H3C S3100 Series Command Manual page 560

Command Manual (For Soliton) – ACL
H3C S3100 Series Ethernet Switches
Note:
Note the following when assigning an advanced ACL to the hardware:
The fragment keywords are not supported.
When you specify the ttl keyword, the ttl argument can only be set to 0, 1 or 255.
When defining the source or destination port information, operator (in
can not be "neq".
When defining the source or destination port information, you can specify up to four
port ranges with the range operator.
Description
Use the rule command to define an ACL rule.
Use the undo rule command to remove an ACL rule or specified settings of an ACL
rule.
To remove an ACL rule using the undo rule command, you need to provide the ID of
the ACL rule. If no other arguments are specified, the entire ACL rule is removed.
Otherwise, only the specified information of the ACL rule is removed.
Note that:
With the config match order specified for the advanced ACL, you can modify any
existent rule. The unmodified part of the rule remains. With the auto match order
specified for the ACL, you cannot modify any existent rule; otherwise the system
prompts error information.
If you do not specify the rule-id argument when creating an ACL rule, the rule will
be numbered automatically. If the ACL has no rules, the rule is numbered 0;
otherwise, the number of the rule will be the greatest rule number plus one. If the
current greatest rule number is 65534, however, the system will display an error
message and you need to specify a number for the rule.
The content of a modified or created rule cannot be identical with the content of
any existing rules; otherwise the rule modification or creation will fail, and the
system prompts that the rule already exists.
If the ACL is created with the auto keyword specified, the newly created rules will
be inserted in the existent ones by depth-first principle, but the numbers of the
existent rules are unaltered.
Examples
# Create advanced ACL 3000 and define rule 1 to deny packets with the source IP
address of 192.168.0.1 and DSCP priority of 46.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] acl number 3000
Chapter 1 ACL Configuration Commands
1-21
Table 1-11)