Configuration Procedure; Configuration Example - H3C S7500 Series Operation Manual

Operation Manual – ACL
H3C S7500 Series Ethernet Switches

1.5.2 Configuration Procedure

Table 1-4 Define a basic ACL rule
To do...
Enter system view
Create or enter
basic ACL view
Define an rule
Display ACL
information
In the case that you specify the rule ID when defining a rule:
If the ACL is created with the config keyword specified and the rule identified by
the rule-id argument exists, the settings specified in the rule command overwrite
the counterparts of the existing rule (other settings of the rule remain unchanged).
If the ACL is created with the auto keyword specified, the rules of the ACL cannot
be edited. In this case, the system prompts errors when you execute the rule
command.
If the rule corresponding to the specified rule ID does not exist, you will create and
define a new rule.
The content of a modified or newly created rule must not be identical with the
content of any existing rule; otherwise the rule modification or creation will be
failed, and the system will prompt that the rule already exists.
If you do not specify a rule ID, you will create and define a new rule, and the system will
assign an ID for the rule automatically.

1.5.3 Configuration Example

# Configure ACL 2000 to deny packets with source IP address being 1.1.1.1.
<H3C> system-view
[H3C] acl number 2000
[H3C-acl-basic-2000] rule deny source 1.1.1.1 0
[H3C-acl-basic-2000] display acl config 2000
Basic ACL
rule 0 deny source 1.1.1.1 0 (0 times matched)
Use the command...
system-view
acl { number acl-number | name
acl-name [ advanced | basic |
link | user ] } [ match-order
{ config | auto } ]
rule [ rule-id ] { permit | deny }
[ source { source-addr wildcard |
any } | fragment | time-range
time-name ]*
display acl config { all |
acl-number | acl-name }
2000, 1 rule
1-8
Chapter 1 ACL Configuration
Remarks
—
Required
By the default, the match
order is config.
Required
Optional
This command can be
executed in any view.