10G Core Routing Switch User Manual
陈泽科技有限公司
- - 80 - -
www.stephen-tele.com
Step 2a
rule
rule_id
{
deny
|
permit
}
protocol
Sip
ip-address net-mask
dip
ip-address net-mask
[
match
[
dscp
priority
|
precedence
priority
|
tos
priority
]] [
set
[
dscp
priority
|
precedence
priority
|
tos
priority
]]
Define an extended IP access list rule and the access
conditions.
The
access-list-number
is a decimal number from 100
to 199.
Enter
deny
or
permit
to specify whether to deny or
permit the packet if conditions are matched.
For
protocol
, enter the name or number of an IP
protocol:
icmp
,
igmp
,
igrp
,
ip
,,
nos
,
ospf
,
pim
,
tcp
, or
udp
, or an integer in the range 0 to 255 representing
an IP protocol number. To match any Internet protocol
(including ICMP, TCP, and UDP) use the keyword
ip
.
Note
This step includes options for most IP protocols.
For additional specific parameters for TCP, UDP, ICMP,
and IGMP, see steps 2b through 2c.
The sip
is the number of the network or host from
which the packet is sent.
The dip is the network or host number to which the
packet is sent.
Sip and dip can be specified as:
•
The 32-bit quantity in dotted-decimal format.
•
The keyword
any
for 0.0.0.0 255.255.255.255 (any
host).
•
The other keywords are optional and have these
meanings:
• precedence
—Enter to match packets with a
precedence level specified as a
number from 0 to 7 or by name:
routine
(
0
),
priority
(
1
),
immediate
(
2
),
flash
(
3
),
flash-override
(
4
),
critical
(
5
),
internet
(6),
network
(
7
).
• tos
—Enter to match by type of service level,
specified by a number from 0 to 15 or a name:
normal
(
0
),
max-reliability
(
2
),
max-throughput
(
4
),
min-delay
(
8
).
• dscp
—Enter to match packets with the DSCP value
specified by a numberfrom 0 to 63, or use the
question mark (?) to see a list of available values.
or
rule
rule_id
{
deny
|
permit
}
protocol
[
match
[
dscp
priority
|
precedence
priority
|
tos
priority
]] [
set
[
dscp
priority
|
precedence
priority
|
tos
priority
]]
In access-list configuration mode, define an extended
IP access list rule if you want to apply to all ip address,
you can configure like this.
