3Com 7700 Configuration Manual page 153

Table 5 Define Advanced ACL
Operation
Delete a sub-item from the ACL
(from advanced ACL view)
Delete one ACL or all the ACL
(from system view)
The advanced ACL is identified with numbers ranging from 100 to 199.
Note that port1 and port2 in this command specify the TCP or UDP ports used by
various high-layer applications. For some common port numbers, you can use the
mnemonic symbols as shortcut. For example, "bgp" can represent the TCP
number 179 used by BGP.
Note: For some switches, the protocol type (the parameter protocol in the rule
command) cannot be configured if the user configures the IP-any rules ( the
source IP address is the host IP address, the destination address is the host IP
address or NET segment address in the rules). Otherwise, the system displays a
message that the configuration is not available.
Define Interface ACL
The rules of the interface ACL are defined on the basis of the packets' Layer-3
interface to analyze the data packets.
Perform the following configuration in the designated view.
Table 6 Define Interface ACL
Operation
Enter interface ACL view(from
system view)
Add a sub-item to the
ACL(from interface ACL view)
Delete a sub-item from the
ACL(from interface ACL view)
Delete one ACL or all the
ACL(from system view)
The numbered interface ACLs can be identified with numbers ranging from 1000
to 1999.
Notes: The Switch 7700 does not have any Layer-3 physical interface but has
Layer-3 VLAN virtual interface. Therefore when the command line prompts for the
input interface type, you can only select Vlan-interface. Otherwise, the system will
display a failure message.
Interface ACL is only used to filter or classify the data treated by the software of
the switch.
Define Layer-2 ACL
The rules of Layer-2 ACL are defined on the basis of the Layer-2 information, such
as source MAC address, source VLAN ID, Layer-2 protocol type, Layer-2 packet
fomat, and destination MAC address.
Command
undo rule rule-id [ source ] [ destination ] [ soure-port
] [ destination-port ] [ precedence ] [ tos ] [ dscp ] [
fragment ] [ time-range ]
undo acl { number acl-number | name acl-name | all }
Command
acl { number acl-number | name acl-name interface } [
match-order { config | auto } ]
rule [ rule-id ] { permit | deny } [ interface { interface-name |
interface-type interface-num | any } ] [ time-range name ]
undo rule rule-id
undo acl { number acl-number | name acl-name | all }
Configuring ACL 145