H3C Technologies H3C WX3000 Series Unified Switches - Manual (Page 334)

36-5
Configuring Basic ACL
A basic ACL filters packets based on their source IP addresses.
A basic ACL can be numbered from 2000 to 2999.
Configuration Prerequisites
z
To configure a time range-based basic ACL rule, you need to create the corresponding time range
first. For information about time range configuration, refer to
Configuring Time Range .
z
The source IP addresses based on which the ACL filters packets are determined.
Configuration Procedure
Follow these steps to define a basic ACL rule:
To do… Use the command… Remarks
Enter system view system-view —
Create an ACL and
enter basic ACL view acl number acl-number [ match-order { auto |
config } ]
Required
config by default
Define an ACL rule rule [ rule-id ] { deny | permit } [ rule-string ]
Required
For information about rule-string,
refer to ACL in H3C WX3000
Series Unified Switches
Switching Engine Command
Reference
.
Configure a description
string to the ACL
description text
Optional
Not configured by default
Note that:
z
With the config match order specified for the basic ACL, you can modify any existent rule. The
unmodified part of the rule remains. With the auto match order specified for the basic ACL, you
cannot modify any existent rule; otherwise the system prompts error information.
z
If you do not specify the rule-id argument when creating an ACL rule, the rule will be numbered
automatically. If the ACL has no rules, the rule is numbered 0; otherwise, it is the maximum rule
number plus one.
z
The content of a modified or created rule cannot be identical with the content of any existing rule;
otherwise the rule modification or creation will fail, and the system prompts that the rule already
exists.
z
With the auto match order specified, the newly created rules will be inserted in the existent ones by
depth-first principle, but the numbers of the existent rules are unaltered.
Configuration Example
# Configure ACL 2000 to deny packets whose source IP addresses are 192.168.0.1.
<device> system-view
[device] acl number 2000
[device-acl-basic-2000] rule deny source 192.168.0.1 0
# Display the configuration information of ACL 2000.
[device-acl-basic-2000] display acl 2000
Basic ACL 2000, 1 rule
Acl's step is 1
rule 0 deny source 192.168.0.1 0