Effective Period Of An Ipv4 Acl; Ip Fragments Filtering With Ipv4 Acl; Introduction To Ipv6 Acl; Ipv6 Acl Classification - H3C S5810 Series Operation Manual

Whenever the step changes, the rules are renumbered, starting from 0. For example, if four rules are
numbered 5, 10, 15, and 20 respectively, changing the step from 5 to 2 will cause the rules to be
renumbered 0, 2, 4, and 6.
Benefits of using the step
With the step and rule numbering/renumbering mechanism, you do not need to assign numbers to rules
when defining them. The system will assign a newly defined rule a number that is the smallest multiple
of the step bigger than the current biggest number. For example, with a step of five, if the biggest
number is currently 28, the newly defined rule will get a number of 30. If the ACL has no rule defined
already, the first defined rule will get a number of 0.
Another benefit of using the step is that it allows you to insert new rules between existing ones as
needed. For example, after creating four rules numbered 0, 5, 10, and 15 in an ACL with a step of five,
you can insert a rule numbered 1.

Effective Period of an IPv4 ACL

You can control when a rule can take effect by referencing a time range in the rule.
A referenced time range can be one that has not been created yet. The rule, however, can take effect
only after the time range is defined and becomes active.

IP Fragments Filtering with IPv4 ACL

Traditional packet filtering performs match operation on only the first fragments. All subsequent
non-first fragments are handled in the way the first fragments are handled. As attackers may fabricate
non-first fragments to attack your network, this results in security risks.
As for the configuration of a rule of an IPv4 ACL, the fragment keyword specifies that the rule applies to
non-first fragment packets only, and does not apply to non-fragment packets or the first fragment
packets. ACL rules that do not contain this keyword is applicable to both non-fragment packets and
fragment packets.

Introduction to IPv6 ACL

This section covers these topics:

IPv6 ACL Classification

IPv6 ACL Naming
IPv6 ACL Match Order
IPv6 ACL Step
Effective Period of an IPv6 ACL
IPv6 ACL Classification
IPv6 ACLs, identified by ACL numbers, fall into two categories, as shown in
1-4
Table 1-2.