Configuring A Frame Header-Based Acl - Huawei Quidway S9300 Configuration Manual

Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
l
l
You can configure different advanced ACLs on the S9300 according to the protocol carried by
IP. Different parameter combinations are available for different protocol types.
----End

8.3.7 Configuring a Frame Header-based ACL

Procedure
Step 1 Run:
system-view
The system view is displayed.
Step 2 Run:
acl [ number ] acl-number [ match-order { auto | config } ]
A frame header-based ACL is created.
To create a frame header-based ACL, the value of acl-number ranges from 4000 to 4999.
match-order indicates the match order of ACL rules.
l
l
If match-order is not used, the match order is config.
Step 3 Run:
rule [ rule-id ] { deny | permit } [ source-mac source-mac-address source-mac-
mask ] [ dest-mac dest-mac-address dest-mac-mask | type protocol-type protocol-type-
mask ]
An ACL rule is created.
----End
Issue 01 (2009-07-28)
rule [ rule-id ] { deny | permit } { tcp | udp } [ destination { destination-
address destination-wildcard | any } | destination-port eq port | dscp dscp |
fragment | precedence precedence | source { source-address source-wildcard |
any } | source-port eq port | time-range time-name | tos tos ]
An ACL rule is created.
When protocol is specified as ICMP, run:
rule [ rule-id ] { deny | permit } icmp [ destination { destination-address
destination-wildcard | any } | fragment | icmp-type { icmp-name | icmp-type icmp-
code } | precedence precedence | source { source-address source-wildcard | any }
| time-range time-name ]
An ACL rule is created.
When protocol is specified as another protocol rather than TCP, UDP, or ICMP, run:
rule [ rule-id ] { deny | permit } { protocol-number | gre | igmp | ip | ipinip
| ospf } [ destination { destination-address destination-wildcard | any } |
dscp dscp | fragment | precedence precedence | source { source-address source-
wildcard | any } | time-range time-name | tos tos ]
An ACL rule is created.
NOTE
dscp dscp and precedence precedence cannot be specified at the same time.
auto: indicates that the ACL rules are matched on the basis of depth first principle.
config: indicates that the rules are matched on the basis of the configuration order.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
*
8 ACL Configuration
*
*
8-7