Configuring Advanced Acl - H3C S5600 Series Operation Manual

Operation Manual – ACL
H3C S5600 Series Ethernet Switches
current greatest rule number is 65534, however, the system will display an error
message and you need to specify a number for the rule.
The content of a modified or created rule cannot be identical with the content of
any existing rule; otherwise the rule modification or creation will fail, and the
system prompts that the rule already exists.
With the auto match order specified, the newly created rules will be inserted in the
existent ones by depth-first principle, but the numbers of the existent rules are
unaltered.
III. Configuration example
# Configure ACL 2000 to deny packets whose source IP addresses are 192.168.0.1.
<Sysname> system-view
[Sysname] acl number 2000
[Sysname-acl-basic-2000] rule deny source 192.168.0.1 0
# Display the configuration information of ACL 2000.
[Sysname-acl-basic-2000] display acl 2000
Basic ACL
Acl's step is 1
rule 0 deny source 192.168.0.1 0

1.2.3 Configuring Advanced ACL

An advanced ACL can filter packets by their source and destination IP addresses, the
protocols carried by IP, and protocol-specific features such as TCP/UDP source and
destination ports, ICMP message type and message code.
An advanced ACL can be numbered from 3000 to 3999. Note that ACL 3998 and ACL
3999 cannot be configured because they are reserved for cluster management.
Advanced ACLs support analysis and processing of three packet priority levels: type of
service (ToS) priority, IP priority and differentiated services codepoint (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate, more
abundant, and more flexible than those defined for basic ACLs.
I. Configuration prerequisites
To configure a time range-based advanced ACL rule, you need to create the
corresponding time ranges first. For information about of time range configuration,
refer to
The settings to be specified in the rule, such as source and destination IP
addresses, the protocols carried by IP, and protocol-specific features, are
determined.
2000, 1 rule
Configuring Time Range.
1-7
Chapter 1 ACL Configuration