H3C Technologies H3C S3600 Series Switches - Manual (Page 714)

1-9
A Layer 2 ACL can be numbered from 4000 to 4999.
Configuration prerequisites
z To configure a time range-based Layer 2 ACL rule, you need to create the
corresponding time ranges first. For information about time range configuration, refer
to Configuring Time Range .
z The settings to be specified in the rule, such as source and destination MAC addresses,
VLAN priorities, and Layer 2 protocol types, are determined.
Configuration procedure
Follow these steps to define a Layer 2 ACL rule:
To do... Use the command... Remarks
Enter system view system-view —
Create a Layer 2 ACL and
enter layer 2 ACL view
acl number acl-number Required
Define an ACL rule
rule [ rule-id ] { permit |
deny } rule-string
Required
For information about
rule-string, refer to ACL
Commands.
Assign a description string
to the ACL rule
rule rule-id comment text
Optional
No description by default
Assign a description string
to the ACL
description text
Optional
No description by default
Note that:
z You can modify any existent rule of the Layer2 ACL and the unmodified part of the ACL
remains.
z If you do not specify the rule-id argument when creating an ACL rule, the rule will be
numbered automatically. If the ACL has no rules, the rule is numbered 0; otherwise, the
number of the rule will be the greatest rule number plus one. If the current greatest rule
number is 65534, however, the system will tell you that the rule cannot be created and
you need to specify a number for the rule.
z The content of a modified or created rule cannot be identical with the content of any
existing rules; otherwise the rule modification or creation will fail, and the system
prompts that the rule already exists.
Configuration example
# Configure ACL 4000 to deny packets sourced from the MAC address 000d-88f5-97ed,
destined for the MAC address 0011-4301-991e, and with their 802.1p priority being 3.
system-view
[Sysname] acl number 4000