F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices Attack Protection Configuration Guide-6PW100

72
92BConfiguring packet filtering on an interface
When an ACL is applied to an interface, the time range-based filtering will also work at the same time.
In addition, you can specify separate access rules for inbound and outbound packets.
The effective range for basic ACL numbers is 2000 to 2999. A basic ACL defines rules based on the
Layer 3 source IP addresses only to analyze and process data packets.
The effective range for advanced ACL numbers is 3000 to 3999. An advanced ACL defines rules
according to the source and destination IP addresses of packets, the type of protocol over IP, TCP/UDP
source and destination ports, and so on.
An advanced ACL supports the following match modes:
• Normal match—Matches Layer 3 information. Non-layer 3 information is ignored. The default
mode is normal match mode.
• Exact match—Matches all advanced ACL rules. For this reason, you must enable fragment
inspection for the firewall to record the status of the first fragment of each packet and obtain the
match information of the subsequent fragments. The exact match mode is not supported on the
device.
You can neither enable packet filtering on an interface in an aggregation group, nor add an interface
with packet filtering enabled to an aggregation group.
186BConfiguring IPv6 packet filtering on an interface
IPv6 packet filtering is a basic firewall function of an IPv6-based ACL. You can configure IPv6 packet
filtering in the inbound or outbound direction of an interface so that the interface filters packets that
match the IPv6 ACL rules.
To configure IPv6 packet filtering on an interface:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter interface view.
interface interface-type
interface-number
N/A
3. Configure IPv6 packet filtering
on an interface.
firewall packet-filter ipv6
{ acl6-number | name acl6-name }
{ inbound | outbound }
IPv6 packets are not filtered by
default.
You can apply only one IPv6 ACL
in one direction of an interface for
packet filtering.
4. Display the packet filtering
statistics of the IPv6 firewall.
display firewall ipv6 statistics { all
| interface interface-type
interface-number } [ | { begin |
exclude | include }
regular-expression ]
Available in any view.
5. Clear the packet filtering
statistics of the IPv6 firewall.
reset firewall ipv6 statistics { all |
interface interface-type
interface-number }
Available in user view.