Operation Manual – ACL
H3C S3610&S5510 Series Ethernet Switches
Chapter 2 IPv4 ACL Configuration
2-12
2.8 IPv4 ACL Configuration Example
2.8.1 Network Requirements
As shown in
, a company interconnects its departments through the switch.
Configure an ACL to deny access of all departments but the President’s office to the
salary query server during office hours (from 8:00 to 18:00) in working days.
2.8.2 Network Diagram
Eth1/0/4
Eth1/0/1
Eth1/0/2
Eth1/0/3
192.168.4.1
Switch
R&D department
Marketing department
Salary query server
President`s office
192.168.2.0/24
192.168.3.0/24
192.168.1.0/24
Figure 2-1
Network diagram for IPv4 ACL configuration
2.8.3 Configuration Procedure
1)
Create a time range for office hours
# Create a periodic time range spanning 8:00 to 18:00 in working days.
<Switch> system-view
[Switch] time-range trname 8:00 to 18:00 working-day
2)
Define an ACL to control access to the salary query server
# Configure a rule to control access of the R&D Department to the salary query server.
[Switch] acl number 3000
[Switch-acl-adv-3000] rule deny ip source 192.168.2.0 0.0.0.255 destination
192.168.4.1 0.0.0.0 time-range trname
[Switch-acl-adv-3000] quit
# Configure a rule to control access of the Marketing Department to the salary query
server.
[Switch] acl number 3001
