–
Configure a basic ACL:
a.
Run
acl
{ [
number
]
acl-number1
|
name
acl-name
basic
[
number
acl-
number2
] } [
match-order
{
auto
|
config
} ]
The basic ACL view is displayed.
b.
Run
rule
[
rule-id
] {
deny
|
permit
} [
fragment-type
fragment-type-
name
|
source
{
source-ip-address source-wildcard
|
any
} |
time-
range
time-name
|
vpn-instance
vpn-instance-name
]
*
A rule is configured for the basic ACL.
When the
rule
command is run to configure rules for a named ACL, only the
source address range specified by
source
and the time period specified by
time-range
are valid as the rules.
When a filtering policy of a routing protocol is used to filter routes:
–
If the action specified in an ACL rule is
permit
, a route that matches the
rule will be received or advertised by the system.
–
If the action specified in an ACL rule is
deny
, a route that matches the
rule will not be received or advertised by the system.
–
If a route has not matched any ACL rules, the route will not be received
or advertised by the system.
–
If an ACL does not contain any rules, all routes matching the
route-
policy
that references the ACL will not be received or advertised by the
system.
–
If the ACL referenced by the
route-policy
does not exist, all routes
matching the
route-policy
will be received or advertised by the system.
–
In the configuration order, the system first matches a route with a rule that
has a smaller number and then matches the route with a rule with a larger
number. Routes can be filtered using a blacklist or a whitelist:
Route filtering using a blacklist: Configure a rule with a smaller number
and specify the action
deny
in this rule to filter out the unwanted routes.
Then, configure another rule with a larger number in the same ACL and
specify the action
permit
in this rule to receive or advertise the other
routes.
Route filtering using a whitelist: Configure a rule with a smaller number
and specify the action
permit
in this rule to permit the routes to be received
or advertised by the system. Then, configure another rule with a larger
number in the same ACL and specify the action
deny
in this rule to filter
out unwanted routes.
–
Configure an advanced ACL:
a.
Run
acl
name
acl-name
advance
[
number
acl-number2
] [
match-order
{
auto
|
config
} ]
The basic ACL view is displayed.
b.
Run
rule
[
rule-id
] {
deny
|
permit
}
protocol
[
source
{
source-ip-
address source-wildcard
|
any
} |
time-range
time-name
]
*
A rule is configured for the advanced ACL.
HUAWEI NetEngine80E/40E Router
Configuration Guide - IP Routing
10 Routing Policy Configuration
Issue 02 (2014-09-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
1231
