Switch 7700 Configuration Guide

Configuring ACL 145
The advanced ACL is identified with numbers ranging from 100 to 199.
Note that port1 and port2 in this command specify the TCP or UDP ports used by
various high-layer applications. For some common port numbers, you can use the
mnemonic symbols as shortcut. For example, “bgp” can represent the TCP
number 179 used by BGP.
Note: For some switches, the protocol type (the parameter protocol in the rule
command) cannot be configured if the user configures the IP-any rules ( the
source IP address is the host IP address, the destination address is the host IP
address or NET segment address in the rules). Otherwise, the system displays a
message that the configuration is not available.
Define Interface ACL
The rules of the interface ACL are defined on the basis of the packets’ Layer-3
interface to analyze the data packets.
Perform the following configuration in the designated view.
The numbered interface ACLs can be identified with numbers ranging from 1000
to 1999.
Notes: The Switch 7700 does not have any Layer-3 physical interface but has
Layer-3 VLAN virtual interface. Therefore when the command line prompts for the
input interface type, you can only select Vlan-interface. Otherwise, the system will
display a failure message.
Interface ACL is only used to filter or classify the data treated by the software of
the switch.
Define Layer-2 ACL
The rules of Layer-2 ACL are defined on the basis of the Layer-2 information, such
as source MAC address, source VLAN ID, Layer-2 protocol type, Layer-2 packet
fomat, and destination MAC address.
Delete a sub-item from the ACL
(from advanced ACL view)
undo rule rule-id [ source ] [ destination ] [ soure-port
] [ destination-port ] [ precedence ] [ tos ] [ dscp ] [
fragment ] [ time-range ]
Delete one ACL or all the ACL
(from system view)
undo acl { number acl-number | name acl-name | all }
Tabl e 6 Define Interface ACL
Operation Command
Enter interface ACL view(from
system view)
acl { number acl-number | name acl-name interface } [
match-order { config | auto } ]
Add a sub-item to the
ACL(from interface ACL view)
rule [ rule-id ] { permit | deny } [ interface { interface-name |
interface-type interface-num | any } ] [ time-range name ]
Delete a sub-item from the
ACL(from interface ACL view)
undo rule rule-id
Delete one ACL or all the
ACL(from system view)
undo acl { number acl-number | name acl-name | all }
Table 5 Define Advanced ACL
Operation Command