R211x-HP Flexfabric 11900 ACL and QoS Command Reference

19
Usage guidelines
When an Ethernet frame header ACL with the lsap keyword specified is for QoS traffic classification or
packet filtering, the lsap-type argument must be AAAA and the lsap-type-mask argument must be FFFF.
Otherwise, the ACL cannot be applied successfully.
Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating
or editing has the same deny or permit statement as another rule in the ACL, your creation or editing
attempt fails.
You can edit ACL rules only when the match order is config. If no optional keywords are provided for the
undo rule command, you delete the entire rule. If optional keywords or arguments are provided, you
delete the specified attributes.
To view rules in an ACL and their rule IDs, use the display acl all command.
Examples
# Create a rule in Ethernet frame header ACL 4000 to permit ARP packets and deny RARP packets.
<Sysname> system-view
[Sysname] acl number 4000
[Sysname-acl-ethernetframe-4000] rule permit type 0806 ffff
[Sysname-acl-ethernetframe-4000] rule deny type 8035 ffff
Related commands
• acl
• display acl
• step
• time-range
rule (IPv4 advanced ACL view)
Use rule to create or edit an IPv4 advanced ACL rule.
Use undo rule to delete an entire IPv4 advanced ACL rule or some attributes in the rule.
Syntax
rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value
| syn syn-value | urg urg-value } * | established } | counting | destination { dest-address dest-wildcard
| any } | destination-port operator port1 [ port2 ] | { dscp dscp | { precedence precedence | tos tos }
* } | fragment | icmp-type { icmp-type [ icmp-code ] | icmp-message } | source { source-address
source-wildcard | any } | source-port operator port1 [ port2 ] | time-range time-range-name |
vpn-instance vpn-instance-name ] *
undo ru
le rule-id [ { { ack | fin | psh | rst | syn | urg } * | established } | counting | destination |
destination-port | { dscp | { precedence | tos } * } | fragment | icmp-type | source | source-port |
time-range | vpn-instance ] *
Default
An IPv4 advanced ACL does not contain any rule.
Views
IPv4 advanced ACL view