q-Tech QSW-9010, Руководство по настройке CLI

Страница: 78 / 101

User Manual
7. ACL service configuration 78
www.qtech.ru
ACL name can be configured with infinite length, but at MIB level only take the first 30 bits.
Don't configure mutually-exclusive rule like tcp\arp, otherwise it will not hit the rules, action will not
be effective.
Standard typical configuration:
OLT (config) # ACL standard 2222
OLT (config-ACL-std-rule) # rule 22 deny source 192.168.2.22
255.255.255.255
Extend
OLT (config) # ACL extend 3333
OLT (config-ACL-ext-rule) #rule 33 deny protocol tcp source
192.168.1.11 ignore source-port equal 33 destination 192.168.2.22
ignore destination-port equal 33 dscp any
Link
OLT (config) # ACL link 4444
OLT (config-ACL-link-rule) # rule 44 permit type arp vlan 100 cos 6
src-mac any dst-mac any
For multicast MAC address (IP V4 begins with 01005e and IP V6 begins with 3333), global multicast
should be disabled.
Hybrid
OLT (config) # ACL hybrid 5555
OLT (config-ACL-hybrid-rule) # rule 55 permit protocol tcp source
any ignore source-port eq 20 destination
any ignore destination-port lt 23 dscp any type ip vlan 100 cos 6
src-mac any ignore dst-mac any ignore
User
PS is Packet Start, starting to offset 0 from the message, until hitting the string of
000001000E00. Only valid for source:
OLT (config) # ACL user 6666
OLT (config-ACL-user-rule) #rule 10 permit base ps offset 0 string
000001000E00
Ipv6 standard
OLT (config) # ACL ipv6 standard 7777
OLT (config-ACL-ipv6-std-rule) # rule 1 permit source fe80 :: 200:
1ff: fe00: e00
Ipv6 extend
OLT (config) # ACL ipv6 extend 8888
OLT (config-ACL-ipv6-ext-rule) # rule 1 permit protocol ip source
any ignore destination any ignore flow-label any traffic-class any