H3C S7500 Series Ethernet Switches Command Manual

Command Manual – ACL
H3C S7500 Series Ethernet Switches Chapter 1
ACL Commands
1-25
View
User-defined ACL view
Parameters
rule-id: ACL rule ID, in the range of 0 to 127.
deny: Drops packets that satisfy the condition.
permit: Permits packets that satisfy the condition to pass.
rule-string: User-defined string of the rule. It must be an even number containing 2 to 20
hexadecimal characters.
rule-mask: User-defined mask of the rule. It is used to perform the logical AND
operations with packets and must be an even number containing 2 to 20 hexadecimal
characters. Note that its length must be the same with that of rule-string.
offset: Mask offset of the rule. It specifies a byte, through its offset from the packet
header, in the packet as the starting point to perform logical AND operations. It ranges
from 0 to 79 bytes, and the maximum value becomes one byte less when the value of
rule-string (and rule-mask) has two more characters. For example, when rule-string
and rule-mask contains two characters respectively, the maximum value of offset is 79
bytes; when the former contains four characters respectively, the maximum value of
offset is 78 bytes, and so on. The rule-mask argument works in conjunction with the
offset argument to extract a string from the packets, compare the string with the
user-defined rule-string, find out the matched packets, and then process the matched
packets accordingly.
&<1-8>: At most eight rules can be defined at one time.
time-range time-name: Specifies a time range within which the rule is valid.
Description
Use the rule command to define an ACL rule.
Use the undo rule command to delete an ACL rule or the attribute information of an
ACL rule.
Before you can delete a rule, you need to specify the rule ID. If you do not know the rule
ID, you can view it by the display acl config command.
In the case that you specify the rule ID when defining a rule:
z If the ACL is created with the config keyword specified and the rule identified by
the rule-id argument exists, the settings specified in the rule command overwrite
the counterparts of the existing rule (other settings of the rule remain unchanged).
If the ACL is created with the auto keyword specified, the rules of the ACL cannot
be edited. In this case, the system prompts errors when you execute the rule
command.