netconfcentral logo

ietf-access-control-list

HTML

ietf-access-control-list@2017-10-03



  module ietf-access-control-list {

    yang-version 1.1;

    namespace
      "urn:ietf:params:xml:ns:yang:ietf-access-control-list";

    prefix acl;

    import ietf-yang-types {
      prefix yang;
    }
    import ietf-packet-fields {
      prefix packet-fields;
    }
    import ietf-interfaces {
      prefix if;
    }

    organization
      "IETF NETMOD (NETCONF Data Modeling Language)
     Working Group";

    contact
      "WG Web: http://tools.ietf.org/wg/netmod/
     WG List: netmod@ietf.org

     Editor: Mahesh Jethanandani
             mjethanandani@gmail.com
     Editor: Lisa Huang
             lyihuang16@gmail.com
     Editor: Sonal Agarwal
             sagarwal12@cisco.com
     Editor: Dana Blair
             dblair@cisco.com";

    description
      "This YANG module defines a component that describe the
     configuration of Access Control Lists (ACLs).

     Copyright (c) 2017 IETF Trust and the persons identified as
     the document authors.  All rights reserved.
     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject
     to the license terms contained in, the Simplified BSD
     License set forth in Section 4.c of the IETF Trust's Legal
     Provisions Relating to IETF Documents
     (http://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC XXXX; see
     the RFC itself for full legal notices.";

    revision "2017-10-03" {
      description
        "Added feature and identity statements for different types
       of rule matches. Split the matching rules based on the
       feature statement and added a must statement within
       each container.";
      reference
        "RFC XXX: Network Access Control List (ACL) YANG Data Model.";

    }


    identity forwarding-action {
      base 
      description
        "Base identity for actions in the forwarding category";
    }

    identity accept {
      base forwarding-action;
      description "Accept the packet";
    }

    identity drop {
      base forwarding-action;
      description
        "Drop packet without sending any ICMP error message";
    }

    identity reject {
      base forwarding-action;
      description
        "Drop the packet and send an ICMP error message to the source";
    }

    identity log-action {
      base 
      description
        "Base identity for defining the destination for logging actions";
    }

    identity log-syslog {
      base log-action;
      description
        "System log (syslog) the information for the packet";
    }

    identity log-none {
      base log-action;
      description
        "No logging for the packet";
    }

    identity acl-base {
      base 
      description
        "Base Access Control List type for all Access Control List type
       identifiers.";
    }

    identity ipv4-acl {
      base acl:acl-base;
      description
        "ACL that primarily matches on fields from the IPv4 header
       (e.g. IPv4 destination address) and layer 4 headers (e.g. TCP
       destination port).  An acl of type ipv4-acl does not contain
       matches on fields in the ethernet header or the IPv6 header.";
    }

    identity ipv6-acl {
      base acl:acl-base;
      description
        "ACL that primarily matches on fields from the IPv6 header
       (e.g. IPv6 destination address) and layer 4 headers (e.g. TCP
       destination port). An acl of type ipv6-acl does not contain
       matches on fields in the ethernet header or the IPv4 header.";
    }

    identity eth-acl {
      base acl:acl-base;
      description
        "ACL that primarily matches on fields in the ethernet header,
       like 10/100/1000baseT or WiFi Access Control List. An acl of
       type eth-acl does not contain matches on fields in the IPv4
       header, IPv6 header or layer 4 headers.";
    }

    identity mixed-l2-l3-ipv4-acl {
      base acl:acl-base;
      description
        "ACL that contains a mix of entries that
       primarily match on fields in ethernet headers,
       entries that primarily match on IPv4 headers.
       Matching on layer 4 header fields may also exist in the
       list.";
    }

    identity mixed-l2-l3-ipv6-acl {
      base acl:acl-base;
      description
        "ACL that contains a mix of entries that
       primarily match on fields in ethernet headers, entries
       that primarily match on fields in IPv6 headers. Matching on
       layer 4 header fields may also exist in the list.";
    }

    identity mixed-l2-l3-ipv4-ipv6-acl {
      base acl:acl-base;
      description
        "ACL that contains a mix of entries that
       primarily match on fields in ethernet headers, entries
       that primarily match on fields in IPv4 headers, and entries
       that primarily match on fields in IPv6 headers. Matching on
       layer 4 header fields may also exist in the list.";
    }

    identity any-acl {
      base acl:acl-base;
      description
        "ACL that can contain any pattern to match upon";
    }

    feature l2-acl {
      description "Layer 2 ACL supported";
    }

    feature ipv4-acl {
      description
        "Layer 3 IPv4 ACL supported";
    }

    feature ipv6-acl {
      description
        "Layer 3 IPv6 ACL supported";
    }

    feature mixed-ipv4-acl {
      description
        "Layer 2 and Layer 3 IPv4 ACL supported";
    }

    feature mixed-ipv6-acl {
      description
        "Layer 2 and Layer 3 IPv6 ACL supported";
    }

    feature l2-l3-ipv4-ipv6-acl {
      description
        "Layer 2 and any Layer 3 ACL supported.";
    }

    feature tcp-acl {
      description
        "TCP header ACL supported.";
    }

    feature udp-acl {
      description
        "UDP header ACL supported.";
    }

    feature icmp-acl {
      description
        "ICMP header ACL supported.";
    }

    feature any-acl {
      description "ACL for any pattern.";
    }

    feature interface-stats {
      description
        "ACL counters are available and reported only per interface";
    }

    feature acl-aggregate-stats {
      description
        "ACL counters are aggregated over all interfaces, and reported
       only per ACL entry";
    }

    feature interface-acl-aggregate {
      description
        "ACL counters are reported per interface, and also aggregated
       and reported per ACL entry";
    }

    typedef acl-type {
      type identityref {
        base acl-base;
      }
      description
        "This type is used to refer to an Access Control List
       (ACL) type";
    }

    typedef acl-ref {
      type leafref {
        path "/access-lists/acl/acl-name";
      }
      description
        "This type is used by data models that need to reference an
       Access Control List";
    }

    grouping interface-acl {
      description
        "Grouping for per-interface ingress ACL data";
      container acl-sets {
        description
          "Enclosing container the list of ingress ACLs on the
         interface";
        list acl-set {
          key "set-name type";
          ordered-by user;
          description
            "List of ingress ACLs on the interface";
          leaf set-name {
            type leafref {
              path
                "../../../../../../acl/acl-name";
            }
            description
              "Reference to the ACL set name applied on ingress";
          }

          leaf type {
            type leafref {
              path
                "../../../../../../acl/acl-type";
            }
            description
              "Reference to the ACL set type applied on ingress";
          }

          list ace {
            if-feature interface-stats or interface-acl-aggregate;
            key "rule-name";
            description
              "List of access list entries(ACE)";
            leaf rule-name {
              type leafref {
                path
                  "../../../../../../../acl/aces/ace/rule-name";
              }
              description
                "The ace rule-name";
            }

            uses acl-counters;
          }  // list ace
        }  // list acl-set
      }  // container acl-sets
    }  // grouping interface-acl

    grouping acl-counters {
      description
        "Common grouping for ACL counters";
      leaf matched-packets {
        type yang:counter64;
        config false;
        description
          "Count of the number of packets matching the current ACL
         entry.

         An implementation should provide this counter on a
         per-interface per-ACL-entry if possible.

         If an implementation only supports ACL counters per entry
         (i.e., not broken out per interface), then the value
         should be equal to the aggregate count across all interfaces.
         An implementation that provides counters per entry per
         interface is not required to also provide an aggregate count,
         e.g., per entry -- the user is expected to be able implement
         the required aggregation if such a count is needed.";
      }

      leaf matched-octets {
        type yang:counter64;
        config false;
        description
          "Count of the number of octets (bytes) matching the current
         ACL entry.

         An implementation should provide this counter on a
         per-interface per-ACL-entry if possible.

         If an implementation only supports ACL counters per entry
         (i.e., not broken out per interface), then the value
         should be equal to the aggregate count across all interfaces.

         An implementation that provides counters per entry per
         interface is not required to also provide an aggregate count,
         e.g., per entry -- the user is expected to be able implement
         the required aggregation if such a count is needed.";
      }
    }  // grouping acl-counters

    container access-lists {
      description
        "This is a top level container for Access Control Lists.
       It can have one or more Access Control Lists.";
      list acl {
        key "acl-type acl-name";
        description
          "An Access Control List(ACL) is an ordered list of
         Access List Entries (ACE). Each Access Control Entry has a
         list of match criteria and a list of actions.
         Since there are several kinds of Access Control Lists
         implemented with different attributes for
         different vendors, this
         model accommodates customizing Access Control Lists for
         each kind and for each vendor.";
        leaf acl-name {
          type string {
            length "1..64";
          }
          description
            "The name of access-list. A device MAY restrict the length
           and value of this name, possibly space and special
           characters are not allowed.";
        }

        leaf acl-type {
          type acl-type;
          description
            "Type of access control list. Indicates the primary intended
           type of match criteria (e.g. ethernet, IPv4, IPv6, mixed,
           etc) used in the list instance.";
        }

        container aces {
          description
            "The access-list-entries container contains
           a list of access-list-entries(ACE).";
          list ace {
            key "rule-name";
            ordered-by user;
            description
              "List of access list entries(ACE)";
            leaf rule-name {
              type string {
                length "1..64";
              }
              description
                "A unique name identifying this Access List
               Entry(ACE).";
            }

            container matches {
              description
                "The rules in this set determine what fields will be
               matched upon before any action is taken on them.
               The rules are selected based on the feature set
               defined by the server and the acl-type defined.";
              container l2-acl {
                if-feature l2-acl;
                must
                  "derived-from(../../../../acl-type, 'acl:eth-acl')";
                description
                  "Rule set for L2 ACL.";
                uses packet-fields:acl-eth-header-fields;
              }  // container l2-acl

              container ipv4-acl {
                if-feature ipv4-acl;
                must
                  "derived-from(../../../../acl-type, "
                    + "'acl:ipv4-acl')";
                description
                  "Rule set that supports IPv4 headers.";
                uses packet-fields:acl-ip-header-fields;

                uses packet-fields:acl-ipv4-header-fields;
              }  // container ipv4-acl

              container ipv6-acl {
                if-feature ipv6-acl;
                must
                  "derived-from(../../../../acl-type, "
                    + "'acl:ipv6-acl')";
                description
                  "Rule set that supports IPv6 headers.";
                uses packet-fields:acl-ip-header-fields;

                uses packet-fields:acl-ipv6-header-fields;
              }  // container ipv6-acl

              container l2-l3-ipv4-acl {
                if-feature mixed-ipv4-acl;
                must
                  "derived-from(../../../../acl-type, "
                    + "'acl:mixed-l2-l3-ipv4-acl')";
                description
                  "Rule set that is a logical AND (&&) of l2
                 and ipv4 headers.";
                uses packet-fields:acl-eth-header-fields;

                uses packet-fields:acl-ip-header-fields;

                uses packet-fields:acl-ipv4-header-fields;
              }  // container l2-l3-ipv4-acl

              container l2-l3-ipv6-acl {
                if-feature mixed-ipv6-acl;
                must
                  "derived-from(../../../../acl-type, "
                    + "'acl:mixed-l2-l3-ipv6-acl')";
                description
                  "Rule set that is a logical AND (&&) of L2
                 && IPv6 headers.";
                uses packet-fields:acl-eth-header-fields;

                uses packet-fields:acl-ip-header-fields;

                uses packet-fields:acl-ipv6-header-fields;
              }  // container l2-l3-ipv6-acl

              container l2-l3-ipv4-ipv6-acl {
                if-feature l2-l3-ipv4-ipv6-acl;
                must
                  "derived-from(../../../../acl-type, "
                    + "'acl:mixed-l2-l3-ipv4-ipv6-acl')";
                description
                  "Rule set that is a logical AND (&&) of L2
                 && IPv4 && IPv6 headers.";
                uses packet-fields:acl-eth-header-fields;

                uses packet-fields:acl-ip-header-fields;

                uses packet-fields:acl-ipv4-header-fields;

                uses packet-fields:acl-ipv6-header-fields;
              }  // container l2-l3-ipv4-ipv6-acl

              container tcp-acl {
                if-feature tcp-acl;
                description
                  "Rule set that defines TCP headers.";
                uses packet-fields:acl-tcp-header-fields;
              }  // container tcp-acl

              container udp-acl {
                if-feature udp-acl;
                description
                  "Rule set that defines UDP headers.";
                uses packet-fields:acl-udp-header-fields;
              }  // container udp-acl

              container icmp-acl {
                if-feature icmp-acl;
                description
                  "Rule set that defines ICMP headers.";
                uses packet-fields:acl-icmp-header-fields;
              }  // container icmp-acl

              container any-acl {
                if-feature any-acl;
                must
                  "derived-from(../../../../acl-type, 'acl:any-acl')";
                presence "Matches any";
                description
                  "Rule set that allows for a any ACL.";
              }  // container any-acl

              leaf interface {
                type if:interface-ref;
                description
                  "Interface name that is specified to
                 match upon.";
              }
            }  // container matches

            container actions {
              if-feature acl-aggregate-stats or interface-acl-aggregate;
              description
                "Definitions of action criteria for this ace entry";
              leaf forwarding {
                type identityref {
                  base forwarding-action;
                }
                mandatory true;
                description
                  "Specifies the forwarding action per ace entry";
              }

              leaf logging {
                type identityref {
                  base log-action;
                }
                default 'log-none';
                description
                  "Specifies the log action and destination for
                   matched packets. Default value is not to log the
                   packet.";
              }

              leaf icmp-off {
                type boolean;
                default "false";
                description
                  "true indicates ICMP errors will never be generated
                   in response to an ICMP error message. false indicates
                   ICMP error will be generated.";
              }
            }  // container actions

            uses acl-counters;
          }  // list ace
        }  // container aces
      }  // list acl

      container interfaces {
        description
          "Enclosing container for the list of interfaces on which
         ACLs are set";
        list interface {
          key "interface-id";
          description
            "List of interfaces on which ACLs are set";
          leaf interface-id {
            type if:interface-ref;
            description
              "Reference to the interface id list key";
          }

          container ingress {
            description
              "The ACL's applied to ingress interface";
            uses interface-acl;
          }  // container ingress

          container egress {
            description
              "The ACL's applied to egress interface";
            uses interface-acl;
          }  // container egress
        }  // list interface
      }  // container interfaces
    }  // container access-lists
  }  // module ietf-access-control-list

Summary

  
  
Organization IETF NETMOD (NETCONF Data Modeling Language) Working Group
  
Module ietf-access-control-list
Version 2017-10-03
File ietf-access-control-list@2017-10-03.yang
  
Prefix acl
Namespace urn:ietf:params:xml:ns:yang:ietf-access-control-list
  
Cooked /cookedmodules/ietf-access-control-list/2017-10-03
YANG /src/ietf-access-control-list@2017-10-03.yang
XSD /xsd/ietf-access-control-list@2017-10-03.xsd
  
Abstract This YANG module defines a component that describe the configuration of Access Control Lists (ACLs). Copyright (c) 2017 IETF Tr...
  
Contact
WG Web: http://tools.ietf.org/wg/netmod/
WG List: netmod@ietf.org

Editor: Mahesh Jethanandani
	mjethanandani@gmail.com
Editor: Lisa Huang
	lyihuang16@gmail.com
Editor: Sonal Agarwal
	sagarwal12@cisco.com
Editor: Dana Blair
	dblair@cisco.com

Description

 
This YANG module defines a component that describe the
configuration of Access Control Lists (ACLs).

Copyright (c) 2017 IETF Trust and the persons identified as
the document authors.  All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD
License set forth in Section 4.c of the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info).

This version of this YANG module is part of RFC XXXX; see
the RFC itself for full legal notices.

Typedefs

Typedef Base type Abstract
acl-ref leafref This type is used by data models that need to reference an Access Control List
acl-type identityref This type is used to refer to an Access Control List (ACL) type

Groupings

Grouping Objects Abstract
acl-counters matched-packets matched-octets Common grouping for ACL counters
interface-acl acl-sets Grouping for per-interface ingress ACL data

Objects

Type Key
Mandatory config
Optional config
Not config
Object Type Abstract
access-lists container This is a top level container for Access Control Lists. It can have one or more Access Control Lists.
   acl list An Access Control List(ACL) is an ordered list of Access List Entries (ACE). Each Access Control Entry has a list of match criteria and a list of actions. Since there are several kinds of Access Control Lists implemented with different attributes for diff...
      aces container The access-list-entries container contains a list of access-list-entries(ACE).
         ace list List of access list entries(ACE)
            actions container Definitions of action criteria for this ace entry
               forwarding leaf Specifies the forwarding action per ace entry
               icmp-off leaf true indicates ICMP errors will never be generated in response to an ICMP error message. false indicates ICMP error will be generated.
               logging leaf Specifies the log action and destination for matched packets. Default value is not to log the packet.
            matched-octets leaf Count of the number of octets (bytes) matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interfa...
            matched-packets leaf Count of the number of packets matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), th...
            matches container The rules in this set determine what fields will be matched upon before any action is taken on them. The rules are selected based on the feature set defined by the server and the acl-type defined.
               any-acl container Rule set that allows for a any ACL.
               icmp-acl container Rule set that defines ICMP headers.
                  code leaf ICMP subtype. Also known as Control messages.
                  rest-of-header leaf Four-bytes field, contents vary based on the ICMP type and code.
                  type leaf Also known as Control messages.
               interface leaf Interface name that is specified to match upon.
               ipv4-acl container Rule set that supports IPv4 headers.
                  destination-ipv4-network leaf Destination IPv4 address prefix.
                  destination-port-range container Inclusive range representing destination ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both valu...
                     lower-port leaf Lower boundary for port.
                     operations leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If existing, the upper port must be greater or equal to lower-port
                  dscp leaf Differentiated Services Code Point.
                  ecn leaf Explicit Congestion Notification.
                  flags leaf Bit definitions for the flags field in IPv4 header.
                  identification leaf An identifying value assigned by the sender to aid in assembling the fragments of a datagram.
                  ihl leaf An IPv4 header field, the Internet Header Length (IHL) is the length of the internet header in 32 bit words, and thus points to the beginning of the data. Note that the minimum value for a correct header is 5.
                  length leaf In IPv4 header field, this field is known as the Total Length. Total Length is the length of the datagram, measured in octets, including internet header and data. In IPv6 header field, this field is known as the Payload Length, the length of the IPv6 pay...
                  offset leaf The fragment offset is measured in units of 8 octets (64 bits). The first fragment has offset zero. The length is 13 bits
                  protocol leaf Internet Protocol number.
                  source-ipv4-network leaf Source IPv4 address prefix.
                  source-port-range container Inclusive range representing source ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both values. ...
                     lower-port leaf Lower boundary for port.
                     operation leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If it exists, the upper port must be greater or equal to lower-port.
                  ttl leaf This field indicates the maximum time the datagram is allowed to remain in the internet system. If this field contains the value zero, then the datagram must be destroyed. In IPv6, this field is known as the Hop Limit.
               ipv6-acl container Rule set that supports IPv6 headers.
                  destination-ipv6-network leaf Destination IPv6 address prefix.
                  destination-port-range container Inclusive range representing destination ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both valu...
                     lower-port leaf Lower boundary for port.
                     operations leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If existing, the upper port must be greater or equal to lower-port
                  dscp leaf Differentiated Services Code Point.
                  ecn leaf Explicit Congestion Notification.
                  flow-label leaf IPv6 Flow label.
                  length leaf In IPv4 header field, this field is known as the Total Length. Total Length is the length of the datagram, measured in octets, including internet header and data. In IPv6 header field, this field is known as the Payload Length, the length of the IPv6 pay...
                  next-header leaf Identifies the type of header immediately following the IPv6 header. Uses the same values as the IPv4 Protocol field.
                  protocol leaf Internet Protocol number.
                  source-ipv6-network leaf Source IPv6 address prefix.
                  source-port-range container Inclusive range representing source ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both values. ...
                     lower-port leaf Lower boundary for port.
                     operation leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If it exists, the upper port must be greater or equal to lower-port.
                  ttl leaf This field indicates the maximum time the datagram is allowed to remain in the internet system. If this field contains the value zero, then the datagram must be destroyed. In IPv6, this field is known as the Hop Limit.
               l2-acl container Rule set for L2 ACL.
                  destination-mac-address leaf Destination IEEE 802 MAC address.
                  destination-mac-address-mask leaf Destination IEEE 802 MAC address mask.
                  ethertype leaf The Ethernet Type (or Length) value represented in the canonical order defined by IEEE 802. The canonical representation uses lowercase characters.
                  source-mac-address leaf Source IEEE 802 MAC address.
                  source-mac-address-mask leaf Source IEEE 802 MAC address mask.
               l2-l3-ipv4-acl container Rule set that is a logical AND (&&) of l2 and ipv4 headers.
                  destination-ipv4-network leaf Destination IPv4 address prefix.
                  destination-mac-address leaf Destination IEEE 802 MAC address.
                  destination-mac-address-mask leaf Destination IEEE 802 MAC address mask.
                  destination-port-range container Inclusive range representing destination ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both valu...
                     lower-port leaf Lower boundary for port.
                     operations leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If existing, the upper port must be greater or equal to lower-port
                  dscp leaf Differentiated Services Code Point.
                  ecn leaf Explicit Congestion Notification.
                  ethertype leaf The Ethernet Type (or Length) value represented in the canonical order defined by IEEE 802. The canonical representation uses lowercase characters.
                  flags leaf Bit definitions for the flags field in IPv4 header.
                  identification leaf An identifying value assigned by the sender to aid in assembling the fragments of a datagram.
                  ihl leaf An IPv4 header field, the Internet Header Length (IHL) is the length of the internet header in 32 bit words, and thus points to the beginning of the data. Note that the minimum value for a correct header is 5.
                  length leaf In IPv4 header field, this field is known as the Total Length. Total Length is the length of the datagram, measured in octets, including internet header and data. In IPv6 header field, this field is known as the Payload Length, the length of the IPv6 pay...
                  offset leaf The fragment offset is measured in units of 8 octets (64 bits). The first fragment has offset zero. The length is 13 bits
                  protocol leaf Internet Protocol number.
                  source-ipv4-network leaf Source IPv4 address prefix.
                  source-mac-address leaf Source IEEE 802 MAC address.
                  source-mac-address-mask leaf Source IEEE 802 MAC address mask.
                  source-port-range container Inclusive range representing source ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both values. ...
                     lower-port leaf Lower boundary for port.
                     operation leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If it exists, the upper port must be greater or equal to lower-port.
                  ttl leaf This field indicates the maximum time the datagram is allowed to remain in the internet system. If this field contains the value zero, then the datagram must be destroyed. In IPv6, this field is known as the Hop Limit.
               l2-l3-ipv4-ipv6-acl container Rule set that is a logical AND (&&) of L2 && IPv4 && IPv6 headers.
                  destination-ipv4-network leaf Destination IPv4 address prefix.
                  destination-ipv6-network leaf Destination IPv6 address prefix.
                  destination-mac-address leaf Destination IEEE 802 MAC address.
                  destination-mac-address-mask leaf Destination IEEE 802 MAC address mask.
                  destination-port-range container Inclusive range representing destination ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both valu...
                     lower-port leaf Lower boundary for port.
                     operations leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If existing, the upper port must be greater or equal to lower-port
                  dscp leaf Differentiated Services Code Point.
                  ecn leaf Explicit Congestion Notification.
                  ethertype leaf The Ethernet Type (or Length) value represented in the canonical order defined by IEEE 802. The canonical representation uses lowercase characters.
                  flags leaf Bit definitions for the flags field in IPv4 header.
                  flow-label leaf IPv6 Flow label.
                  identification leaf An identifying value assigned by the sender to aid in assembling the fragments of a datagram.
                  ihl leaf An IPv4 header field, the Internet Header Length (IHL) is the length of the internet header in 32 bit words, and thus points to the beginning of the data. Note that the minimum value for a correct header is 5.
                  length leaf In IPv4 header field, this field is known as the Total Length. Total Length is the length of the datagram, measured in octets, including internet header and data. In IPv6 header field, this field is known as the Payload Length, the length of the IPv6 pay...
                  next-header leaf Identifies the type of header immediately following the IPv6 header. Uses the same values as the IPv4 Protocol field.
                  offset leaf The fragment offset is measured in units of 8 octets (64 bits). The first fragment has offset zero. The length is 13 bits
                  protocol leaf Internet Protocol number.
                  source-ipv4-network leaf Source IPv4 address prefix.
                  source-ipv6-network leaf Source IPv6 address prefix.
                  source-mac-address leaf Source IEEE 802 MAC address.
                  source-mac-address-mask leaf Source IEEE 802 MAC address mask.
                  source-port-range container Inclusive range representing source ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both values. ...
                     lower-port leaf Lower boundary for port.
                     operation leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If it exists, the upper port must be greater or equal to lower-port.
                  ttl leaf This field indicates the maximum time the datagram is allowed to remain in the internet system. If this field contains the value zero, then the datagram must be destroyed. In IPv6, this field is known as the Hop Limit.
               l2-l3-ipv6-acl container Rule set that is a logical AND (&&) of L2 && IPv6 headers.
                  destination-ipv6-network leaf Destination IPv6 address prefix.
                  destination-mac-address leaf Destination IEEE 802 MAC address.
                  destination-mac-address-mask leaf Destination IEEE 802 MAC address mask.
                  destination-port-range container Inclusive range representing destination ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both valu...
                     lower-port leaf Lower boundary for port.
                     operations leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If existing, the upper port must be greater or equal to lower-port
                  dscp leaf Differentiated Services Code Point.
                  ecn leaf Explicit Congestion Notification.
                  ethertype leaf The Ethernet Type (or Length) value represented in the canonical order defined by IEEE 802. The canonical representation uses lowercase characters.
                  flow-label leaf IPv6 Flow label.
                  length leaf In IPv4 header field, this field is known as the Total Length. Total Length is the length of the datagram, measured in octets, including internet header and data. In IPv6 header field, this field is known as the Payload Length, the length of the IPv6 pay...
                  next-header leaf Identifies the type of header immediately following the IPv6 header. Uses the same values as the IPv4 Protocol field.
                  protocol leaf Internet Protocol number.
                  source-ipv6-network leaf Source IPv6 address prefix.
                  source-mac-address leaf Source IEEE 802 MAC address.
                  source-mac-address-mask leaf Source IEEE 802 MAC address mask.
                  source-port-range container Inclusive range representing source ports to be used. When only lower-port is present, it represents a single port and eq operator is assumed to be default. When both lower-port and upper-port are specified, it implies a range inclusive of both values. ...
                     lower-port leaf Lower boundary for port.
                     operation leaf Operator to be applied on the lower-port.
                     upper-port leaf Upper boundary for port. If it exists, the upper port must be greater or equal to lower-port.
                  ttl leaf This field indicates the maximum time the datagram is allowed to remain in the internet system. If this field contains the value zero, then the datagram must be destroyed. In IPv6, this field is known as the Hop Limit.
               tcp-acl container Rule set that defines TCP headers.
                  acknowledgement-number leaf The acknowledgement number that appears in the packet.
                  data-offset leaf Specifies the size of the TCP header in 32-bit words. The minimum size header is 5 words and the maximum is 15 words thus giving the minimum size of 20 bytes and maximum of 60 bytes, allowing for up to 40 bytes of options in the header.
                  flags leaf Also known as Control Bits. Contains 9 1-bit flags.
                  options leaf The length of this field is determined by the data offset field. Options have up to three fields: Option-Kind (1 byte), Option-Length (1 byte), Option-Data (variable). The Option-Kind field indicates the type of option, and is the only field that is not o...
                  reserved leaf Reserved for future use.
                  sequence-number leaf Sequence number that appears in the packet.
                  urgent-pointer leaf This field is an offset from the sequence number indicating the last urgent data byte.
                  window-size leaf The size of the receive window, which specifies the number of window size units (by default, bytes) (beyond the segment identified by the sequence number in the acknowledgment field) that the sender of this segment is currently willing to receive.
               udp-acl container Rule set that defines UDP headers.
                  length leaf A field that specifies the length in bytes of the UDP header and UDP data. The minimum length is 8 bytes because that is the length of the header. The field size sets a theoretical limit of 65,535 bytes (8 byte header + 65,527 bytes of data) for a UDP dat...
            rule-name leaf A unique name identifying this Access List Entry(ACE).
      acl-name leaf The name of access-list. A device MAY restrict the length and value of this name, possibly space and special characters are not allowed.
      acl-type leaf Type of access control list. Indicates the primary intended type of match criteria (e.g. ethernet, IPv4, IPv6, mixed, etc) used in the list instance.
   interfaces container Enclosing container for the list of interfaces on which ACLs are set
      interface list List of interfaces on which ACLs are set
         egress container The ACL's applied to egress interface
            acl-sets container Enclosing container the list of ingress ACLs on the interface
               acl-set list List of ingress ACLs on the interface
                  ace list List of access list entries(ACE)
                     matched-octets leaf Count of the number of octets (bytes) matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interfa...
                     matched-packets leaf Count of the number of packets matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), th...
                     rule-name leaf The ace rule-name
                  set-name leaf Reference to the ACL set name applied on ingress
                  type leaf Reference to the ACL set type applied on ingress
         ingress container The ACL's applied to ingress interface
            acl-sets container Enclosing container the list of ingress ACLs on the interface
               acl-set list List of ingress ACLs on the interface
                  ace list List of access list entries(ACE)
                     matched-octets leaf Count of the number of octets (bytes) matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interfa...
                     matched-packets leaf Count of the number of packets matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), th...
                     rule-name leaf The ace rule-name
                  set-name leaf Reference to the ACL set name applied on ingress
                  type leaf Reference to the ACL set type applied on ingress
         interface-id leaf Reference to the interface id list key