3Com SuperStack 4 Configuration Manual page 215

ACL Control
Configuration
Configuring ACL for
Telnet Users
Defining ACL
[SW5500-radius-radius1]quit
e Create the user domain 3com163.net and specify radius1 as the RADIUS server
group for the user.
[SW5500]domain 3com163.net
[SW5500-isp-3com163.net]radius-scheme radius1
[SW5500-isp-3com163.net]quit
f Define the ACL
[SW5500]acl number 3000
[SW5500-acl-adv-3000]rule 1 permit ip destination any
[SW5500-acl-adv-3000]quit
g Configure the QoS profile
[SW5500]qos-profile example
[SW5500-qos-profile-example]traffic-limit inbound ip-group 3000 128
exceed drop
[SW5500-qos-profile-example]traffic-priority inbound ip-group 3000
dscp 46
[SW5500-qos-profile-example]quit
h Set user based mode on the Ethernet1/0/1 port
[SW5500]interface gigabitethernet1/0/1
[SW5500-GigabitEthernet1/0/1]qos-profile user-based
P
The Switch supports three major access modes: SNMP (Simple Network
Management Protocol) access, Telnet access and HTTP (Hypertext Transfer
Protocol) access. Security control is achieved at two levels: Connection request
control is achieved at the first level and appropriate ACL configuration ensures
that only legal users can be connected to the Switch. Password authentication is
achieved at the second level and only those connected, with correct passwords,
can log successfully onto the Switch.
In this section only the first level security control, ACL configuration, is detailed.
See the "Getting Started"
This configuration can filter out malicious or illegal connection request before
password authentication.
Two steps are included in this configuration:
1 Define an ACL
2 Import the ACL to control Telnet users
Currently only number-based ACLs can be imported, with the number ranging
from 2000 to 3999.
Perform the following configuration in System View.
chapter on page 19 for the second level control.
ACL Control Configuration 227