Ruijie RG-S2600G-I Series, Справочное руководство CLI

Страница: 923 / 1192

CLI Reference Guide ACL Configuration Commands
Commands
show access-lists View the extended expert ACL.
Platform
Description
This command is supported only in 10.4 (3b16), 10.4 (3b17), 10.4 (5b1) and later versions.
ip access-group
Use this command to apply a specific ACL to an interface. The no form of this command cancels the
application.
ip access-group { id | name } { in | out } [ unreflect | reflect ]
no ip access-group { id | name } { in | out }
Parameter
Description
Parameter Description
id ID of the IP ACL (1 to 199, 1300 to 2699)
name Name of the IP ACL
in Filter the incoming packets of the interface.
out Filter the outgoing packets of the interface.
unreflect
Disable the Reflexive-ACL. (Working principle of the reflexive ACL: a.
A router generates a temporary access list automatically based on
layer-3 and layer-4 information of original traffic of the intranet. The
temporary access list is created based on the following rules:
Protocol unchanged, source-IP and destination-IP are strictly
exchanged with each other, and source-port and destination-port are
strictly exchanged with each other. b. Only when the layer-3 and
layer-4 information of the returned flow strictly matches with the
previous layer-3 and layer-4 information of the temporary access list
created based on outbound traffic, the router will permit the flow to
enter the intranet.)
reflect Enable the Reflexive-ACL.
Defaults No ACL is applied on the interface.
Command
mode
Interface configuration mode.
Usage Guide Use the ip access-group command to apply the specified ACL to the interface, when the firewall is
enabled.
Configuration
Examples
The following example applies the ACL 120 on the fastEthernet0/0 to filter the incoming packets:
Ruijie(config)# interface fastEthernet 0/0
Ruijie(config-if)# ip access-group 120 in