Configuration example, Configuring ipv6 acl – H3C Technologies H3C S3600 Series Switches User Manual

Page 716

1-11

When configuring a rule that matches specific fields of packets, take the following two

items into account:

If VLAN-VPN is not enabled, each packet in the switch carries one VLAN tag, which is

4 bytes long.

If VLAN-VPN is enabled on a port, each packet in the switch carries two VLAN tags,

which is 8 bytes long.

Note that:

You can modify any existent rule of a user-defined ACL. If you modify only the time

range and/or action, the unmodified parts of the rule remain the same. If you modify the

rule-string rule-mask offset combinations, however, the new combinations will replace

all of the original ones.

If you do not specify the rule-id argument when creating an ACL rule, the rule will be

numbered automatically. If the ACL has no rules, the rule is numbered 0; otherwise, the

number of the rule will be the greatest rule number plus one. If the current greatest rule

number is 65534, however, the system will tell you that the rule cannot be created and

you need to specify a number for the rule.

The content of a modified or created rule cannot be identical with the content of any

existing rules; otherwise the rule modification or creation will fail, and the system

prompts that the rule already exists.

Configuration example

# Configure ACL 5000 to deny all TCP packets, provided that VLAN-VPN is not enabled on

any port. In the ACL rule, 06 is the TCP protocol number, ff is the mask of the rule, and 27

is the protocol field offset of an internally processed IP packet.

system-view

[Sysname] acl number 5000

[Sysname-acl-user-5000] rule deny 06 ff 27

# Display the configuration information of ACL 5000.

[Sysname-acl-user-5000] display acl 5000

User defined ACL 5000, 1 rule

Acl's step is 1

rule 0 deny 06 ff 27

Configuring IPv6 ACL

You can match IPv6 packets by IPv6 ACLs to process IPv6 data flows as required. The

number of an IPv6 ACL is in the range from 5000 to 5999.

S3600-SI Series Ethernet switches support matching the following fields:

cos: Matches the CoS field in IPv6 packets.

This manual is related to the following products: