2-5
To do…
Use the command…
Remarks
Create or modify a rule
rule
[
rule-id
] {
deny
|
permit
}
protocol
[ {
ack
ack-value
|
fin
fin-value
|
psh
psh-value
|
rst
rst-value
|
syn
syn-value
|
urg
urg-value
} * |
destination
{
dest-addr dest-wildcard
|
any
} |
destination-port operator port1
[
port2
] |
dscp
dscp | fragment
|
icmp-type
{
icmp-type
icmp-code
|
icmp-message
} |
logging
|
precedence
precedence
|
reflective
|
source
{
sour-addr
sour-wildcard
|
any
} |
source-port operator port1
[
port2
] |
time-range
time-range-name
|
tos
tos
|
vpn-instance
vpn-instance-name
] *
Required
To create or modify multiple rules,
repeat this step.
Note that if the ACL is to be
referenced by a QoS policy for traffic
classification, the
logging
and
reflective
keywords are not
supported and the
operator
argument cannot be:
z
neq
, if the policy is for the
inbound traffic,
z
gt
,
lt
,
neq
or
range
, if the policy is
for the outbound traffic.
Set the rule numbering
step
step
step-value
Optional
5 by default
Configure a description
for the advanced IPv4
ACL
description
text
Optional
By default, an advanced IPv4 ACL
has no ACL description.
Configure a rule
description
rule rule-id comment text
Optional
By default, an IPv4 ACL rule has no
rule description.
Note that:
z
You can only modify the existing rules of an ACL that uses the match order of
config
. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z
When the ACL match order is
auto
, a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.
z
You can modify the match order of an ACL with the
acl number
acl-number
[
name acl-name
]
match-order
{
auto
|
config
} command, but only when the ACL does not contain any rules.
z
The rule specified in the
rule comment
command must already exist.
Configuration Example
# Configure IPv4 ACL 3000 to permit TCP packets with the destination port number of 80 from 129.9.0.0
to 202.38.160.0.
<Sysname> system-view
