8
Step Command Remarks
frame header ACL. description.
4. (Optional.) Set the rule
numbering step.
step
step-value
The default setting is 5.
5. Create or edit a rule.
rule
[ rule-id ] {
deny
|
permit
}
[
cos
vlan-pri |
counting
|
dest-mac
dest-address
dest-mask | {
lsap
lsap-type
lsap-type-mask |
type
protocol-type
protocol-type-mask } |
source-mac
source-address
source-mask |
time-range
time-range-name ] *
By default
,
an Ethernet frame
header ACL does not contain any
rule.
If an Ethernet frame header ACL
is used for packet filtering or QoS
traffic classification and the
lsap
keyword is used, the lsap-type
argument value must be AAAA,
and the lsap-type-mask argument
value must be FFFF. Otherwise,
the ACL does not take effect.
6. (Optional.) Add or edit a rule
comment.
rule
rule-id
comment
text
By default, no rule comments are
configured.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL)
has the same properties and content as the source ACL, but not the same ACL number and name.
To successfully copy an ACL, make sure:
• The destination ACL number is from the same category as the source ACL number.
• The source ACL already exists, but the destination ACL does not.
To copy an ACL:
Step Command
1. Enter system view.
system-view
2. Copy an existing ACL to create a new ACL.
acl
[
ipv6
]
copy
{ source-acl-number |
name
source-acl-name }
to
{ dest-acl-number |
name
dest-acl-name }
Configuring packet filtering with ACLs
This section describes procedures for applying an ACL to filter incoming or outgoing IPv4 or IPv6
packets on the specified interface.
NOTE:
The ACL-based packet filter feature is available on Layer 2 and Layer 3 Ethernet interfaces, and
VLAN interfaces. The term "interface" in this section collectively refers to these types of interfaces.
You can use the port link-mode command to configure an Ethernet port as a Layer 2 or Layer 3
interface (see Layer 2—LAN Switching Configuration Guide).
To Next Page
Loading...
Need help?
General