Operation Manual – ACL
H3C S3610&S5510 Series Ethernet Switches
Chapter 2 IPv4 ACL Configuration
2-4
Note that:
z
You will fail to create or modify a rule if its permit/deny statement is exactly the
same as another rule. In addition, if the ACL match order is set to
auto
rather than
config
, you cannot modify ACL rules.
z
When defining ACL rules, you need not always assign them IDs. The system can
automatically assign rule IDs starting with 0 and increasing in certain rule
numbering steps. A rule ID thus assigned is greater than the current highest rule
ID. For example, if the rule numbering step is 5 and the current highest rule ID is
28, the next rule will be numbered 30. For detailed information about step, refer to
the
step
command.
z
You may use the
display acl
command to verify rules configured in an ACL. If the
match order for this ACL is
auto
, rules are displayed in the depth-first match order
rather than by rule number.
Caution:
z
You can modify the match order of an IPv4 ACL with the
acl number
acl-number
[
name acl-name
]
match-order
{
auto
|
config
} command but only when it does
not contain any rules.
z
The rule specified in the
rule comment
command must have existed.
2.2.3 Configuration Examples
# Create IPv4 ACL 2000 to deny the packets with source address 1.1.1.1 to pass.
<Sysname> system-view
[Sysname] acl number 2000
[Sysname-acl-basic-2000] rule deny source 1.1.1.1 0
# Verify the configuration.
[Sysname-acl-basic-2000] display acl 2000
Basic ACL 2000, named -none-, 1 rule,
ACL's step is 5
rule 0 deny source 1.1.1.1 0
2.3 Configuring an Advanced IPv4 ACL
Advanced IPv4 ACLs filter packets based on source IP address, destination IP address,
protocol carried on IP, and other protocol header fields, such as the TCP/UDP source
port, TCP/UDP destination port, ICMP message type, and ICMP message code.
