Configuring Advanced Acl - H3C S5100-SI Operation Manual

Acl's step is 1
rule 0 deny source 192.168.0.1 0

Configuring Advanced ACL

An advanced ACL can filter packets by their source and destination IP addresses, the protocols carried
by IP, and protocol-specific features such as TCP/UDP source and destination ports, ICMP message
type and message code.
An advanced ACL can be numbered from 3000 to 3999. Note that ACL 3998 and ACL 3999 cannot be
configured because they are reserved for cluster management.
Advanced ACLs support analysis and processing of three packet priority levels: type of service (ToS)
priority, IP priority and differentiated services codepoint (DSCP) priority.
Using advanced ACLs, you can define classification rules that are more accurate, more abundant, and
more flexible than those defined for basic ACLs.
Configuration Prerequisites
To configure a time range-based advanced ACL rule, you need to create the corresponding time
ranges first. For information about of time range configuration, refer to section
Range.
The settings to be specified in the rule, such as source and destination IP addresses, the protocols
carried by IP, and protocol-specific features, are determined.
Configuration Procedure
Table 1-3 Define an advanced ACL rule
Operation
Enter system view
Create an advanced
ACL and enter
advanced ACL view
Define an ACL rule
Assign a description
string to the ACL rule
Assign a description
string to the ACL
Note that:
With the config match order specified for the advanced ACL, you can modify any existent rule. The
unmodified part of the rule remains. With the auto match order specified for the ACL, you cannot
modify any existent rule; otherwise the system prompts error information.
If you do not specify the rule-id argument when creating an ACL rule, the rule will be numbered
automatically. If the ACL has no rules, the rule is numbered 0; otherwise, the number of the rule will
be the greatest rule number plus one. If the current greatest rule number is 65534, however, the
system will display an error message and you need to specify a number for the rule.
Command
system-view
acl number acl-number
[ match-order { auto | config } ]
rule [ rule-id ] { permit | deny }
protocol [ rule-string ]
rule rule-id comment text
description text
1-6
Configuring Time
Description
—
Required
config by default
Required
For information about protocol and
rule-string, refer to ACL Commands.
Optional
No description by default
Optional
No description by default