3-3
Configuration Prerequisites
If you want to reference a time range in a rule, define it with the
time-range
command first.
Configuration Procedure
Follow these steps to configure an advanced IPv6 ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
––
Create an advanced IPv6
ACL and enter its view
acl ipv6
number
acl6-number
[
name
acl6-name
] [
match-order
{
auto
|
config
} ]
Required
The default match order is
config
.
If you specify a name for an
IPv6 ACL when creating the
ACL, you can use the
acl
ipv6 name
acl6-name
command to enter the view of
the ACL later.
Create or modify a rule
rule
[
rule-id
] {
deny
|
permit
}
protocol
[ {
ack
ack-value
|
fin
fin-value
|
psh
psh-value
|
rst
rst-value
|
syn
syn-value
|
urg
urg-value
} * |
destination
{
dest
dest-prefix | dest/dest-prefix | any
} |
destination-port operator port1
[
port2
] |
dscp
dscp | fragment
|
icmpv6-type
{
icmpv6-type
icmpv6-code
|
icmpv6-message
} |
logging
|
source
{
source
source-prefix | source/source-prefix |
any
} |
source-port operator port1
[
port2
] |
time-range
time-range-name
] *
Required
To create or modify multiple
rules, repeat this step.
When an advanced IPv6 ACL
is referenced by a QoS policy
for traffic classification:
z
If the QoS policy is applied
to the inbound or
outbound direction, the
keywords of
logging
,
ack
,
fin
,
psh
,
rst
,
syn
, and
urg
are not supported.
z
If the QoS policy is applied
to the outbound direction,
the keywords of
icmp6-type
is not
supported.
Set the rule numbering step
step
step-value
Optional
5 by default
Configure a description for
the advanced IPv6 ACL
description
text
Optional
By default, an advanced IPv6
ACL has no ACL description.
Configure a rule description
rule
rule-id comment
text
Optional
By default, an IPv6 ACL rule
has no rule description.
Note that:
z
You can only modify the existing rules of an ACL that uses the match order of
config
. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
