Operation Manual – ACL
H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1
ACL Configuration
1-6
1.3.3 Configuration Example
# Configure ACL 2000 to deny packets whose source IP addresses are 1.1.1.1.
<H3C> system-view
[H3C] acl number 2000
[H3C-acl-basic-2000] rule deny source 1.1.1.1 0
[H3C-acl-basic-2000] display acl 2000
Basic ACL 2000, 1 rule
Acl's step is 1
rule 0 deny source 1.1.1.1 0
1.4 Advanced ACL Configuration
An advanced ACL can filter packets by their source and destination IP addresses, the
protocols carried by IP. The rules in an advanced ACL rule can based on
protocol-specific features such as TCP/UDP source and destination ports, ICMP
protocol type, code, and so on.
An advanced ACL can be numbered from 3000 to 3999. Note that ACL 3998 and ACL
3999 cannot be configured because they are reserved for the cluster management.
Advanced ACLs support analysis and processing of three packet priority levels: type of
service (ToS) priority, IP priority and differentiated services codepoint priority (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate, more
abundant, and more flexible than those defined for basic ACLs.
1.4.1 Configuration Preparation
To configure an time range-based advanced ACL rule, you need to create the
corresponding time ranges first. For information about of time range configuration, refer
to section
1.2 “Time Range Configuration”.
The settings to be specified in the rule, such as source and destination IP addresses,
the protocols carried by IP, and protocol-specific features, are determined.
1.4.2 Configuration Procedure
Table 1-3 Define an advanced ACL rule
Operation Command Description
Enter system view
system-view
—
Create an advanced
VLAN or enter
advanced ACL view
acl number acl-number
[ match-order { config | auto } ]
By the default, the
match order is
config.
Define an ACL rule
rule [ rule-id ] { permit | deny }
rule-string
Required
To Next Page
Loading...
Need help?
General