Configuring An Ethernet Frame Header Acl - HP FlexFabric 5700 series Configuration Manual

Step
5. Create or edit a
rule.
6. (Optional.) Add
or edit a rule
comment.
NOTE:
If an ACL is to match information in the IPv6 packet payload, it can only match packets with one extension
header. It cannot match packets with two or more extension headers or with the Encapsulating Security
Payload Header.

Configuring an Ethernet frame header ACL

Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol
header fields, such as:
Source MAC address.
•
Destination MAC address.
•
• 802.1p priority (VLAN priority).
Link layer protocol type.
•
To configure an Ethernet frame header ACL:
Step
1. Enter system view.
Command
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value |
fin fin-value | psh psh-value |
rst rst-value | syn syn-value |
urg urg-value } * |
established } | counting |
destination { dest-address
dest-prefix |
dest-address/dest-prefix |
any } | destination-port
operator port1 [ port2 ] | dscp
dscp | flow-label
flow-label-value | fragment |
icmp6-type { icmp6-type
icmp6-code |
icmp6-message } | logging |
routing [ type routing-type ] |
hop-by-hop [ type hop-type ] |
source { source-address
source-prefix |
source-address/source-prefix
| any } | source-port operator
port1 [ port2 ] | time-range
time-range-name ] *
rule rule-id comment text
Command
system-view
8
Remarks
By default, IPv6 advanced ACL does not contain any
rule.
The logging keyword takes effect only when the
module (for example, packet filtering) that uses the
ACL supports logging.
If an ACL is for QoS traffic classification or packet
filtering:
•
Do not specify the fragment keyword.
•
Do not specify neq for the operator argument.
•
Do not specify the routing, hop-by-hop, or
flow-label keyword if the ACL is for outbound
QoS traffic classification or outbound packet
filtering.
•
Do not specify ipv6-ah for the protocol argument,
nor set its value to 0, 43, 44, 51, or 60, if the ACL
is for outbound QoS traffic classification or
outbound packet filtering.
By default, no rule comments are configured.
Remarks
N/A