1-13
Advanced ACL Configuration Example
Network requirements
Different departments of an enterprise are interconnected through a switch. The R&D department is
connected to Ethernet 1/0/1 of the switch. Apply an ACL to deny requests from the R&D department and
destined for Internet (TCP packets with the destination port number of 80) during the working hours
(8:00 to 18:00).
The R&D department is connected to Ethernet 1/0/1 of the switch. Apply an ACL to deny requests from
the R&D department to the wage server (TCP packets with the destination port number of 80) during
the working hours (8:00 to 18:00).
Network diagram
Figure 1-4 Network diagram for advanced ACL configuration
Configuration procedure
# Define a periodic time range that is active from 8:00 to 18:00 everyday.
<Sysname> system-view
[Sysname] time-range test 8:00 to 18:00 working-day
# Define ACL 3000 to filter packets destined for Internet.
[Sysname] acl number 3000
[Sysname-acl-adv-3000] rule 1 deny tcp destination-port eq 80 time-range test
[Sysname-acl-adv-3000] quit
# Apply ACL 3000 on Ethernet 1/0/1.
[Sysname] interface Ethernet1/0/1
[Sysname-Ethernet1/0/1] packet-filter inbound ip-group 3000
Layer 2 ACL Configuration Example
Network requirements
PC 1 and PC 2 connect to the switch through Ethernet 1/0/1. PC1’s MAC address is 0011-0011-0011.
Apply an ACL to filter packets with the source MAC address of 0011-0011-0011 from 8:00 to 18:00
everyday.
To Next Page
Loading...