H3C S5810 Series, Руководство по эксплуатации

Страница: 545 / 820

2-4
To do… Use the command… Remarks
Enter system view system-view ––
Create an advanced IPv4 ACL
and enter its view
acl number acl-number [ name
acl-name ] [ match-order
{ auto | config } ]
Required
The default match order is
config .
If you specify a name for an
IPv4 ACL when creating the
ACL, you can use the
acl name
acl-name command to enter
the view of the ACL later.
Create or modify a rule
rule [ rule-id ] { deny | permit }
protocol [ { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | destination
{ dest-addr dest-wildcard | any }
| destination-port operator
port1 [ port2 ] | dscp dscp |
fragment | icmp-type
{ icmp-type icmp-code |
icmp-message } | logging |
precedence precedence |
reflective | source { sour-addr
sour-wildcard | any } |
source-port operator port1
[ port2 ] | time-range
time-range-name | tos tos ] *
Required
To create or modify multiple
rules, repeat this step.
When an advanced IPv4 ACL is
referenced by a QoS policy for
traffic classification:
z
If the QoS policy is applied
to the inbound direction, the
logging keyword is not
supported.
z
If the QoS policy is applied
to the outbound direction,
the keywords of
logging,
precedence , icmp-type ,
tos , ack , fin , rst , syn , psh ,
urg , and reflective are not
supported
Set the rule numbering step step step-value
Optional
5 by default
Configure a description for the
advanced IPv4 ACL
description text
Optional
By default, an advanced IPv4
ACL has no ACL description.
Configure a rule description rule rule-id comment text
Optional
By default, an IPv4 ACL rule
has no rule description.
Note that:
z
You can only modify the existing rules of an ACL that uses the match order of config . When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z
When the ACL match order is auto , a newly created rule will be inserted among the existing rules
in the depth-first match order. Note that the IDs of the rules still remain the same.