3Com 4200G 12-Port, Руководство по настройке

Страница: 222 / 422

208 C
HAPTER
26: ACL C
ONFIGURATION
Configuration Tasks
In the case that you specify the rule ID when defining a rule:
■
If the rule corresponding to the specified rule ID already exists, you will edit the
rule, and the modified part in the rule will replace the original content, while other
parts remain unchanged.
■
If the rule corresponding to the specified rule ID does not exists, you will create
and define a new rule.
■
The content of a modified or created rule must not be identical with the content
of any existing rule; otherwise the rule modification or creation will fail, and the
system will prompt that the rule already exists.
If you do not specify a rule ID, you will create and define a new rule, and the system
will assign an ID for the rule automatically.
rule-string : rule information, which can be combination of the parameters given in
Table 180. Table 180 describes the specific parameters.
Table 179 Configure a Layer 2 ACL rule
Operation Command Description
Enter system view system-view -
Create or enter layer
2 ACL view acl number acl-number [
match-order { config | auto } ]
By the default, the match order is
config
Define an rule rule [ rule-id ] { permit | deny }
rule-string
Required
Define the comment
string of the ACL rule rule rule-id comment text Optional
Define the description
information of the
ACL description text Optional
Display ACL
information display acl { all | acl-number } Optional
The
display command can be
executed in any view
Table 180 Rule information
Parameter Type Function Description
format-type Link layer
encapsulation
type Defines the link
layer
encapsulation
type in the rule format-type : the value can be
802.3/802.2, 802.3, ether_ii, or snap
lsap lsap-code
lsap-wildcard
lsap field Defines the lsap
field in the rule lsap-code : the encapsulation format
of data frames, a 16-bit hexadecimal
number
lsap-wildcard : mask of the lsap value,
a 16-bit hexadecimal number used to
specify the mask bit
source { source-addr
source-mask |
vlan-id }*
Source MAC
address
information Specifies the
source MAC
address range in
the rule source-addr : source MAC address, in
the format of H-H-H
source- mask : source MAC address
mask, in the format of H-H-H
vlan-id : source VLAN ID, in the range
of 1 to 4,094
dest dest-addr
dest-mask
Destination MAC
address
information Specifies the
destination MAC
address range in
the rule dest-addr : destination MAC address,
in the format of H-H-H
dest- mask : destination MAC address
mask, in the format of H-H-H