H3C Technologies H3C S3600 Series Switches - Manual (Page 711)

1-6
From 15:00 Jan/28/2006 to 15:00 Jan/28/2008
Configuring Basic ACL
A basic ACL filters packets based on their source IP addresses.
A basic ACL can be numbered from 2000 to 2999.
Configuration prerequisites
z To configure a time range-based basic ACL rule, you need to create the corresponding
time range first. For information about time range configuration, refer to Configuring
Time Range .
z The source IP addresses based on which the ACL filters packets are determined.
Configuration procedure
Follow these steps to define a basic ACL rule:
To do... Use the command... Remarks
Enter system view system-view —
Create an ACL and enter
basic ACL view
acl number acl-number
[ match-order { auto |
config } ]
Required
config by default
Define an ACL rule
rule [ rule-id ] { deny |
permit } [ rule-string ]
Required
For information about
rule-string, refer to ACL
Command.
Configure a description
string to the ACL
description text
Optional
Not configured by default
Note that:
z With the config match order specified for the basic ACL, you can modify any existent
rule. The unmodified part of the rule remains. With the auto match order specified for
the basic ACL, you cannot modify any existent rule; otherwise the system will tell you
that the rule cannot be modified.
z If you do not specify the rule-id argument when creating an ACL rule, the rule will be
numbered automatically. If the ACL has no rules, the rule is numbered 0; otherwise, the
number of the rule will be the greatest rule number plus one. If the current greatest rule
number is 65534, however, the system will tell you that the rule cannot be created and
you need to specify a number for the rule.
z The content of a modified or created rule cannot be identical with the content of any
existing rule; otherwise the rule modification or creation will fail, and the system
prompts that the rule already exists.
z With the auto match order specified, the newly created rules will be inserted in the
existent ones by depth-first principle, but the numbers of the existent rules are
unaltered.