2-3
z
You can only modify the existing rules of an ACL that uses the match order of
config
. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z
When the ACL match order is
auto
, a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.
z
You can modify the match order of an ACL with the
acl number
acl-number
[
name acl-name
]
match-order
{
auto
|
config
} command, but only when the ACL does not contain any rules.
z
The rule specified in the
rule comment
command must already exist.
Configuring an Advanced ACL
Advanced ACLs match packets based on source IP address, destination IP address, protocol carried
over IP, and other protocol header fields, such as the TCP/UDP source port number, TCP/UDP
destination port number, TCP flag, ICMP message type, and ICMP message code.
In addition, advanced ACLs allow you to filter packets based on three priority criteria: type of service
(ToS), IP precedence, and differentiated services codepoint (DSCP) priority.
Advanced ACLs are numbered in the range 3000 to 3999. Compared with basic ACLs, they allow of
more flexible and accurate filtering.
Configuration Prerequisites
If you want to reference a time range in a rule, define it with the
time-range
command first.
Configuration Procedure
Follow these steps to configure an advanced ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
––
Create an advanced ACL and
enter its view
acl number
acl-number
[
name
acl-name
]
[
match-order
{
auto
|
config
} ]
Required
The default match order is
config
.
If you specify a name for an
ACL when creating the ACL,
you can use the
acl
name
acl-name
command to enter
the view of the ACL later.
