direction of traffic in which the ACL rule is applied. Valid values:

    • in: The ACL rule controls inbound network traffic of the on-premises network that is associated with the SAG instance.
    • out: The ACL rule controls outbound network traffic of the on-premises network that is associated with the SAG instance.
    		in
    SourceCidrstringNo

    The source CIDR block.

    Specify the value of this parameter in CIDR notation. Example: 192.168.1.0/24.

    		0.0.0.0/0
    DestCidrstringNo

    The destination CIDR block.

    Specify the value of this parameter in CIDR notation. Example: 192.168.10.0/24.

    		0.0.0.0/0
    IpProtocolstringNo

    The protocol used by the ACL rule.

    The supported protocols provided in this topic are for reference only. The actual protocols in the SAG console shall prevail. The value of the parameter is not case-sensitive.

    		tcp
    SourcePortRangestringNo

    The source port range. Valid values: 1 to 65535 and -1.

    Examples:

    • 1/200: port 1 to port 200.
    • 80/80: port 80.
    • -1/-1: all ports.
    		80/80
    DestPortRangestringNo

    The destination port range. Valid values: 1 to 65535 and -1.

    Examples:

    • 1/200: port 1 to port 200.
    • 80/80: port 80.
    • -1/-1: all ports.
    		80/80
    PolicystringNo

    The action of the ACL rule. Valid values:

    • accept: allows network traffic.
    • drop: blocks network traffic.
    		accept
    PriorityintegerNo

    The priority of the ACL rule.

    A smaller value indicates a higher priority. If multiple rules have the same priority, the rule that is applied earlier takes effect.

    Valid values: 1 to 100. Default value: 1.

    		2
    TypestringNo

    The type of the ACL rule: Valid values:

    • LAN: The ACL rule controls traffic of private IP addresses.
    • WAN: The ACL rule controls traffic of public IP addresses.
    		LAN
    NamestringNo

    The name of the ACL rule.

    The name must be 2 to 128 characters in length, and can contain letters, digits, underscores (_), and hyphens (-). The name must start with a letter.

    		doctest
    DpiSignatureIdsarrayNo
    stringNo

    The IDs of applications that match the ACL rule.

    You can call the ListDpiSignatures operation to query application IDs and information about the applications.

    		1
    DpiGroupIdsarrayNo
    stringNo

    The IDs of application groups that match the ACL rule.

    You can call the ListDpiGroups operation to query application group IDs and information about the applications.

    		20

    Response parameters

    ParameterTypeDescriptionExample
    object
    Policystring

    The action of the ACL rule.

    • accept: allows network traffic.
    • drop: blocks network traffic.
    		accept
    Descriptionstring

    The description of the ACL rule.

    		test
    RequestIdstring

    The ID of the request.

    		7F3DD2C1-0F6B-4575-9106-B2D50DF7A711
    SourcePortRangestring

    The source port range.

    		-1/-1
    SourceCidrstring

    The source CIDR block.

    The value of this parameter is in CIDR notation. Example: 192.168.1.0/24.

    		0.0.0.0/0
    Priorityinteger

    The priority of the ACL rule.

    A smaller value indicates a higher priority. If multiple rules have the same priority, the rule that is applied earlier takes effect.

    		1
    AclIdstring

    The ID of ACL.

    		acl-jdc7tir4fkplwr****
    AcrIdstring

    The ID of the ACL rule.

    		acr-r8hezn2pi39s5a****
    DestPortRangestring

    The destination port range.

    		-1/-1
    Directionstring

    The direction of traffic in which the ACL rule is applied. Valid values:

    • in: The ACL rule controls inbound network traffic of the on-premises network that is associated with the SAG instance.
    • out: The ACL rule controls outbound network traffic of the on-premises network that is associated with the SAG instance.
    		in
    DpiGroupIdsarray

    The IDs of application groups that match the ACL rule.

    string
    		20
    Namestring

    The name of the ACL rule.

    		doctest
    GmtCreatelong

    The timestamp when the ACL rule was created.

    The timestamp is of the Long data type. If multiple ACL rules have the same priority, the rule with the earliest timestamp takes effect.

    		1553777700000
    DestCidrstring

    The destination CIDR block.

    The value of this parameter is in CIDR notation. Example: 192.168.10.0/24.

    		0.0.0.0/0
    DpiSignatureIdsarray

    The IDs of applications that match the ACL rule.

    string
    		1
    IpProtocolstring

    The protocol used by the ACL rule.

    		ALL

    Examples

    Sample success responses

    JSONformat

    {
  "Policy": "accept",
  "Description": "test",
  "RequestId": "7F3DD2C1-0F6B-4575-9106-B2D50DF7A711",
  "SourcePortRange": "-1/-1",
  "SourceCidr": "0.0.0.0/0",
  "Priority": 1,
  "AclId": "acl-jdc7tir4fkplwr****",
  "AcrId": "acr-r8hezn2pi39s5a****",
  "DestPortRange": "-1/-1",
  "Direction": "in",
  "DpiGroupIds": {
    "DpiGroupId": [
      "20"
    ]
  },
  "Name": "doctest",
  "GmtCreate": 1553777700000,
  "DestCidr": "0.0.0.0/0",
  "DpiSignatureIds": {
    "DpiSignatureId": [
      "1"
    ]
  },
  "IpProtocol": "ALL"
}

    Error codes

    HTTP status codeError codeError messageDescription
    400ACL.NoSupportWanTypeAn SAG 1000 device does not support a WAN ACL.An SAG 1000 device does not support a WAN ACL.
    400ACL.InvalidTypeThe specified ACL type is invalid.The specified ACL type is invalid.
    403ForbiddenUser not authorized to operate on the specified resource.You do not have permissions to manage the specified resource.
    403MissingParameterThe input parameter is missing, please check your input.Missing parameters. Check whether all required parameters are set.
    403InvalidDescriptionDescription not valid.The length of the description has exceeded the upper limit.
    403InvalidParameterThe specified parameter is invalid.Invalid parameters.
    403FeatureNotSupportThe current edition of the smart access gateway does not support this feature.The current version of Smart Access Gateway does not support this feature.
    403FeatureNotSupportForActiveSmartAGThe current edition of the active smart access gateway does not support this feature.The current edition of the active SAG instance does not support this feature.
    403FeatureNotSupportForStandBySmartAGThe current edition of the standby smart access gateway does not support this feature.The current version of Smart Access Gateway does not support this feature.
    403NotSupportedProtocolThe specified protocol of the ACL rule is not supported.The specified protocol of the ACL rule is not supported.
    403InvalidId.ACLThe specified ACL ID is invalid.The specified ACL group ID is invalid.
    403InvalidId.ACRThe specified ACL rule ID is invalid.The specified ACL rule ID is invalid.
    403InvalidPortRangeThe specified port range is invalid.The specified port range is invalid.
    403InternalErrorAn internal server error occurred.An internal server error occurred.

    For a list of error codes, visit the Service error codes.

    Change history

    Change timeSummary of changesOperation
    No change history