H3C S7500 Series Ethernet Switches Command Manual

Command Manual – ACL
H3C S7500 Series Ethernet Switches Chapter 1
ACL Commands
1-14
Parameters
rule-id: ACL rule ID, in the range of 0 to 127.
deny: Drops packets that satisfy the condition.
permit: Permits packets that satisfy the condition to pass.
fragment: Specifies that the rule takes effect on non-initial fragment packets only. If you
do not specify this keyword, the ACL will not filter packets by packet fragment
information.
source { sour-addr sour-wildcard | any }: Specifies the source address information in
the rule. sour-addr is used to specify the source IP address of the packet, expressed in
dotted decimal notation. sour-wildcard is used to specify the wildcard mask for the
source subnet mask of the packet, expressed in dotted decimal notation. For example,
you need to input 0.0.255.255 for the subnet mask 255.255.0.0. You can set
sour-wildcard to 0 to represent the host IP address. any is used to represent any
arbitrary IP address.
time-range time-name: Specifies a time range within which the rule is valid. If you do
not specify time-range time-name, the ACL will not filter packets by time range
information.
Description
Use the rule command to define an ACL rule.
Use the undo rule command to delete an ACL rule or the attribute information of an
ACL rule.
Before you can delete a rule, you need to specify the rule ID. If you do not know the rule
ID, you can view it by the display acl config command.
In the case that you specify the rule ID when defining a rule:
z If the ACL is created with the config keyword specified and the rule identified by
the rule-id argument exists, the settings specified in the rule command overwrite
the counterparts of the existing rule (other settings of the rule remain unchanged).
If the ACL is created with the auto keyword specified, the rules of the ACL cannot
be edited. In this case, the system prompts errors when you execute the rule
command.
z If the rule corresponding to the specified rule ID does not exist, you will create and
define a new rule.
z The content of a modified or created rule must not be identical with the content of
any existing rule; otherwise the rule modification or creation will be failed, and the
system will prompt that the rule already exists.
If you do not specify a rule ID, you will create and define a new rule, and the system will
assign an ID for the rule automatically.