Can ACLs Match IP Prefix and Mask Length? H12-821 Exam Question

ACL Matching Capabilities in Huawei Routing

The statement is FALSE. Standard and Extended Access Control Lists (ACLs) on Huawei devices are capable of matching routes based on both the IP address prefix and its subnet mask length. This capability is primarily utilized when ACLs are applied to routing policies for route filtering.

Mechanism: Wildcard Mask vs. Prefix Length

A common misconception, often cited in comments, is that ACLs only evaluate bits using a wildcard mask and cannot distinguish between prefixes like 10.1.1.0/24 and 10.1.1.0/25 if they share the same network portion. While it is true that an ACL entry defines a range of addresses using a base IP and a wildcard mask, this does not mean it ignores the prefix length entirely. When configuring a rule to match a specific route, you specify the network address and the wildcard mask. The combination effectively filters for specific prefix lengths. For example, to match exactly /24, you use a wildcard mask of 0.0.0.255; to match /25, you might use 0.0.0.127. Thus, the ACL inherently distinguishes between different mask lengths by requiring the user to define the exact bit pattern via the wildcard.

Practical Application in Route-Policy

In Huawei VRP, ACLs are frequently used within route-policy nodes to filter routes. The command rule 1 permit ip source x.x.x.x y.y.y.y allows administrators to select routes based on their destination IP and mask. If the question implies that an ACL cannot be used to differentiate or match specific prefix lengths (like distinguishing /24 from /28), it is incorrect because the wildcard mask mechanism provides granular control over the mask bits as well as the address bits. Therefore, ACLs can indeed be used to match both the IP address prefix and the mask length.