How to configure a custom ACL policy correctly

[suyanhj]

Here is my current network topology as follows:

After deployment, the default all node policy works correctly: all nodes can communicate with each other properly, and the subnets within each cloud can also communicate with no issues at all.

However, I encountered a problem: after I created the user client, it was automatically added to this default policy. This causes the client to be able to access all IP addresses in the cloud, which is not the access control effect I want.

My expected requirement is:

1. All nodes in the cloud can maintain normal mutual communication as before.
2. The user client is only allowed to access specific designated addresses via ACL rules.

I have configured some custom ACL rules to achieve this requirement, but after applying the configuration, all the nodes in the cloud can no longer communicate with each other.

Could anyone help me with this configuration problem? Thank you very much for your help!

---

My current ACL configuration is as shown in the figure below:

egress

acl

---

I intended to use the all-cloud rule to let all nodes with netclient deployed communicate with each other, and also permit them to access their respective cloud internal networks.

But once this all-cloud rule is enabled, absolutely no traffic can get through — all connectivity is blocked completely.