H3C S5120-EI Series, Руководство по эксплуатации

Страница: 711 / 1191

2-5
To do… Use the command… Remarks
Create or modify a rule
rule
[
rule-id
] {
deny
|
permit
}
protocol
[ {
established
| {
ack
ack-value
|
fin fin-value
|
psh
psh-value
|
rst rst-value
|
syn
syn-value
|
urg urg-value
} * } |
destination
{
dest-addr
dest-wildcard
|
any
} |
destination-port operator port1
[
port2
] |
dscp dscp | fragment
|
icmp-type
{
icmp-type icmp-code
|
icmp-message
} |
logging
|
precedence precedence
|
reflective
|
source
{
sour-addr
sour-wildcard
|
any
} |
source-port operator port1
[
port2
] |
time-range
time-range-name
|
tos tos
|
vpn-instance
vpn-instance-name
] *
Required
To create or modify multiple rules,
repeat this step.
Notes that the
reflective
keyword is
not supported.
Note that if the ACL is to be
referenced by a QoS policy for traffic
classification, the
logging
keyword
is not supported and the
operator
argument cannot be
neq.
Set the rule numbering
step
step step-value
Optional
5 by default
Configure a description
for the advanced IPv4
ACL
description text
Optional
By default, an advanced IPv4 ACL
has no ACL description.
Configure a rule
description
rule rule-id comment text
Optional
By default, an IPv4 ACL rule has no
rule description.
Note that:
z
You can only modify the existing rules of an ACL that uses the match order of
config
. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z
When the ACL match order is
auto
, a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.
z
You can modify the match order of an ACL with the
acl number acl-number
[
name acl-name
]
match-order
{
auto
|
config
} command, but only when the ACL does not contain any rules.
z
The rule specified in the
rule comment
command must already exist.
Configuration Example
# Configure IPv4 ACL 3000 to permit TCP packets with the destination port number of 80 from 129.9.0.0
to 202.38.160.0.