3Com Switch 4200G Configuration Guide

204 CHAPTER 26: ACL CONFIGURATION
Configuration Procedure
In the case that you specify the rule ID when defining a rule:
■ If the rule corresponding to the specified rule ID already exists, you will edit the
rule, and the modified part in the rule will replace the original content, while other
parts remain unchanged.
■ If the rule corresponding to the specified rule ID does not exists, you will create
and define a new rule.
■ The content of a modified or created rule must not be identical with the content
of any existing rule; otherwise the rule modification or creation will fail, and the
system will prompt that the rule already exists.
If you do not specify a rule ID, you will create and define a new rule, and the system
will assign an ID for the rule automatically.
Configuration Example Configure ACL 2000 to deny packets whose source IP address is 1.1.1.1.
<S4200G> system-view
[4200G] acl number 2000
[4200G-acl-basic-2000] rule deny source 1.1.1.1 0
[4200G-acl-basic-2000] display acl 2000
Basic ACL 2000, 1 rule
Acl's step is 1
rule 0 deny source 1.1.1.1 0 (0 times matched)
Defining Advanced
ACLs
Advanced ACLs define classification rules according to the source and destination IP
addresses of packets, the type of protocol over IP, and protocol-specific features such
as TCP/UDP source and destination ports, TCP flag bit, ICMP protocol type, code, and
so on.
The value range for advanced ACL numbers is 3,000 to 3,999.
Advanced ACLs support analysis and processing of three packet priority levels: type of
service (ToS) priority, IP priority and differentiated services codepoint Priority (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate, more
abundant, and more flexible than those defined with basic ACLs.
Table 173 Define a basic ACL rule
Operation Command Description
Enter system view system-view -
Enter basic ACL view acl number acl-number [ match-order
{ config | auto }]
By the default, the match
order is config
Define an rule rule [ rule-id ] { permit | deny } [
fragment ] [ source { sour-addr
sour-wildcard | any }] [ time-range
time-name ]
Required
Define the description
information of the
ACL
description text Optional
Display ACL
information
display acl { all | acl-number } Optional
The display command can be
executed in any view