HP VPN Firewall Appliances Access Control Command Reference

21
numbering step to the current highest rule ID, starting from 0. For example, if the rule numbering step is
5 and the current highest rule ID is 28, the rule is numbered 30.
deny: Denies matching packets.
permit: Allows matching packets to pass.
protocol: Matches protocol carried over IPv6. It can be a number in the range of 0 to 255, or in words,
gre (47), icmpv6 (58), ipv6, ipv6-ah (51), ipv6-esp (50), ospf (89), tcp (6), or udp (17) . Table 8 des
cribes
the parameters that yo
u can specify regardless of the value for the protocol argument.
Table 8 Match criteria and other rule information for IPv6 advanced ACL rules
Parameters Function Descri
p
tion
source
{ source-address
source-prefix |
source-address/so
urce-prefix | any }
Specifies a source IPv6 address.
The source-address and source-prefix arguments
represent an IPv6 source address, and prefix length in
the range of 1 to 128.
The any keyword represents any IPv6 source address.
destination
{ dest-address
dest-prefix |
dest-address/dest-
prefix | any }
Specifies a destination IPv6
address.
The dest-address and dest-prefix arguments represent
a destination IPv6 address, and prefix length in the
range of 1 to 128.
The any keyword specifies any IPv6 destination
address.
counting
Counts the number of times the
ACL rule has been matched. In
the software version, the device
counts the number of times the
ACL rule has been matched no
matter whether this keyword is
specified.
N/A
dscp dscp Specifies a DSCP preference.
The dscp argument can be a number in the range of 0
to 63, or in words, af11 (10), af12 (12), af13 (14),
af21 (18), af22 (20), af23 (22), af31 (26), af32 (28),
af33 (30), af41 (34), af42 (36), af43 (38), cs1 (8),
cs2 (16), cs3 (24), cs4 (32), cs5 (40), cs6 (48), cs7
(56), default (0), or ef (46).
flow-label
flow-label-value
Specifies a flow label value in
an IPv6 packet header.
The flow-label-value argument is in the range of 0 to
1048575.
logging Logs matching packets.
This function requires that the module that uses the
ACL supports logging.
routing [ type
routing-type ]
Specifies the type of routing
header.
The routing-type argument is a value in the range of 0
to 255.
If no routing type header is specified, the rule applies
to the IPv6 packets with any type of routing header.
fragment
Applies the rule to only non-first
fragments.
Without this keyword, the rule applies to all fragments
and non-fragments.