R3303-HP HSR6800 Routers ACL and QoS Configuration Guide

Figure 2 Network diagram

Configuration procedure

# Create a periodic time range from 8:00 to 18:00 on working days.

<RouterA> system-view

[RouterA] time-range work 8:0 to 18:0 working-day

# Create an IPv6 advanced ACL numbered 3000 and configure three rules in the ACL. One rule permits

access from the President office to the database server, one rule permits access from the Financial

department to the database server during working hours, and one rule denies access from other

departments to the database server.

[RouterA] acl ipv6 number 3000

[RouterA-acl6-adv-3000] rule permit ipv6 source 1001:: 16 destination 1000::100 128

[RouterA-acl6-adv-3000] rule permit ipv6 source 1002:: 16 destination 1000::100 128

time-range work

[RouterA-acl6-adv-3000] rule deny ipv6 source any destination 1000::100 128

[RouterA-acl6-adv-3000] quit

# Enable IPv6 firewall, and apply IPv6 advanced ACL 3000 to filter outgoing IPv6 packets on interface

GigabitEthernet 1/0/1.

[RouterA] firewall ipv6 enable

[RouterA] interface gigabitethernet 1/0/1

[RouterA-GigabitEthernet1/0/1] firewall packet-filter ipv6 3000 outbound

Verifying the configuration

# Ping the database server from a PC in the Financial department during working hours. (All PCs in this

example use Windows XP.)

C:\> ping 1000::100

Pinging 1000::100 with 32 bytes of data:

Reply from 1000::100: time<1ms

President office

1001::/16

Financial department

1002::/16

Marketing department

1003::/16

Device A

GE1/0/1

GE1/0/4GE1/0/2

GE1/0/3

Financial database server

1000::100/16