H3C Technologies H3C SecBlade LB Cards - Manual (Page 46)

35
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
system-view
[LB] time-range work 8:0 to 18:0 working-day
# Create an IPv6 advanced ACL numbered 3000 and configure three rules in the ACL. One rule permits
access from the President's office to the database server, one rule permits access from the Financial
department to the database server during working hours, and one rule denies access from other
departments to the database server.
[LB] acl ipv6 number 3000
[LB-acl6-adv-3000] rule permit ipv6 source 1001:: 16 destination 1000::100 128
[LB-acl6-adv-3000] rule permit ipv6 source 1002:: 16 destination 1000::100 128 time-range
work
[LB-acl6-adv-3000] rule deny ipv6 source any destination 1000::100 128
[LB-acl6-adv-3000] quit
# Enable IPv6 firewall, and apply IPv6 advanced ACL 3000 to filter outgoing packets on interface
GigabitEthernet 0/1.
[LB] firewall ipv6 enable
[LB] interface gigabitethernet 0/1
[LB-GigabitEthernet0/1] firewall packet-filter ipv6 3000 outbound
[LB-GigabitEthernet0/1] quit
Verifying the configuration
# Ping the database server from a PC in the Financial department during working hours. (All PCs in this
example use Windows XP.)
C:\> ping 1000::100
Pinging 1000::100 with 32 bytes of data:
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Ping statistics for 1000::100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
The output shows that the database server can be pinged.
# Ping the database server from a PC in the Marketing department during working hours.
C:\> ping 1000::100
Pinging 1000::100 with 32 bytes of data:
Destination net unreachable.
Destination net unreachable.
Destination net unreachable.