Huawei Quidway S9300 Configuration Manual page 171

Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
Procedure
Step 1 Assign IP addresses to interfaces.
# Add interfaces to the VLAN and assign IP addresses to the VLANIF interfaces.
Add GE 1/0/1, GE 2/0/1, and GE 3/0/1 to VLAN 10, VLAN 20, and VLAN 30 respectively,
and add GE 2/0/1 to VLAN 100. The first IP address of the network segment is taken as the
address of the VLANIF interface. Take GE 1/0/1 as an example. The configurations of other
interfaces are similar to the configuration of GE 1/0/1, and are not mentioned here.
<Quidway> system-view
[Quidway] vlan batch 10 20 30 100
[Quidway] interface gigabitethernet 1/0/1
[Quidway-GigabitEthernet1/0/1] port link-type access
[Quidway-GigabitEthernet1/0/1] port default vlan 10
[Quidway-GigabitEthernet1/0/1] quit
[Quidway] interface vlanif 10
[Quidway-Vlanif10] ip address 10.164.1.1 255.255.255.0
[Quidway-Vlanif10] quit
Step 2 Configure the time range.
# Configure the time range from 8:00 to 17:30.
<Quidway> system-view
[Quidway] time-range satime 8:00 to 17:30 working-day
Step 3 Configure ACLs.
# Configure the ACL for the personnel of the marketing department to access the salary query
server.
[Quidway] acl 3002
[Quidway-acl-adv-3002] rule deny ip source 10.164.2.0 0.0.0.255 destination
10.164.9.9 0.0.0.0 time-range satime
[Quidway-acl-adv-3002] quit
# Configure the ACL for the personnel of the R&D department to access the salary query server.
[Quidway] acl 3003
[Quidway-acl-adv-3003] rule deny ip source 10.164.3.0 0.0.0.255 destination
10.164.9.9 0.0.0.0 time-range satime
[Quidway-acl-adv-3003] quit
Step 4 Configure ACL-based traffic classifiers.
# Configure the traffic classifier c_market to classify the packets that match ACL 3002.
[Quidway] traffic classifier c_market
[Quidway-classifier-c_market] if-match acl 3002
[Quidway-classifier-c_market] quit
# Configure the traffic classifier c_rd to classify the packets that match ACL 3003.
[Quidway] traffic classifier c_rd
[Quidway-classifier-c_rd] if-match acl 3003
[Quidway-classifier-c_rd] quit
Step 5 Configure traffic behaviors.
# Configure the traffic behavior b_market to reject packets.
[Quidway] traffic behavior b_market
[Quidway-behavior-b_market] deny
[Quidway-behavior-b_market] quit
# Configure the traffic behavior b_rd to reject packets.
Issue 01 (2009-07-28) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
8 ACL Configuration
8-17