H3C S7500 Series Ethernet Switches Operation Manual

Operation Manual – ACL
H3C S7500 Series Ethernet Switches Chapter 1
ACL Configuration
1-9
1.6 Defining Advanced ACLs
Advanced ACLs define classification rules according to the source and destination IP
addresses of packets, the type of protocol over IP, and protocol-specific features such
as TCP/UDP source and destination ports, ICMP protocol type, code, and so on.
The value range for advanced ACL numbers is 3,000 to 3,999. Note that ACL 3998 and
ACL 3999 cannot be configured because they are reserved for the cluster
management.
Advanced ACLs support analysis and processing of three packet priority levels: type of
service (ToS) priority, IP priority and differentiated services codepoint Priority (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate,
abundant, and flexible than those defined with basic ACLs.
1.6.1 Configuration Prerequisites
Before configuring an ACL rule containing time range arguments, you need to define
the corresponding time ranges. For the configuration of time ranges, refer to
Configuring Time Ranges.
The values of source and destination IP addresses, the type of the protocols over IP,
and protocol-specific features in the rule have been defined.
1.6.2 Configuration Procedure
Table 1-5 Define an advanced ACL rule
To do... Use the command... Remarks
Enter system view
system-view
—
Create or enter
advanced ACL view
acl { number acl-number |
name acl-name [ advanced |
basic | link | user ] }
[ match-order { config |
auto } ]
Required
By the default, the match
order is config.
Define an rule
rule [ rule-id ] { permit | deny }
rule-string
Required
Display ACL
information
display acl config { all |
acl-number | acl-name }
Optional
This command can be
executed in any view.
rule-string: rule information, which can be combination of the parameters described in
Table 1-6. You must configure the protocol argument in the rule information before you
can configure other arguments.