Defining Advanced Acls - 3Com 7757 Configuration Manual

642 C 60: ACL C
HAPTER
Configuration Example
Defining Advanced
ACLs
ONFIGURATION
Table 510 Define a basic ACL rule
Operation
Create or enter basic ACL
view
Define an rule
Display ACL information
In the case that you specify the rule ID when defining a rule:
If the rule corresponding to the specified rule ID already exists, you will edit the
■
rule, and the modified part in the rule will replace the original content, while
other parts remain unchanged.
If the rule corresponding to the specified rule ID does not exists, you will create
■
and define a new rule.
The content of a newly created rule must not be identical with the content of
■
any existing rule; otherwise the rule creation will fail, and the system will
prompt that the rule already exists.
If you do not specify a rule ID, you will create and define a new rule, and the
system will assign an ID for the rule automatically.
# Configure ACL 2000 to deny packets whose source IP address is 1.1.1.1.
<SW7750> system-view
[SW7750] acl number 2000
[SW7750-acl-basic-2000] rule deny source 1.1.1.1 0
[SW7750-acl-basic-2000] display acl config 2000
Basic ACL 2000, 1 rule,
rule 0 deny source 1.1.1.1 0 (0 times matched)
Advanced ACLs define classification rules according to the source and destination
IP addresses of packets, the type of protocol over IP, and protocol-specific features
such as TCP/UDP source and destination ports, TCP flag bit, ICMP protocol type,
and so on.
The value range for advanced ACL numbers is 3,000 to 3,999 (ACL 3998 and
3999 are reserved for cluster management, and you cannot configure them).
Advanced ACLs support analysis and processing of three packet priority levels:
type of service (ToS) priority, IP priority and differentiated services codepoint
Priority (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate,
more abundant, and more flexible than those defined with basic ACLs.
Command
acl { number acl-number |
name acl-name [ advanced |
basic | link | user ] }
[ match-order { config |
auto } ]
rule [ rule-id ] { permit |
deny } [ source { source-addr
wildcard | any } | fragment |
time-range time-name ]*
display acl config { all |
acl-number | acl-name }
Description
Required
By the default, the match
order is config.
Required
Optional
This command can be
executed in any view.