netconfcentral logo

openconfig-acl

HTML

openconfig-acl@2017-05-26



  module openconfig-acl {

    yang-version 1;

    namespace
      "http://openconfig.net/yang/acl";

    prefix oc-acl;

    import openconfig-packet-match {
      prefix oc-match;
    }
    import openconfig-interfaces {
      prefix oc-if;
    }
    import openconfig-yang-types {
      prefix oc-yang;
    }
    import openconfig-extensions {
      prefix oc-ext;
    }

    organization "OpenConfig working group";

    contact
      "OpenConfig working group
    www.openconfig.net";

    description
      "This module defines configuration and operational state
    data for network access control lists (i.e., filters, rules,
    etc.).  ACLs are organized into ACL sets, with each set
    containing one or more ACL entries.  ACL sets are identified
    by a unique name, while each entry within a set is assigned
    a sequence-id that determines the order in which the ACL
    rules are applied to a packet.

    Individual ACL rules specify match criteria based on fields in
    the packet, along with an action that defines how matching
    packets should be handled. Entries have a type that indicates
    the type of match criteria, e.g., MAC layer, IPv4, IPv6, etc.";

    revision "2017-05-26" {
      description
        "Separated ACL entries by type";
      reference
        "1.0.0";

    }

    revision "2016-08-08" {
      description
        "OpenConfig public release";
      reference
        "0.2.0";

    }

    revision "2016-01-22" {
      description "Initial revision";
      reference
        "TBD";

    }

    oc-ext:openconfig-version "1.0.0";

    identity ACL_TYPE {
      base 
      description
        "Base identity for types of ACL sets";
    }

    identity ACL_IPV4 {
      base ACL_TYPE;
      description
        "IP-layer ACLs with IPv4 addresses";
    }

    identity ACL_IPV6 {
      base ACL_TYPE;
      description
        "IP-layer ACLs with IPv6 addresses";
    }

    identity ACL_L2 {
      base ACL_TYPE;
      description "MAC-layer ACLs";
    }

    identity ACL_MIXED {
      base ACL_TYPE;
      description
        "Mixed-mode ACL that specifies L2 and L3 protocol
      fields.  This ACL type is not implemented by many
      routing/switching devices.";
    }

    identity FORWARDING_ACTION {
      base 
      description
        "Base identity for actions in the forwarding category";
    }

    identity ACCEPT {
      base FORWARDING_ACTION;
      description "Accept the packet";
    }

    identity DROP {
      base FORWARDING_ACTION;
      description
        "Drop packet without sending any ICMP error message";
    }

    identity REJECT {
      base FORWARDING_ACTION;
      description
        "Drop the packet and send an ICMP error message to the source";
    }

    identity LOG_ACTION {
      base 
      description
        "Base identity for defining the destination for logging
      actions";
    }

    identity LOG_SYSLOG {
      base LOG_ACTION;
      description "Log the packet in Syslog";
    }

    identity LOG_NONE {
      base LOG_ACTION;
      description "No logging";
    }

    identity ACL_COUNTER_CAPABILITY {
      base 
      description
        "Base identity for system to indicate how it is able to report
      counters";
    }

    identity INTERFACE_ONLY {
      base ACL_COUNTER_CAPABILITY;
      description
        "ACL counters are available and reported only per interface";
    }

    identity AGGREGATE_ONLY {
      base ACL_COUNTER_CAPABILITY;
      description
        "ACL counters are aggregated over all interfaces, and reported
      only per ACL entry";
    }

    identity INTERFACE_AGGREGATE {
      base ACL_COUNTER_CAPABILITY;
      description
        "ACL counters are reported per interface, and also aggregated
      and reported per ACL entry.";
    }

    grouping input-interface-config {
      description "Config of interface";
    }  // grouping input-interface-config

    grouping input-interface-state {
      description
        "State information of interface";
    }  // grouping input-interface-state

    grouping input-interface-top {
      description
        "Input interface top level container";
      container input-interface {
        description
          "Input interface container";
        container config {
          description "Config data";
          uses input-interface-config;
        }  // container config

        container state {
          config false;
          description "State information";
          uses input-interface-config;

          uses input-interface-state;
        }  // container state

        uses oc-if:interface-ref;
      }  // container input-interface
    }  // grouping input-interface-top

    grouping action-config {
      description "Config of action type";
      leaf forwarding-action {
        type identityref {
          base FORWARDING_ACTION;
        }
        mandatory true;
        description
          "Specifies the forwarding action.  One forwarding action
        must be specified for each ACL entry";
      }

      leaf log-action {
        type identityref {
          base LOG_ACTION;
        }
        default 'LOG_NONE';
        description
          "Specifies the log action and destination for
        matched packets.  The default is not to log the
        packet.";
      }
    }  // grouping action-config

    grouping action-state {
      description
        "State information of action type";
    }  // grouping action-state

    grouping action-top {
      description
        "ACL action type top level container";
      container actions {
        description
          "Enclosing container for list of ACL actions associated
        with an entry";
        container config {
          description
            "Config data for ACL actions";
          uses action-config;
        }  // container config

        container state {
          config false;
          description
            "State information for ACL actions";
          uses action-config;

          uses action-state;
        }  // container state
      }  // container actions
    }  // grouping action-top

    grouping acl-counters-state {
      description
        "Common grouping for ACL counters";
      leaf matched-packets {
        type oc-yang:counter64;
        description
          "Count of the number of packets matching the current ACL
        entry.

        An implementation should provide this counter on a
        per-interface per-ACL-entry if possible.

        If an implementation only supports ACL counters per entry
        (i.e., not broken out per interface), then the value
        should be equal to the aggregate count across all interfaces.

        An implementation that provides counters per entry per
        interface is not required to also provide an aggregate count,
        e.g., per entry -- the user is expected to be able implement
        the required aggregation if such a count is needed.";
      }

      leaf matched-octets {
        type oc-yang:counter64;
        description
          "Count of the number of octets (bytes) matching the current
        ACL entry.

        An implementation should provide this counter on a
        per-interface per-ACL-entry if possible.

        If an implementation only supports ACL counters per entry
        (i.e., not broken out per interface), then the value
        should be equal to the aggregate count across all interfaces.

        An implementation that provides counters per entry per
        interface is not required to also provide an aggregate count,
        e.g., per entry -- the user is expected to be able implement
        the required aggregation if such a count is needed.";
      }
    }  // grouping acl-counters-state

    grouping access-list-entries-config {
      description
        "Access List Entries (ACE) config.";
      leaf sequence-id {
        type uint32;
        description
          "The sequence id determines the order in which ACL entries
        are applied.  The sequence id must be unique for each entry
        in an ACL set.  Target devices should apply the ACL entry
        rules in the order determined by sequence id, rather than
        the relying only on order in the list.";
      }

      leaf description {
        type string;
        description
          "A user-defined description, or comment, for this Access List
        Entry.";
      }
    }  // grouping access-list-entries-config

    grouping access-list-entries-state {
      description
        "Access List Entries state.";
      uses acl-counters-state;
    }  // grouping access-list-entries-state

    grouping access-list-entries-top {
      description
        "Access list entries to level container";
      container acl-entries {
        description
          "Access list entries container";
        list acl-entry {
          key "sequence-id";
          description
            "List of ACL entries comprising an ACL set";
          leaf sequence-id {
            type leafref {
              path "../config/sequence-id";
            }
            description
              "references the list key";
          }

          container config {
            description
              "Access list entries config";
            uses access-list-entries-config;
          }  // container config

          container state {
            config false;
            description
              "State information for ACL entries";
            uses access-list-entries-config;

            uses access-list-entries-state;
          }  // container state

          uses oc-match:ethernet-header-top {
            when
              "../../config/type='ACL_L2'" {
              description
                "MAC-layer fields are valid when the ACL type is L2";
            }
          }

          uses oc-match:ipv4-protocol-fields-top {
            when
              "../../config/type='ACL_IPV4'" {
              description
                "IPv4-layer fields are valid when the ACL type is
              IPv4";
            }
          }

          uses oc-match:ipv6-protocol-fields-top {
            when
              "../../config/type='ACL_IPV6'" {
              description
                "IPv6-layer fields are valid when the ACL type is
              IPv6";
            }
          }

          uses oc-match:transport-fields-top {
            when
              "../../config/type='ACL_IPV6' or "
                + "../../config/type='ACL_IPV4'" {
              description
                "Transport-layer fields are valid when specifying
              L3 ACL types";
            }
          }

          uses input-interface-top;

          uses action-top;
        }  // list acl-entry
      }  // container acl-entries
    }  // grouping access-list-entries-top

    grouping acl-set-config {
      description
        "Access Control List config";
      leaf name {
        type string;
        description
          "The name of the access-list set";
      }

      leaf type {
        type identityref {
          base ACL_TYPE;
        }
        description
          "The type determines the fields allowed in the ACL entries
        belonging to the ACL set (e.g., IPv4, IPv6, etc.)";
      }

      leaf description {
        type string;
        description
          "Description, or comment, for the ACL set";
      }
    }  // grouping acl-set-config

    grouping acl-set-state {
      description
        "Access Control List state";
    }  // grouping acl-set-state

    grouping acl-set-top {
      description
        "Access list entries variables top level container";
      container acl-sets {
        description
          "Access list entries variables enclosing container";
        list acl-set {
          key "name type";
          description
            "List of ACL sets, each comprising of a list of ACL
          entries";
          leaf name {
            type leafref {
              path "../config/name";
            }
            description
              "Reference to the name list key";
          }

          leaf type {
            type leafref {
              path "../config/type";
            }
            description
              "Reference to the type list key";
          }

          container config {
            description "Access list config";
            uses acl-set-config;
          }  // container config

          container state {
            config false;
            description
              "Access list state information";
            uses acl-set-config;

            uses acl-set-state;
          }  // container state

          uses access-list-entries-top;
        }  // list acl-set
      }  // container acl-sets
    }  // grouping acl-set-top

    grouping interface-acl-entries-config {
      description
        "Configuration data for per-interface ACLs";
    }  // grouping interface-acl-entries-config

    grouping interface-acl-entries-state {
      description
        "Operational state data for per-interface ACL entries";
      leaf sequence-id {
        type leafref {
          path
            "/acl/acl-sets/"
              + "acl-set[name=current()/../../../../set-name]"
              + "[type=current()/../../../../type]/"
              + "acl-entries/acl-entry/sequence-id";
        }
        description
          "Reference to an entry in the ACL set applied to an
        interface";
      }

      uses acl-counters-state;
    }  // grouping interface-acl-entries-state

    grouping interface-acl-entries-top {
      description
        "Top-level grouping for per-interface ACL entries";
      container acl-entries {
        config false;
        description
          "Enclosing container for list of references to ACLs";
        list acl-entry {
          key "sequence-id";
          description
            "List of ACL entries assigned to an interface";
          leaf sequence-id {
            type leafref {
              path "../state/sequence-id";
            }
            description
              "Reference to per-interface acl entry key";
          }

          container state {
            config false;
            description
              "Operational state data for per-interface ACL entries";
            uses interface-acl-entries-config;

            uses interface-acl-entries-state;
          }  // container state
        }  // list acl-entry
      }  // container acl-entries
    }  // grouping interface-acl-entries-top

    grouping interface-ingress-acl-config {
      description
        "Configuration data for per-interface ingress ACLs";
      leaf set-name {
        type leafref {
          path
            "../../../../../../acl-sets/acl-set/config/name";
        }
        description
          "Reference to the ACL set name applied on ingress";
      }

      leaf type {
        type leafref {
          path
            "../../../../../../acl-sets/acl-set[name=current()/../set-name]"
              + "/config/type";
        }
        description
          "Reference to the ACL set type applied on ingress";
      }
    }  // grouping interface-ingress-acl-config

    grouping interface-ingress-acl-state {
      description
        "Operational state data for the per-interface ingress ACL";
    }  // grouping interface-ingress-acl-state

    grouping interface-ingress-acl-top {
      description
        "Top-level grouping for per-interface ingress ACL data";
      container ingress-acl-sets {
        description
          "Enclosing container the list of ingress ACLs on the
        interface";
        list ingress-acl-set {
          key "set-name type";
          description
            "List of ingress ACLs on the interface";
          leaf set-name {
            type leafref {
              path "../config/set-name";
            }
            description
              "Reference to set name list key";
          }

          leaf type {
            type leafref {
              path "../config/type";
            }
            description
              "Reference to type list key";
          }

          container config {
            description
              "Configuration data ";
            uses interface-ingress-acl-config;
          }  // container config

          container state {
            config false;
            description
              "Operational state data for interface ingress ACLs";
            uses interface-ingress-acl-config;

            uses interface-ingress-acl-state;
          }  // container state

          uses interface-acl-entries-top;
        }  // list ingress-acl-set
      }  // container ingress-acl-sets
    }  // grouping interface-ingress-acl-top

    grouping interface-egress-acl-config {
      description
        "Configuration data for per-interface egress ACLs";
      leaf set-name {
        type leafref {
          path
            "../../../../../../acl-sets/acl-set/config/name";
        }
        description
          "Reference to the ACL set name applied on egress";
      }

      leaf type {
        type leafref {
          path
            "../../../../../../acl-sets/acl-set[name=current()/../set-name]"
              + "/config/type";
        }
        description
          "Reference to the ACL set type applied on egress.";
      }
    }  // grouping interface-egress-acl-config

    grouping interface-egress-acl-state {
      description
        "Operational state data for the per-interface egress ACL";
    }  // grouping interface-egress-acl-state

    grouping interface-egress-acl-top {
      description
        "Top-level grouping for per-interface egress ACL data";
      container egress-acl-sets {
        description
          "Enclosing container the list of egress ACLs on the
        interface";
        list egress-acl-set {
          key "set-name type";
          description
            "List of egress ACLs on the interface";
          leaf set-name {
            type leafref {
              path "../config/set-name";
            }
            description
              "Reference to set name list key";
          }

          leaf type {
            type leafref {
              path "../config/type";
            }
            description
              "Reference to type list key";
          }

          container config {
            description
              "Configuration data ";
            uses interface-egress-acl-config;
          }  // container config

          container state {
            config false;
            description
              "Operational state data for interface egress ACLs";
            uses interface-egress-acl-config;

            uses interface-egress-acl-state;
          }  // container state

          uses interface-acl-entries-top;
        }  // list egress-acl-set
      }  // container egress-acl-sets
    }  // grouping interface-egress-acl-top

    grouping acl-interfaces-config {
      description
        "Configuration data for interface references";
      leaf id {
        type oc-if:interface-id;
        description
          "User-defined identifier for the interface -- a common
        convention could be '<if name>.<subif index>'";
      }
    }  // grouping acl-interfaces-config

    grouping acl-interfaces-state {
      description
        "Operational state data for interface references";
    }  // grouping acl-interfaces-state

    grouping acl-interfaces-top {
      description
        "Top-level grouping for interface-specific ACL data";
      container interfaces {
        description
          "Enclosing container for the list of interfaces on which
        ACLs are set";
        list interface {
          key "id";
          description
            "List of interfaces on which ACLs are set";
          leaf id {
            type leafref {
              path "../config/id";
            }
            description
              "Reference to the interface id list key";
          }

          container config {
            description
              "Configuration for ACL per-interface data";
            uses acl-interfaces-config;
          }  // container config

          container state {
            config false;
            description
              "Operational state for ACL per-interface data";
            uses acl-interfaces-config;

            uses acl-interfaces-state;
          }  // container state

          uses oc-if:interface-ref;

          uses interface-ingress-acl-top;

          uses interface-egress-acl-top;
        }  // list interface
      }  // container interfaces
    }  // grouping acl-interfaces-top

    grouping acl-config {
      description
        "Global configuration data for ACLs";
    }  // grouping acl-config

    grouping acl-state {
      description
        "Global operational state data for ACLs";
      leaf counter-capability {
        type identityref {
          base ACL_COUNTER_CAPABILITY;
        }
        description
          "System reported indication of how ACL counters are reported
        by the target";
      }
    }  // grouping acl-state

    grouping acl-top {
      description
        "Top level grouping for ACL data and structure";
      container acl {
        description
          "Top level enclosing container for ACL model config
        and operational state data";
        container config {
          description
            "Global config data for ACLs";
          uses acl-config;
        }  // container config

        container state {
          config false;
          description
            "Global operational state data for ACLs";
          uses acl-config;

          uses acl-state;
        }  // container state

        uses acl-set-top;

        uses acl-interfaces-top;
      }  // container acl
    }  // grouping acl-top

    uses acl-top;
  }  // module openconfig-acl

Summary

  
  
Organization OpenConfig working group
  
Module openconfig-acl
Version 2017-05-26
File openconfig-acl.yang
  
Prefix oc-acl
Namespace http://openconfig.net/yang/acl
  
Cooked /cookedmodules/openconfig-acl/2017-05-26
YANG /src/openconfig-acl@2017-05-26.yang
XSD /xsd/openconfig-acl@2017-05-26.xsd
  
Abstract This module defines configuration and operational state data for network access control lists (i.e., filters, rules, etc.). ACL...
  
Contact
OpenConfig working group
www.openconfig.net

Description

 
This module defines configuration and operational state
data for network access control lists (i.e., filters, rules,
etc.).  ACLs are organized into ACL sets, with each set
containing one or more ACL entries.  ACL sets are identified
by a unique name, while each entry within a set is assigned
a sequence-id that determines the order in which the ACL
rules are applied to a packet.

Individual ACL rules specify match criteria based on fields in
the packet, along with an action that defines how matching
packets should be handled. Entries have a type that indicates
the type of match criteria, e.g., MAC layer, IPv4, IPv6, etc.

Groupings

Grouping Objects Abstract
access-list-entries-config sequence-id description Access List Entries (ACE) config.
access-list-entries-state matched-packets matched-octets Access List Entries state.
access-list-entries-top acl-entries Access list entries to level container
acl-config Global configuration data for ACLs
acl-counters-state matched-packets matched-octets Common grouping for ACL counters
acl-interfaces-config id Configuration data for interface references
acl-interfaces-state Operational state data for interface references
acl-interfaces-top interfaces Top-level grouping for interface-specific ACL data
acl-set-config name type description Access Control List config
acl-set-state Access Control List state
acl-set-top acl-sets Access list entries variables top level container
acl-state counter-capability Global operational state data for ACLs
acl-top acl Top level grouping for ACL data and structure
action-config forwarding-action log-action Config of action type
action-state State information of action type
action-top actions ACL action type top level container
input-interface-config Config of interface
input-interface-state State information of interface
input-interface-top input-interface Input interface top level container
interface-acl-entries-config Configuration data for per-interface ACLs
interface-acl-entries-state sequence-id matched-packets matched-octets Operational state data for per-interface ACL entries
interface-acl-entries-top acl-entries Top-level grouping for per-interface ACL entries
interface-egress-acl-config set-name type Configuration data for per-interface egress ACLs
interface-egress-acl-state Operational state data for the per-interface egress ACL
interface-egress-acl-top egress-acl-sets Top-level grouping for per-interface egress ACL data
interface-ingress-acl-config set-name type Configuration data for per-interface ingress ACLs
interface-ingress-acl-state Operational state data for the per-interface ingress ACL
interface-ingress-acl-top ingress-acl-sets Top-level grouping for per-interface ingress ACL data

Objects

Type Key
Mandatory config
Optional config
Not config
Object Type Abstract
acl container Top level enclosing container for ACL model config and operational state data
   acl-sets container Access list entries variables enclosing container
      acl-set list List of ACL sets, each comprising of a list of ACL entries
         acl-entries container Access list entries container
            acl-entry list List of ACL entries comprising an ACL set
               actions container Enclosing container for list of ACL actions associated with an entry
                  config container Config data for ACL actions
                     forwarding-action leaf Specifies the forwarding action. One forwarding action must be specified for each ACL entry
                     log-action leaf Specifies the log action and destination for matched packets. The default is not to log the packet.
                  state container State information for ACL actions
                     forwarding-action leaf Specifies the forwarding action. One forwarding action must be specified for each ACL entry
                     log-action leaf Specifies the log action and destination for matched packets. The default is not to log the packet.
               config container Access list entries config
                  description leaf A user-defined description, or comment, for this Access List Entry.
                  sequence-id leaf The sequence id determines the order in which ACL entries are applied. The sequence id must be unique for each entry in an ACL set. Target devices should apply the ACL entry rules in the order determined by sequence id, rather than the relying only on o...
               input-interface container Input interface container
                  config container Config data
                  interface-ref container Reference to an interface or subinterface
                     config container Configured reference to interface / subinterface
                        interface leaf Reference to a base interface. If a reference to a subinterface is required, this leaf must be specified to indicate the base interface.
                        subinterface leaf Reference to a subinterface -- this requires the base interface to be specified using the interface leaf in this container. If only a reference to a base interface is requuired, this leaf should not be set.
                     state container Operational state for interface-ref
                        interface leaf Reference to a base interface. If a reference to a subinterface is required, this leaf must be specified to indicate the base interface.
                        subinterface leaf Reference to a subinterface -- this requires the base interface to be specified using the interface leaf in this container. If only a reference to a base interface is requuired, this leaf should not be set.
                  state container State information
               ipv4 container Top level container for IPv4 match field data
                  config container Configuration data for IPv4 match fields
                     destination-address leaf Destination IPv4 address prefix.
                     dscp leaf Value of diffserv codepoint.
                     hop-limit leaf The IP packet's hop limit -- known as TTL (in hops) in IPv4 packets, and hop limit in IPv6
                     protocol leaf The protocol carried in the IP packet, expressed either as its IP protocol number, or by a defined identity.
                     source-address leaf Source IPv4 address prefix.
                  state container State information for IPv4 match fields
                     destination-address leaf Destination IPv4 address prefix.
                     dscp leaf Value of diffserv codepoint.
                     hop-limit leaf The IP packet's hop limit -- known as TTL (in hops) in IPv4 packets, and hop limit in IPv6
                     protocol leaf The protocol carried in the IP packet, expressed either as its IP protocol number, or by a defined identity.
                     source-address leaf Source IPv4 address prefix.
               ipv6 container Top-level container for IPv6 match field data
                  config container Configuration data for IPv6 match fields
                     destination-address leaf Destination IPv6 address prefix.
                     destination-flow-label leaf Destination IPv6 Flow label.
                     dscp leaf Value of diffserv codepoint.
                     hop-limit leaf The IP packet's hop limit -- known as TTL (in hops) in IPv4 packets, and hop limit in IPv6
                     protocol leaf The protocol carried in the IP packet, expressed either as its IP protocol number, or by a defined identity.
                     source-address leaf Source IPv6 address prefix.
                     source-flow-label leaf Source IPv6 Flow label.
                  state container Operational state data for IPv6 match fields
                     destination-address leaf Destination IPv6 address prefix.
                     destination-flow-label leaf Destination IPv6 Flow label.
                     dscp leaf Value of diffserv codepoint.
                     hop-limit leaf The IP packet's hop limit -- known as TTL (in hops) in IPv4 packets, and hop limit in IPv6
                     protocol leaf The protocol carried in the IP packet, expressed either as its IP protocol number, or by a defined identity.
                     source-address leaf Source IPv6 address prefix.
                     source-flow-label leaf Source IPv6 Flow label.
               l2 container Ethernet header fields
                  config container Configuration data
                     destination-mac leaf Destination IEEE 802 MAC address.
                     destination-mac-mask leaf Destination IEEE 802 MAC address mask.
                     ethertype leaf Ethertype field to match in Ethernet packets
                     source-mac leaf Source IEEE 802 MAC address.
                     source-mac-mask leaf Source IEEE 802 MAC address mask.
                  state container State Information.
                     destination-mac leaf Destination IEEE 802 MAC address.
                     destination-mac-mask leaf Destination IEEE 802 MAC address mask.
                     ethertype leaf Ethertype field to match in Ethernet packets
                     source-mac leaf Source IEEE 802 MAC address.
                     source-mac-mask leaf Source IEEE 802 MAC address mask.
               sequence-id leaf references the list key
               state container State information for ACL entries
                  description leaf A user-defined description, or comment, for this Access List Entry.
                  matched-octets leaf Count of the number of octets (bytes) matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interfa...
                  matched-packets leaf Count of the number of packets matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), th...
                  sequence-id leaf The sequence id determines the order in which ACL entries are applied. The sequence id must be unique for each entry in an ACL set. Target devices should apply the ACL entry rules in the order determined by sequence id, rather than the relying only on o...
               transport container Transport fields container
                  config container Configuration data
                     destination-port leaf Destination port or range
                     source-port leaf Source port or range
                     tcp-flags leaf-list List of TCP flags to match
                  state container State data
                     destination-port leaf Destination port or range
                     source-port leaf Source port or range
                     tcp-flags leaf-list List of TCP flags to match
         config container Access list config
            description leaf Description, or comment, for the ACL set
            name leaf The name of the access-list set
            type leaf The type determines the fields allowed in the ACL entries belonging to the ACL set (e.g., IPv4, IPv6, etc.)
         name leaf Reference to the name list key
         state container Access list state information
            description leaf Description, or comment, for the ACL set
            name leaf The name of the access-list set
            type leaf The type determines the fields allowed in the ACL entries belonging to the ACL set (e.g., IPv4, IPv6, etc.)
         type leaf Reference to the type list key
   config container Global config data for ACLs
   interfaces container Enclosing container for the list of interfaces on which ACLs are set
      interface list List of interfaces on which ACLs are set
         config container Configuration for ACL per-interface data
            id leaf User-defined identifier for the interface -- a common convention could be '<if name>.<subif index>'
         egress-acl-sets container Enclosing container the list of egress ACLs on the interface
            egress-acl-set list List of egress ACLs on the interface
               acl-entries container Enclosing container for list of references to ACLs
                  acl-entry list List of ACL entries assigned to an interface
                     sequence-id leaf Reference to per-interface acl entry key
                     state container Operational state data for per-interface ACL entries
                        matched-octets leaf Count of the number of octets (bytes) matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interfa...
                        matched-packets leaf Count of the number of packets matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), th...
                        sequence-id leaf Reference to an entry in the ACL set applied to an interface
               config container Configuration data
                  set-name leaf Reference to the ACL set name applied on egress
                  type leaf Reference to the ACL set type applied on egress.
               set-name leaf Reference to set name list key
               state container Operational state data for interface egress ACLs
                  set-name leaf Reference to the ACL set name applied on egress
                  type leaf Reference to the ACL set type applied on egress.
               type leaf Reference to type list key
         id leaf Reference to the interface id list key
         ingress-acl-sets container Enclosing container the list of ingress ACLs on the interface
            ingress-acl-set list List of ingress ACLs on the interface
               acl-entries container Enclosing container for list of references to ACLs
                  acl-entry list List of ACL entries assigned to an interface
                     sequence-id leaf Reference to per-interface acl entry key
                     state container Operational state data for per-interface ACL entries
                        matched-octets leaf Count of the number of octets (bytes) matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interfa...
                        matched-packets leaf Count of the number of packets matching the current ACL entry. An implementation should provide this counter on a per-interface per-ACL-entry if possible. If an implementation only supports ACL counters per entry (i.e., not broken out per interface), th...
                        sequence-id leaf Reference to an entry in the ACL set applied to an interface
               config container Configuration data
                  set-name leaf Reference to the ACL set name applied on ingress
                  type leaf Reference to the ACL set type applied on ingress
               set-name leaf Reference to set name list key
               state container Operational state data for interface ingress ACLs
                  set-name leaf Reference to the ACL set name applied on ingress
                  type leaf Reference to the ACL set type applied on ingress
               type leaf Reference to type list key
         interface-ref container Reference to an interface or subinterface
            config container Configured reference to interface / subinterface
               interface leaf Reference to a base interface. If a reference to a subinterface is required, this leaf must be specified to indicate the base interface.
               subinterface leaf Reference to a subinterface -- this requires the base interface to be specified using the interface leaf in this container. If only a reference to a base interface is requuired, this leaf should not be set.
            state container Operational state for interface-ref
               interface leaf Reference to a base interface. If a reference to a subinterface is required, this leaf must be specified to indicate the base interface.
               subinterface leaf Reference to a subinterface -- this requires the base interface to be specified using the interface leaf in this container. If only a reference to a base interface is requuired, this leaf should not be set.
         state container Operational state for ACL per-interface data
            id leaf User-defined identifier for the interface -- a common convention could be '<if name>.<subif index>'
   state container Global operational state data for ACLs
      counter-capability leaf System reported indication of how ACL counters are reported by the target