Command Manual (For Soliton) – ACL
H3C S3100 Series Ethernet Switches
Chapter 1 ACL Configuration Commands
1-21
Note:
z
Note the following when assigning an advanced ACL to the hardware:
z
The
fragment
keywords are not supported.
z
When you specify the
ttl
keyword, the
ttl
argument can only be set to
0
,
1
or
255
.
z
When defining the source or destination port information, operator (in
Table 1-11
)
can not be “
neq
”.
z
When defining the source or destination port information, you can specify up to four
port ranges with the
range
operator.
Description
Use the
rule
command to define an ACL rule.
Use the
undo rule
command to remove an ACL rule or specified settings of an ACL
rule.
To remove an ACL rule using the
undo rule
command, you need to provide the ID of
the ACL rule. If no other arguments are specified, the entire ACL rule is removed.
Otherwise, only the specified information of the ACL rule is removed.
Note that:
z
With the
config
match order specified for the advanced ACL, you can modify any
existent rule. The unmodified part of the rule remains. With the
auto
match order
specified for the ACL, you cannot modify any existent rule; otherwise the system
prompts error information.
z
If you do not specify the
rule-id
argument when creating an ACL rule, the rule will
be numbered automatically. If the ACL has no rules, the rule is numbered 0;
otherwise, the number of the rule will be the greatest rule number plus one. If the
current greatest rule number is 65534, however, the system will display an error
message and you need to specify a number for the rule.
z
The content of a modified or created rule cannot be identical with the content of
any existing rules; otherwise the rule modification or creation will fail, and the
system prompts that the rule already exists.
z
If the ACL is created with the
auto
keyword specified, the newly created rules will
be inserted in the existent ones by depth-first principle, but the numbers of the
existent rules are unaltered.
Examples
# Create advanced ACL 3000 and define rule 1 to deny packets with the source IP
address of 192.168.0.1 and DSCP priority of 46.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] acl number 3000
