Configuring Basic Acl Rule; Configuring Extended Acl - Zte ZXR10 5900 Series User Manual

Step Command
1 acl standard {number <acl-number
ZXR10(config)#
>|name <acl-name>}
2
ZXR10(config-std-acl)#
}{<source>[<source-wildcard>]|any}[time-range
<timerange-name>]
3
ZXR10(config-std-acl)#
before}<rule-no>
Example
Step Command
1 acl extend {number <acl-number>|n
ZXR10(config)#
ame <acl-name>}
2
ZXR10(config-ext-acl)#
eny}{<source><source-wildcard>|any}{<dest
><dest-wildcard>|any}[<icmp-type>[icmp-code
<icmp-code>]][{[precedence <pre-value>][tos
<tos-value>]}|dscp <dscp-value>][fragment][time-
range <timerange-name>]
3
ZXR10(config-ext-acl)#
}{<ip-number>|ip}{<source><source-wildcard>|a
ny}{<dest><dest-wildcard>|any}[{[precedence
<pre-value>][tos <tos-value>]}|dscp <dscp-value
>][fragment][time-range <timerange-name>]
4
ZXR10(config-ext-acl)#
y}{<source><source-wildcard>|any}[<rule><port
>]{<dest><dest-wildcard>|any}[<rule><port>][est
ablished][{[precedence <pre-value>][tos <tos-val
ue>]}|dscp <dscp-value>][fragment][time-range
<timerange-name>]
1. If a packet matches multiple rules at the same time, the first
matched rule shall apply. Therefore, the sequence of these
rules is critical important. In usual cases, the rule with smaller
range is put ahead and the rule with larger range is put behind.
2. Taking network security into account, an implicit Deny rule is
automatically attached to the end of each ACL to deny all pack-
ets. Therefore, a Permit rule is usually configured at the end
of ACL to permit all packets to pass through.

Configuring Basic ACL Rule

rule <1-100>{permit|deny
move <rule-no>{after |
This example defines a standard ACL. The ACL permits packets
from the network segment 192.168.1.0/24 to pass, but reject
packets with the source IP address of 192.168.1.100.
ZXR10(config)#acl standard number 10
ZXR10(config-std-acl)#rule 1 deny 192.168.1.100 0.0.0.0
ZXR10(config-std-acl)#rule 2 permit 192.168.1.0 0.0.0.255

Configuring Extended ACL

rule <rule-no>{permit|d
rule <rule-no>{permit|deny
rule <rule-no>{permit|den
Confidential and Proprietary Information of ZTE CORPORATION
Chapter 7 ACL Configuration
Function
This enters the standard ACL
configuration mode.
This configures the rules of
ACL.
This moves a rule behind of
another rule.
Function
This enters the extended ACL
configuration.
This configures the rules
based on ICMP.
This configures the rules
based on IP or IP protocol
number (excluded ICMP, TCP,
UDP)
This configures the rules
based on TCP.
61