3Com S7906E - Switch, Руководство по настройке

Страница: 2037 / 2621

2-3
To do… Use the command… Remarks
Enter system view system-view ––
Create and enter basic IPv4
ACL view
acl number acl-number [ name
acl-name ] [ match-order { auto |
config } ]
Required
The default match order is
config .
If you specify a name for an IPv4
ACL when creating the ACL, you
can use the
acl name acl-name
command to enter the view of
the ACL later.
Create or modify a rule
rule [ rule-id ] { deny | permit }
[ fragment | logging | source
{ sour-addr sour-wildcard | any } |
time-range time-range-name |
vpn-instance
vpn-instance-name
] *
Required
To create multiple rules, repeat
this step.
Note that the logging and
vpn-instance keywords are not
supported if the ACL is to be
referenced by a QoS policy for
traffic classification.
Set a rule numbering step step step-value
Optional
The default step is 5.
Create an IPv4 ACL
description
description text
Optional
By default, no IPv4 ACL
description is present.
Create a rule description rule rule-id comment text
Optional
By default, no rule description is
present.
Note that:
z
You can only modify the existing rules of an ACL that uses the match order of config . When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z
When the ACL match order is auto , a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.
z
You can modify the match order of an ACL with the acl number acl-number [ name acl-name ]
match-order { auto | config } command but only when it does not contain any rules.
z
The rule specified in the rule comment command must have existed.
Configuration Examples
# Create IPv4 ACL 2000 to deny the packets with source address 1.1.1.1 to pass.
<Sysname> system-view