Command Reference Guide

32
Usage guidelines
If an ACL is for QoS traffic classification or packet filtering:
• Do not specify the fragment keyword.
• Do not specify the vpn-instance or routing keyword if the ACL is for outbound QoS traffic
classification or outbound packet filtering.
Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating
or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created
or changed.
You can edit ACL rules only when the match order is config.
• If you do not specify any optional keywords, the undo rule command deletes the entire rule.
• If you specify optional keywords or arguments, the undo rule command deletes the specified
attributes.
To view rules in an ACL and their rule IDs, use the display acl ipv6 all command.
Examples
# Create an IPv6 basic ACL rule to deny the packets from any source IP segment but 1001::/16,
312 4 :1123::/32, or FE80:5060:1001::/48.
<Sysname> system-view
[Sysname] acl ipv6 number 2000
[Sysname-acl6-basic-2000] rule permit source 1001:: 16
[Sysname-acl6-basic-2000] rule permit source 3124:1123:: 32
[Sysname-acl6-basic-2000] rule permit source fe80:5060:1001:: 48
[Sysname-acl6-basic-2000] rule deny source any
Related commands
• acl
• acl logging interval
• display acl
• step
• time-range
rule (user-defined ACL view)
Use rule to create or edit a user-defined ACL rule.
Use undo rule to delete a user-defined ACL rule.
Syntax
rule [ rule-id ] { deny | permit } [ { l2 rule-string rule-mask offset }&<1-8> ] [ counting | time-range
time-range-name ] *
undo rule rule-id
Default
A user-defined ACL does not contain any rule.
Views
User-defined ACL view