3Com 3CR17660-91, Configuration Manual

Page: 219 / 422

Defining Advanced ACLs 205
Configuration
Preparation
Before configuring an ACL rule containing time range arguments, you need to
configure define the corresponding time ranges. For the configuration of time ranges,
refer to ?Advanced ACL.
The values of source and destination IP addresses, the type of protocol over IP, and
protocol-specific features in the rule have been defined.
Configuration Procedure
In the case that you specify the rule ID when defining a rule:
■
If the rule corresponding to the specified rule ID already exists, you will edit the
rule, and the modified part in the rule will replace the original content, while other
parts remain unchanged.
■
If the rule corresponding to the specified rule ID does not exists, you will create
and define a new rule.
■
The content of a modified or created rule must not be identical with the content
of any existing rule; otherwise the rule modification or creation will fail, and the
system will prompt that the rule already exists.
If you do not specify a rule ID, you will create and define a new rule, and the system
will assign an ID for the rule automatically.
rule-string : rule information, which can be combination of the parameters given in
Table 175. Table 175 describes the specific parameters. You must configure the
protocol argument in the rule information before you can configure other arguments.
Table 174 Configure an advanced ACL rule
Operation Command Description
Enter system view system-view -
Enter advanced ACL
view acl number acl-number [ match-order
{ config | auto } ]
By the default, the match order
is
config
Define an rule rule [ rule-id ] { permit | deny }
rule-string
Required
Define the comment
string of the ACL rule rule rule-id comment text Optional
Define the description
information of the
ACL description text Optional
Display ACL
information display acl { all | acl-number } Optional
The
display command can be
executed in any view
Table 175 Rule information
Parameter Type Function Description
protocol Protocol type Type of protocol
over IP When expressed in numerals, the
value range is 1 to 255
When expressed with a name, the
value can be GRE, ICMP, IGMP, IP,
IPinIP, OSPF, TCP, and UDP
source { sour-addr
sour-wildcard | any }
Source address
information Specifies the source
address information
in the rule sour-addr sour-wildcard is used to
specify the source address of the
packet, expressed in dotted
decimal notation
any represents any source address