Filter
Top Products
1-8
To do... Use the command... Remarks
Define an ACL rule
rule [ rule-id ] { permit | deny }
rule-string
Required
For information about
rule-string, refer to ACL
Commands.
Assign a description string to
the ACL rule
rule rule-id comment text
Optional
No description by default
Assign a description string to
the ACL
description text
Optional
No description by default
Note that:
z You can modify any existent rule of the Layer2 ACL and the unmodified part of the ACL remains.
z If you do not specify the rule-id argument when creating an ACL rule, the rule will be numbered
automatically. If the ACL has no rules, the rule is numbered 0; otherwise, the number of the rule will
be the greatest rule number plus one. If the current greatest rule number is 65534, however, the
system will display an error message and you need to specify a number for the rule.
z The content of a modified or created rule cannot be identical with the content of any existing rules;
otherwise the rule modification or creation will fail, and the system prompts that the rule already
exists.
Configuration example
# Configure ACL 4000 to deny packets sourced from the MAC address 000d-88f5-97ed, destined for
the MAC address 0011-4301-991e, and with their 802.1p priority being 3.
<Sysname> system-view
[Sysname] acl number 4000
[Sysname-acl-ethernetframe-4000] rule deny cos 3 source 000d-88f5-97ed ffff-ffff-ffff dest
0011-4301-991e ffff-ffff-ffff
# Display the configuration information of ACL 4000.
[Sysname-acl-ethernetframe-4000] display acl 4000
Ethernet frame ACL 4000, 1 rule
Acl's step is 1
rule 0 deny cos excellent-effort source 000d-88f5-97ed ffff-ffff-ffff dest 0011-4301-991e
ffff-ffff-ffff
Configuring User-defined ACL
A user-defined ACL filters packets by comparing specific bytes in packet headers with specified string.
A user-defined ACL can be numbered from 5000 to 5999.
Configuration prerequisites
To configure a time range-based user-defined ACL rule, you need to define the corresponding time
ranges first. For information about time range configuration, refer to
Configuring Time Range.
Configuration procedure
Follow these steps to define a user-defined ACL rule: