Analyzing Huawei Advanced ACL Rule Syntax and Behavior

H12-821 By islever Editorial Last updated

Routing Policy and Routing Control

Short answer

B The statement is false because the ACL rule specifically permits only ICMP packets, not general IP packets, from the specified source to the destination network.

Question

A router uses an advanced ACL to filter data. The ACL configuration is shown below. Which of the following statements is false about the configuration?
[Huawei] ad 3001
[Huawei-ad-adv-3001] rule permit icmp source 192.168.1.3 0 destination 192.168.2.0 0.0.0.255
  1. The ACL denies ICMP packets from host 192.168.1.2 to network segment 192.168.2.0/24.
  2. The ACL permits IP packets from host 192.168.1.3 to network segment 192.168.2.0/24. Correct Answer
  3. The ACL is a numbered ACL whose number is 3001.
  4. The ACL permits ICMP packets from host 192.168.1.3 to host 192.168.2.200.

Key Takeaways

The main trap is overlooking the protocol specifier (icmp) in the ACL rule, leading to the incorrect assumption that it applies to all IP traffic rather than just ICMP.

This question tests understanding of Huawei advanced ACL syntax, specifically how protocol specifications and wildcard masks define permitted traffic. The correct answer identifies that the rule permits ICMP, not all IP packets.

Common mistake: Many candidates might choose Option A as false, mistakenly believing that the ACL explicitly permits all traffic or fails to recognize the implicit deny at the end of the ACL list.

Expert Analysis

The configuration provided defines an advanced ACL (indicated by the ad command and number 3001). In Huawei's numbering scheme, advanced ACLs range from 3000 to 3999. This immediately validates that the ACL is indeed numbered 3001, making statement C true.

The specific rule is: rule permit icmp source 192.168.1.3 0 destination 192.168.2.0 0.0.0.255. Let's break down the components:

  1. Action: permit. The rule allows traffic matching the criteria.
  2. Protocol: icmp. This rule applies strictly to ICMP packets, not all IP packets.
  3. Source: 192.168.1.3 0. A wildcard mask of 0 means an exact match. Thus, the source must be exactly host 192.168.1.3.
  4. Destination: 192.168.2.0 0.0.0.255. A wildcard mask of 0.0.0.255 corresponds to a subnet mask of 255.255.255.0, or a /24 prefix. This matches any host in the 192.168.2.0/24 network segment.

Evaluating the options against this analysis:

  • Option D states the ACL permits ICMP packets from host 192.168.1.3 to host 192.168.2.200. Since 192.168.2.200 is within the 192.168.2.0/24 range, this statement is true.
  • Option A states the ACL denies ICMP packets from host 192.168.1.2 to network segment 192.168.2.0/24. Advanced ACLs have an implicit deny at the end. Since host 192.168.1.2 does not match the explicit permit rule for source 192.168.1.3, these packets are denied by default. Thus, this statement is true.
  • Option B claims the ACL permits IP packets from host 192.168.1.3 to network segment 192.168.2.0/24. This is incorrect because the rule explicitly specifies the icmp protocol. It does not permit other IP protocols like TCP or UDP. Therefore, this statement is false.

The question asks for the false statement, which is B.

Exam Strategy

When analyzing ACL rules, always isolate the four key components: Action (permit/deny), Protocol (ip/icmp/tcp/udp), Source Address/Mask, and Destination Address/Mask. Do not assume 'ip' covers all traffic unless the protocol field is missing or explicitly set to 'ip'. Remember that advanced ACLs end with an implicit deny, so any traffic not explicitly matched by a permit rule is dropped.

Frequently Asked Questions

What does a wildcard mask of 0 mean?

A wildcard mask of 0 indicates an exact match. For example, '192.168.1.3 0' matches only the specific host 192.168.1.3 and no other addresses.

Does an advanced ACL automatically block traffic?

Yes. All Huawei ACLs include an implicit deny any rule at the very end. If a packet does not match any explicit permit rule, it is denied by default.

How do I identify an advanced ACL in Huawei devices?

Advanced ACLs are identified by their number range (3000-3999) and the 'ad' prompt indicator during configuration. They can filter based on protocol, source/destination ports, and IP addresses.

More H12-821 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Adi_1 👍 1 Answered B
    A — True ICMP packets from 192.168.1.2 are indeed denied. B — FALSE The rule specifically permits ICMP packets only — not IP packets in general. C — TRUE ACL number 3001 falls within the advanced (extended) D — TRUE Host 192.168.2.200 falls within the destination range 192.168.2.0 0.0.0.255 (192.168.2.0/24). The source 192.168.1.3 with wildcard 0 (exact match) matches only that specific host. So ICMP packets from 192.168.1.3 to 192.168.2.200 are permitted.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

IS-IS Supported Cost Types: Wide vs Narrow

S-grade

VRRP and BFD Integration Failover Behavior

S-grade

Multiple BGP Processes on a Single Router

S-grade

IS-IS IIH Circuit Type Values for Level-1-2 Routers

S-grade

Practice All H12-821 Questions

Access 168 questions with complete answers and detailed explanations.

View Full H12-821 Practice Test →

← Back to H12-821 Study Guide