Ruijie RG-S2900G-E Series, Configuration Manual

Page: 773 / 943

Configuration Guide Access Control List Configuration
Ruijie(config-ipv6-nacl)# deny ipv6 any any
Ruijie(config-ipv6-nacl)# exit
Ruijie(config)# interface gigabitEthernet 0/1
Ruijie(config-if)# ipv6 traffic-filter v6-list in
Ruijie(config-if)# end
Ruijie# show access-lists
ipv6 access-list v6-list
permit ipv6 ::192.168.4.12 any
deny any any
Ruijie#
Configuring ACL80
The ACL80 is also call the custom access list, which means matching the first 80 bytes of the
message to filter the messages. A message consists of a series of byte flows. The ACL80 enables the
user to perform match filtering by bits in the specified 16 bytes of the first 80 bytes in the message.
Note
The randomly specified 16 bytes does not contain the following fields:
Packet SMAC, DMAC,SIP, DIP,ETYPE,PROTOCOL,L4_SPORT,
L4_DPORT,VID.
In other words, you can select to match the above fields or other 16
bytes.
For any 16-byte field, it is possible to compare or not the configured value by bits. In other words, it
allows setting any bit of those 16 bytes as 0 or 1. There are two factors in filtering any byte: filtering
rule and filter domain template. The bits of the both are one-to-one corresponding. The filtering rule
specifies the value of the field to be filtered. The filter domain template specifies whether to filter the
related fields in the filtering rule (“1” indicates matching the bit in the corresponding filtering rule, 0 for
not). Therefore, when it is time to match a bit, it is required to set 1 for the corresponding bit in the
filter domain template. If the filter domain template bit is set as 0, no match will be done no matter
what the corresponding bit is in the filtering rule.
For example,
Ruijie(config)# expert access-list advanced name
Ruijie(config-exp-dacl)# permit 00d0f8123456 ffffffffffff 0
Ruijie(config-exp-dacl)# deny 00d0f8654321 ffffffffffff 6
The user custom access control list matches any byte of the first 80 bytes in the layer-2 data frames
according to the user definitions, and then performs corresponding processing for the messages. To
use the user custom access control list correctly, it is necessary to have in-depth knowledge about the
structure of layer-2 data frame. The following illustrates the first 64 bytes in a layer-2 data frame (each
letter indicates a hexadecimal number, and each two letters indicate a byte).
AA AA AA AA AA AA BB BB BB BB BB BB CC CC DD DD
DD DD EE FF GG HH HH HH II II JJ KK LL LL MM MM
NN NN OO PP QQ QQ RR RR RR RR SS SS SS SS TT TT
UU UU VV VV VV VV WW WW WW WW XY ZZ aa aa bb bb