H3C Technologies H3C S3100 Series Switches - Manual (Page 381)

Operation Manual – ACL
H3C S3100-52P Ethernet Switch Chapter 1 ACL Configuration
1-5
When you define an ACL rule using the rule command with the rule-id argument
provided,
z
If the ACL rule identified by the rule-id argument already exists, the settings
specified in the rule command overwrite the corresponding settings of the existing
rule. And the existing settings remain unchanged if the corresponding settings are
not specified in the command.
z
If the ACL rule identified by the rule-id argument does not exist, you will create a
new rule.
z
The content of a modified or created rule cannot be identical with the content of
any existing rules; otherwise the rule modification or creation will fail, and the
system prompts that the rule already exists.
If you do not specify the rule-id argument when creating an ACL rule, the rule will be
numbered automatically.
1.3.3 Configuration Example
# Configure ACL 2000 to deny packets whose source IP addresses are 1.1.1.1.
system-view
[H3C] acl number 2000
[H3C-acl-basic-2000] rule deny source 1.1.1.1 0
[H3C-acl-basic-2000] display acl 2000
Basic ACL 2000, 1 rule
Acl's step is 1
rule 0 deny source 1.1.1.1 0
1.4 Advanced ACL Configuration
An advanced ACL can filter packets by their source and destination IP addresses, the
protocols carried by IP. The rules in an advanced ACL rule can based on
protocol-specific features such as TCP/UDP source and destination ports, TCP flag bit,
ICMP protocol type, code, and so on.
An advanced ACL can be numbered from 3000 to 3999.
Advanced ACLs support analysis and processing of three packet priority levels: type of
service (ToS) priority, IP priority and differentiated services codepoint priority (DSCP).
Using advanced ACLs, you can define classification rules that are more accurate, more
abundant, and more flexible than those defined for basic ACLs.
1.4.1 Configuration Preparation
To configure an time range-based advanced ACL rule, you need to create the
corresponding time ranges first. For information about of time range configuration, refer
to section 1.2 “Time Range Configuration”.