Defining Advanced Acls; Configuration Prerequisites; Configuration Procedure - H3C S7500 Series Operation Manual

Operation Manual – ACL
H3C S7500 Series Ethernet Switches

1.6 Defining Advanced ACLs

Advanced ACLs define classification rules according to the source and destination IP
addresses of packets, the type of protocol over IP, and protocol-specific features such
as TCP/UDP source and destination ports, ICMP protocol type, code, and so on.
The value range for advanced ACL numbers is 3,000 to 3,999. Note that ACL 3998 and
ACL 3999 cannot be configured because they are reserved for the cluster
management.
Advanced ACLs support analysis and processing of three packet priority levels: type of
service (ToS) priority, IP priority and differentiated services codepoint Priority (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate,
abundant, and flexible than those defined with basic ACLs.

1.6.1 Configuration Prerequisites

Before configuring an ACL rule containing time range arguments, you need to define
the corresponding time ranges. For the configuration of time ranges, refer to
Configuring Time
The values of source and destination IP addresses, the type of the protocols over IP,
and protocol-specific features in the rule have been defined.

1.6.2 Configuration Procedure

Table 1-5 Define an advanced ACL rule
To do...
Enter system view
Create or enter
advanced ACL view
Define an rule
Display ACL
information
rule-string: rule information, which can be combination of the parameters described in
Table 1-6. You must configure the protocol argument in the rule information before you
can configure other arguments.
Ranges.
Use the command...
system-view
acl { number acl-number |
name acl-name [ advanced |
basic | link | user ] }
[ match-order { config |
auto } ]
rule [ rule-id ] { permit | deny }
rule-string
display acl config { all |
acl-number | acl-name }
1-9
Chapter 1 ACL Configuration
Remarks
—
Required
By the default, the match
order is config.
Required
Optional
This command can be
executed in any view.