H3C Technologies H3C S3600 Series Switches - Manual (Page 713)

1-8
To do... Use the command... Remarks
Assign a description string
to the ACL rule
rule rule-id comment text
Optional
No description by default
Assign a description string
to the ACL
description text
Optional
No description by default
Note that:
z With the config match order specified for the advanced ACL, you can modify any
existent rule. The unmodified part of the rule remains. With the auto match order
specified for the ACL, you cannot modify any existent rule; otherwise the system will
tell you that the rule cannot be modified.
z If you do not specify the rule-id argument when creating an ACL rule, the rule will be
numbered automatically. If the ACL has no rules, the rule is numbered 0; otherwise, the
number of the rule will be the greatest rule number plus one. If the current greatest rule
number is 65534, however, the system will tell you that the rule cannot be created and
you need to specify a number for the rule.
z The content of a modified or created rule cannot be identical with the content of any
existing rules; otherwise the rule modification or creation will fail, and the system
prompts that the rule already exists.
z If the ACL is created with the auto keyword specified, the newly created rules will be
inserted in the existent ones by depth-first principle, but the numbers of the existent
rules are unaltered.
Configuration example
# Configure ACL 3000 to permit the TCP packets sourced from the network 129.9.0.0/16
and destined for the network 202.38.160.0/24 and with the destination port number being
80.
system-view
[Sysname] acl number 3000
[Sysname-acl-adv-3000] rule permit tcp source 129.9.0.0 0.0.255.255 destinatio n
202.38.160.0 0.0.0.255 destination-port eq 80
# Display the configuration information of ACL 3000.
[Sysname-acl-adv-3000] display acl 3000
Advanced ACL 3000, 1 rule
Acl's step is 1
rule 0 permit tcp source 129.9.0.0 0.0.255.255 destination 202.38.160.0 0.0.0.255
destination-port eq www
Configuring Layer 2 ACL
Layer 2 ACLs filter packets according to their Layer 2 information, such as the source and
destination MAC addresses, VLAN priority, and Layer 2 protocol types.