1-6
Advanced ACLs support analysis and processing of three packet priority levels: type of service (ToS)
priority, IP priority and differentiated services codepoint (DSCP) priority.
Using advanced ACLs, you can define classification rules that are more accurate, more abundant, and
more flexible than those defined for basic ACLs.
Configuration Prerequisites
z
To configure a time range-based advanced ACL rule, you need to create the corresponding time
ranges first. For information about of time range configuration, refer to section
Configuring Time
Range
.
z
The settings to be specified in the rule, such as source and destination IP addresses, the protocols
carried by IP, and protocol-specific features, are determined.
Configuration Procedure
Table 1-3
Define an advanced ACL rule
Operation
Command
Description
Enter system view
system-view
—
Create an advanced
ACL and enter
advanced ACL view
acl number
acl-number
[
match-order
{
auto
|
config
} ]
Required
config
by default
Define an ACL rule
rule
[
rule-id
] {
permit
|
deny
}
protocol
[
rule-string
]
Required
For information about
protocol
and
rule-string
, refer to
ACL Commands
.
Assign a description
string to the ACL rule
rule
rule-id
comment
text
Optional
No description by default
Assign a description
string to the ACL
description
text
Optional
No description by default
Note that:
z
With the
config
match order specified for the advanced ACL, you can modify any existent rule. The
unmodified part of the rule remains. With the
auto
match order specified for the ACL, you cannot
modify any existent rule; otherwise the system prompts error information.
z
If you do not specify the
rule-id
argument when creating an ACL rule, the rule will be numbered
automatically. If the ACL has no rules, the rule is numbered 0; otherwise, the number of the rule will
be the greatest rule number plus one. If the current greatest rule number is 65534, however, the
system will display an error message and you need to specify a number for the rule.
z
The content of a modified or created rule cannot be identical with the content of any existing rules;
otherwise the rule modification or creation will fail, and the system prompts that the rule already
exists.
z
If the ACL is created with the
auto
keyword specified, the newly created rules will be inserted in the
existent ones by depth-first principle, but the numbers of the existent rules are unaltered.
Configuration Example
# Configure ACL 3000 to permit the TCP packets sourced from the network 129.9.0.0/16 and with the
destination port number being 80.
<Sysname> system-view
