H3C S5500-SI Series, Operation Manual

Page: 785 / 1217

3-2
To do… Use the command… Remarks
Configure a description
for the basic IPv6 ACL
description text
Optional
By default, a basic IPv6 ACL has no ACL
description.
Configure a rule
description
rule rule-id comment text
Optional
By default, an IPv6 ACL rule has no rule
description.
Note that:
z
You can only modify the existing rules of an ACL that uses the match order of config . When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z
When the ACL match order is auto , a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.
z
You can modify the match order of an IPv6 ACL with the acl ipv6 number acl6-number [ name
acl6-name ] match-order { auto | config } command, but only when the ACL does not contain any
rules.
z
The rule specified in the rule comment command must already exist.
Configuration Example
# Configure IPv6 ACL 2000 to permit IPv6 packets with the source address of 2030:5060::9050/64 and
deny IPv6 packets with the source address of fe80:5060::8050/96.
<Sysname> system-view
[Sysname] acl ipv6 number 2000
[Sysname-acl6-basic-2000] rule permit source 2030:5060::9050/64
[Sysname-acl6-basic-2000] rule deny source fe80:5060::8050/96
# Verify the configuration.
[Sysname-acl6-basic-2000] display acl ipv6 2000
Basic IPv6 ACL 2000, named -none-, 2 rules,
ACL's step is 5
rule 0 permit source 2030:5060::9050/64 (4 times matched)
rule 5 deny source FE80:5060::8050/96 (5 times matched)
Configuring an Advanced IPv6 ACL
Advanced IPv6 ACLs match packets based on the source IPv6 address, destination IPv6 address,
protocol carried over IPv6, and other protocol header fields such as the TCP/UDP source port number,
TCP/UDP destination port number, ICMP message type, and ICMP message code.