HP E4510-48G, Command Reference Manual

Page: 835 / 1334

14-16
If you specify no optional keywords, the undo rule command removes the entire ACL rule; otherwise,
the command removes only the specified criteria. Before performing the undo rule command, you
may use the display acl command to view the ID of the rule.
When defining ACL rules, you do not need to assign them IDs; the system can automatically assign
rule IDs starting with 0 and increasing in certain rule numbering steps. A rule ID thus assigned is the
smallest multiple of the step that is bigger than the current biggest number. For example, if the rule
numbering step is 5 and the current highest rule ID is 28, the next rule will be numbered 30.
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an existing
rule in the ACL.
You can only modify the existing rules of an ACL that uses the match order of config . When modifying
a rule of such an ACL, you may choose to change just some of the settings, in which case the other
settings remain the same.
When the ACL match order is auto , a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.
If the ACL match order is auto , rules are displayed in the depth-first match order rather than by rule
number.
For an advanced IPv4 ACL to be referenced by a QoS policy for traffic classification:
z
The logging and reflective keywords are not supported.
z
The operator cannot be neq if the ACL is for the inbound traffic.
z
The operator cannot be gt , lt , neq , or range if the ACL is for the outbound traffic.
Related commands: display acl .
Examples
# Define a rule to permit TCP packets with the destination port of 80 from 129.9.0.0 to 202.38.160.0.
<Sysname> system-view
[Sysname] acl number 3101
[Sysname-acl-adv-3101] rule permit tcp source 129.9.0.0 0.0.255.255 destination 202.38.160.0
0.0.0.255 destination-port eq 80
rule (Ethernet frame header ACL view)
Syntax
rule [ rule-id ] { deny | permit } [ cos vlan-pri | dest-mac dest-addr dest-mask | lsap lsap-code
lsap-wildcard | source-mac sour-addr source-mask | time-range time-range-name | type type-code
type-wildcard ] *
undo rule rule-id
View
Ethernet frame header ACL view