3Com Switch 7750 Configuration Guide

642 CHAPTER 60: ACL CONFIGURATION
In the case that you specify the rule ID when defining a rule:
■ If the rule corresponding to the specified rule ID already exists, you will edit the
rule, and the modified part in the rule will replace the original content, while
other parts remain unchanged.
■ If the rule corresponding to the specified rule ID does not exists, you will create
and define a new rule.
■ The content of a newly created rule must not be identical with the content of
any existing rule; otherwise the rule creation will fail, and the system will
prompt that the rule already exists.
If you do not specify a rule ID, you will create and define a new rule, and the
system will assign an ID for the rule automatically.
Configuration Example # Configure ACL 2000 to deny packets whose source IP address is 1.1.1.1.
<SW7750> system-view
[SW7750] acl number 2000
[SW7750-acl-basic-2000] rule deny source 1.1.1.1 0
[SW7750-acl-basic-2000] display acl config 2000
Basic ACL 2000, 1 rule,
rule 0 deny source 1.1.1.1 0 (0 times matched)
Defining Advanced
ACLs
Advanced ACLs define classification rules according to the source and destination
IP addresses of packets, the type of protocol over IP, and protocol-specific features
such as TCP/UDP source and destination ports, TCP flag bit, ICMP protocol type,
and so on.
The value range for advanced ACL numbers is 3,000 to 3,999 (ACL 3998 and
3999 are reserved for cluster management, and you cannot configure them).
Advanced ACLs support analysis and processing of three packet priority levels:
type of service (ToS) priority, IP priority and differentiated services codepoint
Priority (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate,
more abundant, and more flexible than those defined with basic ACLs.
Create or enter basic ACL
view
acl { number acl-number |
name acl-name [ advanced |
basic | link | user ]}
[ match-order { config |
auto }]
Required
By the default, the match
order is config.
Define an rule rule [ rule-id ]{permit |
deny } [ source { source-addr
wildcard | any } | fragment |
time-range time-name ]*
Required
Display ACL information display acl config { all |
acl-number | acl-name }
Optional
This command can be
executed in any view.
Table 510 Define a basic ACL rule
Operation Command Description