4000 Router Series ACL and QoS Command Reference

Usage guidelines

Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating

or editing has the same deny or permit statement as another rule in the ACL, your creation or editing

attempt fails.

You can edit ACL rules only when the match order is config.

If no optional keywords are provided in the undo rule command, you delete the entire rule. If optional

keywords or arguments are provided, you delete the specified attributes.

To view rules in an ACL and their rule IDs, use the display acl ipv6 all command.

Examples

# Create an IPv6 basic ACL rule to deny the packets from any source IP segment but 1001::/16,

312 4 :1123::/32, or FE80:5060:1001::/48.

<Sysname> system-view

[Sysname] acl ipv6 number 2000

[Sysname-acl6-basic-2000] rule permit source 1001:: 16

[Sysname-acl6-basic-2000] rule permit source 3124:1123:: 32

[Sysname-acl6-basic-2000] rule permit source fe80:5060:1001:: 48

[Sysname-acl6-basic-2000] rule deny source any

Related commands

• acl

• acl logging interval

• display acl

• step

• time-range

rule (user-defined ACL view)

Use rule to create or edit a user-defined ACL rule.

Use undo rule to delete a user-defined ACL rule.

Syntax

rule [ rule-id ] { deny | permit } [ { { ipv4 | ipv6 | l2 | l4 } rule-string rule-mask offset }&<1-8> ] [ counting

| time-range time-range-name ] *

undo rule rule-id

Default

A user-defined ACL does not contain any rule.

Views

User-defined ACL view

Predefined user roles

network-admin

Parameters

rule-id: Specifies a rule ID in the range of 0 to 65534. If no rule ID is provided when you create an ACL

rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the