HP VPN Firewall Appliances Access Control Command Reference

23
Table 10 ICMPv6-specific parameters for IPv6 advanced ACL rules
Parameters Function Descri
p
tion
icmp6-type { icmp6-type
icmp6-code |
icmp6-message }
Specifies the ICMPv6
message type and
code.
The icmp6-type argument is in the range of 0 to 255.
The icmp6-code argument is in the range of 0 to 255.
The icmp6-message argument specifies a message name.
Supported ICMP message names and their corresponding
type and code values are listed in Table 11.
Table 11 ICMPv6 message names supported in IPv6 advanced ACL rules
ICMPv6 messa
g
e name ICMPv6 messa
g
e t
yp
e ICMPv6 messa
g
e code
echo-reply 129 0
echo-request 128 0
err-Header-field 4 0
frag-time-exceeded 3 1
hop-limit-exceeded 3 0
host-admin-prohib 1 1
host-unreachable 1 3
neighbor-advertisement 136 0
neighbor-solicitation 135 0
network-unreachable 1 0
packet-too-big 2 0
port-unreachable 1 4
redirect 137 0
router-advertisement 134 0
router-solicitation 133 0
unknown-ipv6-opt 4 2
unknown-next-hdr 4 1
Usage guidelines
Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating
or editing has the same deny or permit statement as another rule in the ACL, your creation or editing
attempt fails.
To view rules in an ACL and their rule IDs, use the display acl ipv6 all command.
Examples
# Create an IPv6 advanced ACL rule to permit TCP packets with the destination port 80 from
2030:5060::/64 to FE80:5060::/96, and enable logging matching packets.
<Sysname> system-view
[Sysname] acl ipv6 number 3000
[Sysname-acl6-adv-3000] rule permit tcp source 2030:5060::/64 destination fe80:5060::/96
destination-port eq 80 logging