Configuring Hybrid Acl - Zte ZXR10 5900 Series User Manual

Step Command
1
acl hybrid {number <acl-number>|n
ZXR10(config)#
ame <acl-name>}
2
ZXR10(config-hybd-acl)#
eny}{<ip-number>|ip}{<source><source-wildc
ard>|any}{<dest><dest-wildcard>|any}{[any
|<ether protocol>]}[cos <0-7>][<vlan-id>][ingress
<source-mac><source-mac-wildcard> egress
<dest-mac><dest-mac-wildcard>][time-range
<timerange-name>]
3
ZXR10(config-hybd-acl)#
rmit|deny}{<source><source-wildcard>|
any}{[<dest-ip><dest-wildcard>| any {ethe
r-protocol}[<vlan-id>][cos<value>][egress
<dst-mac><dst-wildcard>][ingress <sor-mac><s
or-wildcard>][time-range<range-name>]][eq
<port-number>{<dst-mac><dst-wildcard>|
any}<ether-protocol>[<vlan-id>][cos<value
>][egress<dst-mac><dst-wildcard>][ingress
<sor-mac><sor-wildcard>][time-range
<range-name>]]}
4
ZXR10(config-hybd-acl)#
rmit|deny}{<source><source-wildcard>|
any}{[<dest-ip><dest-wildcard>| any {ethe
r-protocol}[<vlan-id>][cos<value>][egress
<dst-mac><dst-wildcard>][ingress <sor-mac><s
or-wildcard>][time-range<range-name>]][eq
<port-number>{<dst-mac><dst-wildcard>|
any}<ether-protocol>[<vlan-id>][cos<value
>][egress<dst-mac><dst-wildcard>][ingress
<sor-mac><sor-wildcard>][time-range
<range-name>]]}
5
ZXR10(config-hybd-acl)#
before}<rule-no>
Example

Configuring Hybrid ACL

rule <rule-no>{permit|d
rule <rule-no>{pe
rule <rule-no>{pe
move <rule-no>{after |
This shows an extended ACL to perform the following functions:
1. Permit UDP
210.168.1.0/24, the destination IP address 210.168.2.10,
destination MAC address 00d0.d0c0.5741, the source port
100 and the destination port 200 to pass.
2. Forbid the BGP
192.168.3.0/24 passing.
3. Forbid all packets with the MAC address 0100.2563.1425.
ZXR10(config)#acl hybrid number 300
ZXR10(config-hybd-acl)#rule 1 permit udp 210.168.1.0 0.0.0.255 Eq
100 210.168.2.10 0.0.0.0 eq 200 any Egress
00d0.d0c0.5741 0000.0000.0000
ZXR10(config-hybd-acl)#rule 2 deny tcp 192.168.3.0 0.0.0.255
Eq BGP any any
ZXR10(config-hybd-acl)#rule 3 deny any any any ingress
0100.2563.1425 0000.0000.0000
Confidential and Proprietary Information of ZTE CORPORATION
Function
This enters the hybrid ACL
configuration.
This configures the rules
based on IP or IP protocol
number (excluded ICMP, TCP,
UDP).
This configures the rules
based on TCP.
This configures the rules
based on UDP.
This moves a rule behind
another rule.
packets from the
packets from
Chapter 7 ACL Configuration
network segment
the network segment
63