Zte ZXR10 5250 Series - Page 92

ZXR105250SeriesCongurationGuide
7.ExtendedegressACL:MatchesthesourceIPaddress,destinationIPaddress,
IPprotocoltype,TCPsourceportnumber,TCPdestinationportnumber,UDP
sourceportnumber,UDPdestinationportnumber,ICMPtype,ICMPCodeand
DiffServCodePoint(DSCP).
8.L2egressACL:MatchesthedestinationMACaddress,sourceVLANIDand802.
1ppriorityvalue,EthernetnetworktypeandDSAP/SSAP .
9.HybridegressACL:MatchestheSourceIPv4/IPv6address,destination
IPv4/IPv6address,IPprotocoltype,TCPsourceportnumber,TCPdestination
portnumber,UDPsourceportnumber,UDPdestinationportnumber,DiffServ
CodePoint(DSCP),sourceMACaddress,destinationMACaddress,source
VLANIDand802.1ppriorityvalue.
10.User-denedingressACL:Onlymatchesthebytesdenedbyusers.
lEachACLhasanaccesslistnumbertoidentify,whichisadigit.Theaccesslist
numberrangesofdifferenttypesofACLareshownbelow:
1.BasicingressACL:1–99
2.ExtendedingressACL:100–199
3.L2ingressACL:200–299
4.HybridingressACL:300–399,supportIPv6
5.BasicegressACL:400–499
6.ExtendedegressACL:500–599
7.L2egressACL:600-699
8.HybridegressACL:700–799,supportsIPv6
9.GlobalACL:800
10.User-denedingressACL:801–828
lEachACLhasatmost500rulesandtherangeis1–500.
ConguringACL
TheACLcongurationincludesthefollowingcommands:
CommandFunction
zte(cfg)#setport<portlist>aclmode{port|vlan}SetsportACLbindingmode.
zte(cfg)#setport<portlist>acl<1-799>{enable|disable}BindsACLinstancetotheport.
zte(cfg)#setvlan<vlanlist>acl<1-399>{enable|disable}BindsACLinstancetotheVLAN.
zte(cfg)#setacl<1-799>rule<1-500>time-range
<word>{enable|disable}
ExecutesanACLactionina
specictimerange.
zte(cfg)#createacl<1-828>name<name>CreatesanACLname.
zte(cfg)#clearacl<1-828>nameClearsanACLname.
zte(cfg)#showport<portlist>acl-modeDisplaysportACLbindingmode.
zte(cfg)#configingress-aclbasicnumber<1-99>Createsandconguresabasic
ingressACLinstance.
zte(basic-acl-group)#rule<1-500>{permit|deny}{<source-ipa
ddr><sip-mask>|any}[fragment]
SetsabasicingressACLrule.
5-44
SJ-20131111172707-002|2013-11-27(R1.0)ZTEProprietaryandCondential