HP E4510-48G Command Reference Manual page 830

Default Level
2: System level
Parameters
rule-id: Basic IPv4 ACL rule number, in the range 0 to 65534.
deny: Drops matched packets.
permit: Allows matched packets to pass.
fragment: Indicates that the rule applies to only non-first fragments. A rule without this keyword applies
to all fragments and non-fragments.
logging: Generates log entries for matched packets. This function requires that the module using the
ACL support logging.
source { sour-addr sour-wildcard | any }: Specifies a source address. The sour-addr sour-wildcard
argument combination specifies a source IP address in dotted decimal notation. A wildcard of zero
indicates a host address. The any keyword indicates any source IP address.
time-range time-range-name: Specifies the time range in which the rule takes effect. The
time-range-name argument is a case insensitive string of 1 to 32 characters. It must start with an
English letter and cannot be the English word of all to avoid confusion.
vpn-instance vpn-instance-name: Specifies a VPN instance. The vpn-instance-name argument is a
case-sensitive string of 1 to 31 characters. Without this combination, the rule applies to only non-VPN
packets.
Description
Use the rule command to create a basic IPv4 ACL rule or modify an existing basic IPv4 ACL rule.
Use the undo rule command to remove a basic IPv4 ACL rule or remove some criteria from the rule.
If you specify no optional keywords, the undo rule command removes the entire ACL rule; otherwise,
the command removes only the specified criteria. Before performing the undo rule command, you
may use the display acl command to view the ID of the rule.
When defining ACL rules, you do not need to assign them IDs; the system can automatically assign
rule IDs starting with 0 and increasing in certain rule numbering steps. A rule ID thus assigned is the
smallest multiple of the step that is bigger than the current biggest number. For example, if the rule
numbering step is 5 and the current highest rule ID is 28, the next rule will be numbered 30.
You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an existing
rule in the ACL.
You can only modify the existing rules of an ACL that uses the match order of config. When modifying
a rule of such an ACL, you may choose to change just some of the settings, in which case the other
settings remain the same.
When the ACL match order is auto, a newly created rule will be inserted among the existing rules in
the depth-first match order. Note that the IDs of the rules still remain the same.
14-11