Field	Description
Current time	Current system time
Time-range	The configuration and state of time range, such as time range name, its activated state, and start time and ending time.

1.1.2 time-range

Syntax

time-range time-name { start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] | from time1 date1 [ to time2 date2 ] | to time2 date2 }

undo time-range time-name [ start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] | from time1 date1 [ to time2 date2 ] | to time2 date2 ]

View

System view

Default Level

2: System level

Parameters

time-name: Time range name comprising 1 to 32 characters. It is case insensitive and must start with an English letter. To avoid confusion, this name cannot be all.

start-time: Start time of a periodic time range, in hh:mm format as 24-hour time, where hh is hours and mm is minutes. Its value ranges from 00:00 to 23:59.

end-time: End time of the periodic time range, in hh:mm format as 24-hour time, where hh is hours and mm is minutes. Its value ranges from 00:00 to 24:00. The end time must be greater than the start time.

days: Indicates on which day or days of the week the periodic time range is valid. You may specify multiple values, in words or in digits, separated by spaces, for this argument, but make sure that they do not overlap. These values can take one of the following forms:

l A digit in the range 0 to 6, respectively for Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, and Saturday.

l Week in words, that is, Mon, Tue, Wed, Thu, Fri, Sat, or Sun.

l working-day for Monday through Friday.

l off-day for Saturday and Sunday.

l daily for seven days of a week.

from time1 date1: Indicates the start time and date of an absolute time range. The time1 argument specifies the time of the day in hh:mm format as 24-hour time, where hh is hours and mm is minutes. Its value ranges from 00:00 to 23:59. The date1 argument specifies a date in MM/DD/YYYY or YYYY/MM/DD format, where MM is the month of the year in the range 1 to 12, DD is the day of the month in the range 1 to 31, and YYYY is the year in the usual Gregorian calendar in the range 1970 to 2100. If not specified, the start time is the earliest time available from the system, namely, 01/01/1970 00:00:00 AM.

to time2 date2: Indicates the end time and date of the absolute time range. The format of the time2 argument is the same as that of the time1 argument, but its value ranges from 00:00 to 24:00. The end time must be greater than the start time. If not specified, the end time is the maximum time available from the system, namely, 12/31/2100 24:00:00 PM. The format and value range of the date2 argument are the same as those of the date1 argument.

Description

Use the time-range command to create a time range.

Use the undo time-range command to remove a time range.

You may create a maximum of 256 time ranges.

A time range can be one of the following:

l Periodic time range created using the time-range time-name start-time to end-time days command. A time range thus created recurs periodically on the day or days of the week.

l Absolute time range created using the time-range time-name { from time1 date1 [ to time2 date2 ] | to time2 date2 } command. Unlike a periodic time range, a time range thus created does not recur.

l Compound time range created using the time-range time-name start-time to end-time days { from time1 date1 [ to time2 date2 ] | to time2 date2 } command. A time range thus created recurs on the day or days of the week only within the specified period. For example, to create a time range that is active from 12:00 to 14:00 on Wednesdays between January 1, 2004 00:00 and December 31, 2004 23:59, you may use the time-range test 12:00 to 14:00 wednesday from 00:00 01/01/2004 to 23:59 12/31/2004 command.

l By default, up to 256 time ranges are available.

You may create individual time ranges identified with the same name. They are regarded as one time range whose active period is the result of ORing periodic ones, ORing absolute ones, and ANDing periodic and absolute ones.

Examples

# Create an absolute time range named test, setting it to become active from 00:00 on January 1, 2003.

<Sysname> system-view

[Sysname] time-range test from 0:0 2003/1/1

# Create a compound time range named test, setting it to be active between 8:00 to 18:00 during working days.

<Sysname> system-view

[Sysname] time-range test 8:00 to 18:00 working-day

# Create a periodic time range named test, setting it to be active between 14:00 and 18:00 on Saturday and Sunday.

<Sysname> system-view

[Sysname] time-range test 14:00 to 18:00 off-day

1.2 IPv4 ACL Configuration Commands

1.2.1 acl

Syntax

acl number acl-number [ match-order { auto | config } ]

undo acl { all | number acl-number }

View

System view

Default Level

2: System level

Parameters

number: Defines a numbered access control list (ACL).

acl-number: IPv4 ACL number in the range 2000 to 5999, where:

l 2000 to 2999 for basic IPv4 ACLs

l 3000 to 3999 for advanced IPv4 ACLs

l 4000 to 4999 for Ethernet frame header ACLs

l 5000 to 5999 for user-defined ACLs

match-order: Sets the order in which ACL rules are matched. This keyword is not available for user-defined IPv4 ACLs.

l auto: Performs depth-first match.

l config: Performs matching against rules in the order in which they are configured.

all: All IPv4 ACLs.

Description

Use the acl command to enter IPv4 ACL view. If the ACL does not exist, it is created first.

Use the undo acl command to remove a specified or all IPv4 ACLs.

By default, the match order is config.

Note that:

l The match order for user-defined ACLs can only be config.

l You can also use this command to modify the match order of an existing IPv4 ACL but only when it is empty.

Examples

# Create IPv4 ACL 2000.

<Sysname> system-view

[Sysname] acl number 2000

[Sysname-acl-basic-2000]

1.2.2 description (for IPv4)

Syntax

description text

undo description

View

Basic IPv4 ACL view, advanced IPv4 ACL view, Ethernet frame header ACL view, user-defined ACL view

Default Level

2: System level

Parameters

text: ACL description, a case-sensitive string of 1 to 127 characters.

Description

Use the description command to create an IPv4 ACL description to describe the purpose of the ACL for example.

Use the undo description command to remove the ACL description.

By default, an IPv4 ACL has no description.

Examples

# Define the description of IPv4 ACL 2000.

<Sysname> system-view

[Sysname] acl number 2000

[Sysname-acl-basic-2000] description This acl is used in eth 0

# Define the description of IPv4 ACL 3000.

<Sysname> system-view

[Sysname] acl number 3000

[Sysname-acl-adv-3000] description This acl is used in eth 0

# Define the description of IPv4 ACL 4000.

<Sysname> system-view

[Sysname] acl number 4000

[Sysname-acl-ethernetframe-4000] description This acl is used in eth 0

# Define the description of IPv4 ACL 5000.

<Sysname> system-view

[Sysname] acl number 5000

[Sysname-acl-user-5000] description This acl is used in eth 0

1.2.3 display acl

Syntax

display acl { acl-number | all }

View

Any view

Default Level

1: Monitor level

Parameters

acl-number: IPv4 ACL number in the range 2000 to 5999, where:

l 2000 to 2999 for basic IPv4 ACLs

l 3000 to 3999 for advanced IPv4 ACLs

l 4000 to 4999 for Ethernet frame header ACLs

l 5000 to 5999 for user-defined ACLs

all: All IPv4 ACLs.

Description

Use the display acl command to display information about the specified or all IPv4 ACLs.

This command displays ACL rules in the order in which the system compares a packet against them.

Examples

# Display information about ACL 2001.

<Sysname> display acl 2001

Basic ACL 2001, named flow, 1 rules,

this is first

ACL's step is 5

rule 22 permit fragment time-range aaa

rule 22 comment THIS RULE IS USED IN VLAN2(Inactive)

Table 1-2 Description on the fields of the display acl command

Field	Description
Basic ACL 2001	The displayed information is about the basic IPv4 ACL 2001.
1 rules	The ACL contains one rule.
this is first	Description of the IPv4 ACL
ACL’s step is 5	The rules in this ACL are numbered in the step of 5.
rule xx	Configuration information of IPv4 ACL XX
rule xx comment	Description of IPv4 ACL XX
Active/Inactive	Indicates whether the ACL is active

1.2.4 reset acl counter

Syntax

reset acl counter { acl-number | all }

View

User view

Default Level

2: System level

Parameters

acl-number: IPv4 ACL number in the range 2000 to 4999, where:

l 2000 to 2999 for basic IPv4 ACLs

l 3000 to 3999 for advanced IPv4 ACLs

l 4000 to 4999 for Ethernet frame header ACLs

all: All IPv4 ACLs with ACL numbers falling in the range 2000 to 4999.

Description

Use the reset acl counter command to clear statistics about specified or all IPv4 ACLs except for user-defined ACLs.

Examples

# Clear statistics about IPv4 ACL 2001.

<Sysname> reset acl counter 2001

1.2.5 rule (in basic ACL view)

Syntax

rule [ rule-id ] { deny | permit } [ fragment | logging | source { sour-addr sour-wildcard | any } | time-range time-name | vpn-instance vpn-instance-name ] *

undo rule rule-id [ fragment | logging | source | time-range | vpn-instance ] *

View

Basic ACL view

Default Level

2: System level

Parameters

rule-id: ACL rule number in the range 0 to 65534.

deny: Defines a deny statement to drop matched packets.

permit: Defines a permit statement to allow matched packets to pass.

fragment: Indicates that the rule applies only to non-first fragments. Without this keyword, the rule applies to both fragments and non-fragments

logging: Specifies to log matched packets.

source { sour-addr sour-wildcard | any }: Specifies a source address. The sour-addr sour-wildcard argument specifies a source IP address in dotted decimal notation. Setting the wildcard to a zero indicates a host address. The any keyword indicates any source IP address.

time-range time-name: Specifies the time range in which the rule takes effect. If the specified time range does not exist, the rule will not take effect.

vpn-instance vpn-instance-name: Specifies a VPN instance. The vpn-instance-name argument is a case-insensitive string of 1 to 31 characters.

Description

Use the rule command to create an IPv4 ACL rule or modify the rule if it has existed.

Use the undo rule command to remove an IPv4 ACL rule or parameters from the rule.

With the undo rule command, if no optional parameters are specified, the entire ACL rule is removed; otherwise, only the involved information is removed.

Note that:

l You will fail to create or modify a rule if its permit/deny statement is exactly the same as another rule. In addition, if the ACL match order is set to auto rather than config, you cannot modify ACL rules.

l You may use the display acl command to verify rules configured in an ACL. If the match order for this ACL is auto, rules are displayed in the depth-first match order rather than by rule number.

Examples

# Create a rule to deny packets with the source IP address 1.1.1.1.

<Sysname> system-view

[Sysname] acl number 2000

[Sysname-acl-basic-2000] rule deny source 1.1.1.1 0

1.2.6 rule (in advanced ACL view)

Syntax

rule [ rule-id ] { deny | permit } protocol [ destination { dest-addr dest-wildcard | any } | destination-port operator port1 [ port2 ] | dscp dscp | established | fragment | icmp-type { icmp-type icmp-code | icmp-message } | logging | precedence precedence | reflective | source { sour-addr sour-wildcard | any } | source-port operator port1 [ port2 ] | time-range time-name | tos tos | vpn-instance vpn-instance-name ] *

View

Advanced ACL view

Default Level

2: System level

Parameters

rule-id: ACL rule number in the range 0 to 65534.

deny: Defines a deny statement to drop matched packets.

permit: Defines a permit statement to allow matched packets to pass.

protocol: Protocol carried by IP. It can be a number in the range 0 to 255, or in words, gre (47), icmp (1), igmp (2), ip, ipinip (4), ospf (89), tcp (6), udp (17).

Table 1-3 Parameters for advanced IPv4 ACL rules

Parameter	Function	Description
source { sour-addr sour-wildcard \| any }	Specifies a source address.	The sour-addr sour-wildcard argument specifies a source IP address in dotted decimal notation. Setting the wildcard to a zero indicates a host address. The any keyword indicates any source IP address.
destination { dest-addr dest-wildcard \| any }	Specifies a destination address.	The dest-addr dest-wildcard argument specifies a destination IP address in dotted decimal notation. Setting the dest-wildcard to a zero indicates a host address. The any keyword indicates any destination IP address.
precedence precedence	Specifies an IP precedence value.	The precedence argument can be a number in the range 0 to 7, or in words, routine, priority, immediate, flash, flash-override, critical, internet, or network.
tos tos	Specifies a ToS preference.	The tos argument can be a number in the range 0 to 15, or in words, max-reliability (2), max-throughput (4), min-delay (8), min-monetary-cost (1), or normal (0).
dscp dscp	Specifies a DSCP priority.	The dscp argument can be a number in the range 0 to 63, or in words, af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, cs1, cs2, cs3, cs4, cs5, cs6, cs7, default, or ef.
logging	Specifies to log matched packets.	This function requires that the module using the ACL supports logging.
reflective	Specifies the rule to be reflective.	A rule with the reflective keyword can be defined only for TCP, UDP, or ICMP packets and its statement can only be permit.
vpn-instance vpn-instance-name	Specifies a VPN instance.	The vpn-instance-name argument is a case-insensitive string of 1 to 31 characters.
fragment	Indicates that the rule applies only to non-first fragments.	With this keyword not provided, the rule is effective to both non-fragments and fragments.
time-range time-name	Specifies the time range in which the rule can take effect.	If the specified time range does not exist, the rule will not take effect.

If the protocol argument is set to tcp or udp, you may define the parameters in the following table.

Table 1-4 TCP/UDP-specific parameters for advanced IPv4 ACL rules

Parameter	Function	Description
source-port operator port1 [ port2 ]	Defines a UDP or TCP source port against which UDP or TCP packets are matched.	The operator argument can be lt (lower than), gt (greater than), eq (equal to), neq (not equal to), and range (inclusive range). port1, port2: TCP or UDP port number, represented by a number in the range 0 to 65535. TCP port number can be represented in words as follows: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), or www (80). UDP port number can be represented in words as follows: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), xdmcp (177).
destination-port operator port1 [ port2 ]	Defines a UDP or TCP destination port against which UDP or TCP packets are matched.
established	Defines the rule for TCP connection packets.	A keyword specific to TCP. With this keyword, the rule matches TCP connection packets with the ACK or RST flag.

If the protocol argument is set to icmp, you may define the parameters in the following table.

Table 1-5 Parameters for advanced IPv4 ACL rules

Parameter	Function	Description
icmp-type { icmp-type icmp-code \| icmp-message }	Specifies the ICMP message type and code.	The icmp-type argument ranges from 0 to 255. The icmp-code argument ranges from 0 to 255. The icmp-message argument specifies a message name.

Parameter

Function

Description

icmp-type { icmp-type icmp-code | icmp-message }

Specifies the ICMP message type and code.

The icmp-type argument ranges from 0 to 255.

The icmp-code argument ranges from 0 to 255.

The icmp-message argument specifies a message name.

The following table provides the ICMP messages that you can specify in advanced IPv4 ACL rules.

Table 1-6 ICMP messages and their codes

ICMP message	Type	Code
echo	8	0
echo-reply	0	0
fragmentneed-DFset	3	4
host-redirect	5	1
host-tos-redirect	5	3
host-unreachable	3	1
information-reply	16	0
information-request	15	0
net-redirect	5	0
net-tos-redirect	5	2
net-unreachable	3	0
parameter-problem	12	0
port-unreachable	3	3
protocol-unreachable	3	2
reassembly-timeout	11	1
source-quench	4	0
source-route-failed	3	5
timestamp-reply	14	0
timestamp-request	13	0
ttl-exceeded	11	0

Description

Use the rule command to define or modify an advanced IPv4 ACL rule. If the rule does not exist, it is created first.

Use the undo rule command to remove an ACL rule or parameters from the rule.

With the undo rule command, if no optional parameters are specified, the entire ACL rule is removed; otherwise, only the involved information is removed.

Note that:

l You may use the display acl command to verify rules configured in an ACL. If the match order for this ACL is auto, rules are displayed in the depth-first order rather than by rule number.

Examples

# Define a rule to permit the TCP packets to pass with the destination port 80 sent from 129.9.0.0 to 202.38.160.0.

<Sysname> system-view

[Sysname] acl number 3101

[Sysname-acl-adv-3101] rule permit tcp source 129.9.0.0 0.0.255.255 destination 202.38.160.0 0.0.0.255 destination-port eq 80

1.2.7 rule (in Ethernet frame header ACL view)

Syntax

rule [ rule-id ] { deny | permit } [ cos vlan-pri | dest-mac dest-addr dest-mask | lsap lsap-code lsap-wildcard | source-mac sour-addr source-mask | time-range time-name | type type-code type-wildcard ] *

undo rule rule-id

View

Ethernet frame header ACL view

Default Level

2: System level

Parameters

rule-id: ACL rule number in the range 0 to 65534.

deny: Defines a deny statement to drop matched packets.

permit: Defines a permit statement to allow matched packets to pass.

cos vlan-pri: Defines a 802.1p priority. The vlan-pri argument takes a value in the range 0 to 7; or its equivalent in words, best-effort, background, spare, excellent-effort, controlled-load, video, voice, or network-management.

dest-mac dest-addr dest-mask: Specifies a destination MAC address range. The dest-addr and dest-mask arguments indicate a destination MAC address and mask in xxxx-xxxx-xxxx format.

lsap lsap-code lsap-wildcard: Defines the DSAP and SSAP fields in the LLC encapsulation. The lsap-code argument is a 16-bit hexadecimal number indicating frame encapsulation. The lsap-wildcard argument is a 16-bit hexadecimal number indicating the wildcard of the LSAP code.

source-mac sour-addr source-mask: Specifies a source MAC address range. The sour-addr and sour-mask arguments indicate a source MAC address and mask in xxxx-xxxx-xxxx format.

time-range time-name: Specifies the time range in which the rule can take effect. If the specified time range does not exist, the rule will not take effect.

type type-code type-wildcard: Defines a link layer protocol. The type-code argument is a 16-bit hexadecimal number indicating frame type. It is corresponding to the type-code field in Ethernet_II and Ethernet_SNAP frames. The type-wildcard argument is a 16-bit hexadecimal number indicating the wildcard.

Description

Use the rule command to create an Ethernet frame header ACL rule or modify the rule if it has existed.

Use the undo rule command to remove an Ethernet frame header ACL rule.

Note that:

l You may use the display acl command to verify rules configured in an ACL. If the match order for this ACL is auto, rules are displayed in the depth-first order rather than by rule number.

Caution:

l When you define an Ethernet frame header ACL, do not set the type-code argument to 0x0800, 0x86DD, 0x8847, 0x8848, or 0x8100.

l For the default flow template to be used, the destination mask corresponding to the type keyword must be 0xFFFF.

Examples

# Create a rule to deny packets with the 802.1p priority of 3.

<Sysname> system-view

[Sysname] acl number 4000

[Sysname-acl-ethernetframe-4000] rule deny cos 3

1.2.8 rule (in user-defined ACL view)

Syntax

rule [ rule-id ] { deny | permit } [ { { ipv4 | ipv6 | l2 | l4 | l5 } rule-string rule-mask offset }&<1-8> ] [ time-range time-name ]

undo rule rule-id

View

User-defined ACL view

Default Level

2: System level

Parameters

rule-id: ACL rule number in the range 0 to 65534.

deny: Defines a deny statement to drop matched packets.

permit: Defines a permit statement to allow matched packets to pass.

ipv4: Sets the offset from the beginning of the IPv4 header.

ipv6: Sets the offset from the beginning of the IPv6 header.

l2: Sets the offset from the beginning of the Layer 2 frame header.

l4: Sets the offset from the beginning of the Layer 4 header.

l5: Sets the offset from the beginning of the Layer 5 header.

rule-string: Defines a match pattern in hexadecimal format. Its length must be a multiple of two.

rule-mask: Defines a match pattern mask in hexadecimal format. Its length must be the same as that of the match pattern.

offset: The offset in bytes at which the match operation begins.

&<1-8>: Indicates that up to eight match patterns can be defined in the rule.

time-range time-name: Specifies the time range in which the rule can take effect. If the specified time range does not exist, the rule will not take effect.

Description

Use the rule command to create a user-defined IPv4 ACL rule.

Use the undo rule command to remove a user-defined IPv4 ACL rule.

Note that you will fail to create a user-defined ACL rule if its permit/deny statement is exactly the same as another rule.

Examples

# Create user-defined ACL 5500, permitting any packet with the 13th and 14th bytes starting from the Layer 2 header being 0x0806 (that is, ARP packets).

<Sysname> system-view

[Sysname] acl number 5500

[Sysname-acl-user-5500] rule 0 permit l2 0806 ffff 12

1.2.9 rule comment (for IPv4)

Syntax

rule rule-id comment text

undo rule rule-id comment

View

Basic IPv4 ACL view, advanced IPv4 ACL view, Ethernet frame header ACL view, user-defined ACL view

Default Level

2: System level

Parameters

rule-id: IPv4 ACL rule number in the range 0 to 65534.

text: IPv4 ACL rule description, a case-sensitive string of 1 to 127 characters.

Description

Use the rule comment command to create or modify an ACL rule description, for example to describe the purpose of the ACL rule or the parameters it contains.

You will fail to do that if the specified rule does not exist.

Use the undo rule comment command to remove the ACL rule description.

By default, no rule description is created.

Examples

# Create a rule in ACL 2000 and define the rule description.

<Sysname> system-view

[Sysname] acl number 2000

[Sysname-acl-basic-2000] rule 0 deny source 1.1.1.1 0

[Sysname-acl-basic-2000] rule 0 comment This rule is used in eth 1

# Create a rule in ACL 3000 and define the rule description.

<Sysname> system-view

[Sysname] acl number 3000

[Sysname-acl-adv-3000] rule 0 permit ip source 1.1.1.1 0

[Sysname-acl-adv-3000] rule 0 comment This rule is used in eth 1

# Create a rule in ACL 4000 and define the rule description.

<Sysname> system-view

[Sysname] acl number 4000

[Sysname-acl-ethernetframe-4000] rule 0 deny cos 3

[Sysname-acl-ethernetframe-4000] rule 0 comment This rule is used in eth 1

# Create a rule in ACL 5000 and define the rule description.

<Sysname> system-view

[Sysname] acl number 5000

[Sysname-acl-user-5000] rule 0 permit l2 14 20 10

[Sysname-acl-user-5000] rule 0 comment This rule is used in eth 1

1.2.10 step (for IPv4)

Syntax

step step-value

undo step

View

Basic IPv4 ACL view, advanced IPv4 ACL view, Ethernet frame header ACL view

Default Level

2: System level

Parameters

step-value: IPv4 ACL rule numbering step, in the range 1 to 20.

Description

Use the step command to set a rule numbering step.

Use the undo step command to restore the default.

By default, rule numbering step is five.

When defining rules in an IPv4 ACL, you do not necessarily assign them numbers. The system can do this automatically in steps. For example, if the default step applies, rules you created are automatically numbered 0, 5, 10, 15, and so on. One benefit of rule numbering step is that it allows you to insert new rules between existing ones as needed. For example, after creating four rules numbered 0, 5, 10, 15 in an ACL configured with the step of five, you can still insert a rule numbered 1.

Any step change can result in renumbering. For example, after you change the step in the above example from five to two, the rules are renumbered 0, 2, 4, 6, and 8.

Note that even if the current step is the default, performing the undo step command can still result in rule renumbering. Suppose that ACL 3001 adopts the default numbering step and contains two rules numbered 0 and 5. After you insert rule 1 and rule 3, the rules are numbered 0, 1, 3, and 5. If you perform the undo step command, they will be renumbered 0, 5, 10, and 15.

Examples

# Set the rule numbering step to 2 for IPv4 ACL 3101.

<Sysname> system-view

[Sysname] acl number 3101

[Sysname-acl-basic-3101] step 2

1.3 IPv6 ACL Configuration Commands

1.3.1 acl ipv6

Syntax

acl ipv6 number acl6-number [ match-order { auto | config } ]

undo acl ipv6 { all | number acl6-number }

View

System view

Default Level

2: System level

Parameters

acl6-number: IPv6 ACL number. It is a value in one of the following ranges:

l 2000 to 2999 for basic IPv6 ACLs

l 3000 to 3999 for advanced IPv6 ACLs

match-order: Sets the order in which ACL rules are matched.

l auto: Performs depth-first match.

l config: Performs matching against rules in the order in which they are configured.

all: All IPv6 ACLs.

Description

Use the acl ipv6 command to enter IPv6 ACL view. If the ACL does not exist, it is created first.

Use the undo acl ipv6 command to remove a specified or all IPv6 ACLs.

By default, the match order is config.

You can also use this command to modify the match order of an existing IPv6 ACL but only when it is empty.

Examples

# Create ACL 2000.

<Sysname> system-view

[Sysname] acl ipv6 number 2000

[Sysname-acl6-basic-2000]

1.3.2 description (for IPv6)

Syntax

description text

undo description

View

Basic IPv6 ACL view, advanced IPv6 ACL view

Default Level

2: System level

Parameters

text: ACL description, a case-sensitive string of 1 to 127 characters.

Description

Use the description command to create an IPv6 ACL description, to describe the purpose of the ACL for example.

Use the undo description command to remove the IPv6 ACL description.

By default, an IPv6 ACL has no description.

Examples

# Create a description for IPv6 ACL 2000.

<Sysname> system-view

[Sysname] acl ipv6 number 2000

[Sysname-acl6-basic-2000] description This acl is used in vlan2

# Create a description for IPv6 ACL 3000.

<Sysname> system-view

[Sysname] acl ipv6 number 3000

[Sysname-acl6-adv-3000] description This acl is used in vlan2

1.3.3 display acl ipv6

Syntax

display acl ipv6 { acl6-number | all }

View

Any view

Default Level

1: Monitor level

Parameters

acl6-number: IPv6 ACL number. It is a value in one of the following ranges:

l 2000 to 2999 for basic IPv6 ACLs

l 3000 to 3999 for advanced IPv6 ACLs

all: All IPv6 ACLs.

Description

Use the display acl ipv6 command to display information about the specified or all IPv6 ACLs.

The output will be displayed in matching order.

Examples

# Display information about IPv6 ACL 2001.

<Sysname> display acl ipv6 2001

Basic IPv6 ACL 2001, 1 rule,

this is first

ACL's step is 5

rule 22 permit fragment time-range aaa

rule 22 comment This rule is used in vlan2(Active)

Table 1-7 Description on the fields of the display acl ipv6 command

Field	Description
Basic IPv6 ACL 2001	The displayed information is about the basic IPv6 ACL 2001.
1 rule	The ACL contains one rule.
this is first	Description of the IPv6 ACL
ACL's step is 5	The rules in this ACL are numbered in the step of 5.
rule xx	Configuration information of IPv6 ACL XX
rule xx comment	Description of IPv6 ACL XX
Active/Inactive	Indicates whether the ACL is active.

1.3.4 reset acl ipv6 counter

Syntax

reset acl ipv6 counter { acl6-number | all }

View

User view

Default Level

2: System level

Parameters

acl6-number: IPv6 ACL number. It is a value in one of the following ranges:

l 2000 to 2999 for basic IPv6 ACLs

l 3000 to 3999 for advanced IPv6 ACLs

all: All IPv6 ACLs.

Description

Use the reset acl ipv6 counter command to clear statistics about specified or all basic and advanced IPv6 ACLs.

Examples

# Clear the statistics about IPv6 ACL 2001.

<Sysname> reset acl ipv6 counter 2001

1.3.5 rule (in basic IPv6 ACL view)

Syntax

rule [ rule-id ] { deny | permit } [ fragment | logging | source { ipv6-address prefix-length | ipv6-address/prefix-length | any } | time-range time-name ] *

undo rule rule-id [ fragment | logging | source | time-range ] *

View

Basic IPv6 ACL view

Default Level

2: System level

Parameters

rule-id: IPv6 ACL rule number in the range 0 to 65534.

deny: Defines a deny statement to drop matched packets.

permit: Defines a permit statement to allow matched packets to pass.

fragment: Indicates that the rule applies only to non-first fragments. The rule applies to both fragments and non-fragments without this keyword.

logging: Specifies to log matched packets.

source { ipv6-address prefix-length | ipv6-address/prefix-length | any }: Specifies a source address. The ipv6-address and prefix-length arguments specify a source IPv6 address, and its address prefix length in the range 1 to 128. The any keyword indicates any IPv6 source address.

time-range time-name: Specifies the time range in which the rule takes effect. If the specified time range does not exist, the rule will not take effect.

Description

Use the rule command to create an IPv6 ACL rule or modify the rule if it has existed.

Use the undo rule command to remove an IPv6 ACL rule or parameters from the rule.

With the undo rule command, if no optional parameters are specified, the entire ACL rule is removed; otherwise, only the involved information is removed.

Note that:

l You may use the display acl ipv6 command to verify rules configured in an ACL. If the match order for this IPv6 ACL is auto, rules are displayed in the depth-first match order rather than by rule number.

Examples

# Create rules in IPv6 ACL 2000.

<Sysname> system-view

[Sysname] acl ipv6 number 2000

[Sysname-acl6-basic-2000] rule permit source 2030:5060::9050/64

[Sysname-acl6-basic-2000] rule 8 deny source fe80:5060::8050/96

1.3.6 rule (in advanced IPv6 ACL view)

Syntax

rule [ rule-id ] { deny | permit } protocol [ destination { dest dest-prefix | dest/dest-prefix | any } | destination-port operator port1 [ port2 ] | dscp dscp | fragment | icmpv6-type { icmpv6-type icmpv6-code | icmpv6-message } | logging | source { source source-prefix | source/source-prefix | any } | source-port operator port1 [ port2 ] | time-range time-name ] *

View

Advanced IPv6 ACL view

Default Level

2: System level

Parameters

rule-id: IPv6 ACL rule number in the range 0 to 65534.

deny: Defines a deny statement to drop matched packets.

permit: Defines a permit statement to allow matched packets to pass.

protocol: Protocol carried on IPv6. It can be a number in the range 0 to 255, or in words, gre (47), icmpv6 (58), ipv6, ipv6-ah (51), ipv6-esp (50), ospf (89), tcp (6), udp (17).

Table 1-8 Match criteria and other rule information for advanced IPv6 ACL rules

Parameter	Function	Description
source { source source-prefix \| source/source-prefix \| any }	Specifies a source IPv6 address.	The source and source-prefix arguments specify an IPv6 source address and its prefix length in the range 1 to 128. The any keyword indicates any IPv6 source address.
destination { dest dest-prefix \| dest/dest-prefix \| any }	Specifies a destination IPv6 address.	The dest and dest-prefix arguments specify a destination IPv6 address, and its prefix length in the range 1 to 128. The any keyword indicates any IPv6 destination address.
dscp dscp	Specifies a DSCP preference	The dscp argument can be a number in the range 0 to 63, or in words, af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, cs1, cs2, cs3, cs4, cs5, cs6, cs7, default, or ef.
logging	Specifies to log matched packets	This function requires that the module using the ACL supports logging.
fragment	Indicates that the rule applies only to non-first fragments	With this keyword not provided, the rule is effective to both non-fragments and fragments.
time-range time-name	Specifies the time range in which the rule can take effect.	If the specified time range does not exist, the rule will not take effect.

If the protocol argument is set to tcp or udp, you may define the parameters in the following table.

Table 1-9 TCP/UDP-specific match criteria for advanced IPv6 ACL rules

Parameter	Function	Description
source-port operator port1 [ port2 ]	Defines the source port in the UDP/TCP packet.	The operator argument can be lt (lower than), gt (greater than), eq (equal to), or range (inclusive range). The port1 and port2 arguments each specify a TCP or UDP port, represented by a number in the range 0 to 65535. TCP port number can be represented in words as follows: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), or www (80). UDP port number can be represented in words as follows: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), xdmcp (177).
destination-port operator port1 [ port2 ]	Defines the destination port in the UDP/TCP packet.

Parameter

Function

Description

source-port operator port1 [ port2 ]

Defines the source port in the UDP/TCP packet.

The operator argument can be lt (lower than), gt (greater than), eq (equal to), or range (inclusive range).

The port1 and port2 arguments each specify a TCP or UDP port, represented by a number in the range 0 to 65535. TCP port number can be represented in words as follows:

chargen (19), bgp (179), cmd (514), daytime (13), discard (9), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), or www (80).

UDP port number can be represented in words as follows: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), xdmcp (177).

destination-port operator port1 [ port2 ]

Defines the destination port in the UDP/TCP packet.

If the protocol argument is set to ICMPv6, you may define the parameters in the following table.

Table 1-10 ICMPv6-specific match criteria for advanced IPv6 ACL rules

Parameter	Function	Description
icmpv6-type { icmpv6-type icmpv6-code \| icmpv6-message }	Specifies the ICMPv6 message type and code	The icmpv6-type argument ranges from 0 to 255. The icmpv6-code argument ranges from 0 to 255. The icmpv6-message argument specifies a message name.

Parameter

Function

Description

icmpv6-type { icmpv6-type icmpv6-code | icmpv6-message }

Specifies the ICMPv6 message type and code

The icmpv6-type argument ranges from 0 to 255.

The icmpv6-code argument ranges from 0 to 255.

The icmpv6-message argument specifies a message name.

The following table provides the ICMPv6 messages that you can specify in advanced IPv6 ACL rules.

Table 1-11 Available ICMPv6 messages

ICMPv6 message	Type	Code
redirect	137	0
echo-request	128	0
echo-reply	129	0
err-Header-field	4	0
frag-time-exceeded	3	1
hop-limit-exceeded	3	0
host-admin-prohib	1	1
host-unreachable	1	3
neighbor-advertisement	136	0
neighbor-solicitation	135	0
network-unreachable	1	0
packet-too-big	2	0
port-unreachable	1	4
router-advertisement	134	0
router-solicitation	133	0
unknown-ipv6-opt	4	2
unknown-next-hdr	4	1

Description

Use the rule command to create an IPv6 ACL rule or modify the rule if it has existed.

Use the undo rule command to remove an IPv6 ACL rule or parameters from the rule.

With the undo rule command, if no optional parameters are specified, the entire ACL rule is removed; otherwise, only the involved information is removed.

Note that:

l You may use the display acl ipv6 command to verify rules configured in an IPv6 ACL. If the match order for this IPv6 ACL is auto, rules are displayed in the depth-first match order rather than by rule number.

Examples

# Create a rule in IPv6 ACL 3000, permitting the TCP packets with the source address 2030:5060::9050/64 to pass.

<Sysname> system-view

[Sysname] acl ipv6 number 3000

[Sysname-acl6-adv-3000] rule permit tcp source 2030:5060::9050/64

1.3.7 rule comment (for IPv6)

Syntax

rule rule-id comment text

undo rule rule-id comment

View

Basic IPv6 ACL view, advanced IPv6 ACL view

Default Level

2: System level

Parameters

rule-id: IPv6 ACL rule number in the range 0 to 65534.

text: IPv6 ACL rule description, a case-sensitive string of 1 to 127 characters.

Description

Use the rule comment command to create or modify a description for an existing IPv6 ACL rule, for example to describe the purpose of the ACL rule or its attributes.

Use the undo rule comment command to remove the IPv6 ACL rule description.

By default, no rule description is created.

Examples

# Define a rule in IPv6 ACL 2000 and create a description for the rule.

<Sysname> system-view

[Sysname] acl ipv6 number 2000

[Sysname-acl6-basic-2000] rule 0 permit source 2030:5060::9050/64

[Sysname-acl6-basic-2000] rule 0 comment This rule is used in eth 1

# Define a rule in IPv6 ACL 3000 and create a description for the rule.

<Sysname> system-view

[Sysname] acl ipv6 number 3000

[Sysname-acl6-adv-3000] rule 0 permit tcp source 2030:5060::9050/64

[Sysname-acl6-adv-3000] rule 0 comment This rule is used in eth 1

1.3.8 step (for IPv6)

Syntax

step step-value

undo step

View

Basic IPv6 ACL view, advanced IPv6 ACL view

Default Level

2: System level

Parameters

step-value: The step in which the rules in the IPv6 ACL is numbered. By default, it is in the range 1 to 20 at the step of 5.

Description

Use the step command to set a rule numbering step for the IPv6 ACL.

Use the undo step command to restore the default.

When defining rules in an IPv6 ACL, you do not necessarily assign them numbers. The system can do this automatically in steps. For example, if the default step applies, rules you created are numbered 0, 5, 10, 15, and so on automatically.

One benefit of rule numbering step is that it allows you to insert new rules between existing ones as needed. For example, after creating four rules numbered 0, 5, 10, 15 in an ACL configured with the step of 5, you can still insert a rule numbered 1.

Any step change can result in renumbering. For example, after you change the step in the above example from 5 to 2, the rules are renumbered 0, 2, 4, 6, and 8.

Note that even if the current step is the default, performing the undo step command can still result in rule renumbering. Suppose that IPv6 ACL 3001 adopts the default numbering step and contains two rules numbered 0 and 5. After you insert rule 1 and rule 3, the rules are numbered 0, 1, 3, and 5. If you perform the undo step command, they will be renumbered 0, 5, 10, and 15.

Examples

# Set the rule numbering step to 2 for IPv6 ACL 2000.

<Sysname> system-view

[Sysname] acl ipv6 number 2000

[Sysname-acl6-basic-2000] step 2

# Set the rule numbering step to 2 for IPv6 ACL 3000.

<Sysname> system-view

[Sysname] acl ipv6 number 3000

[Sysname-acl6-adv-3000] step 2

Chapter 2 Flow Template Configuration Commands

2.1 Flow Template Configuration Commands

2.1.1 display flow-template user-defined

Syntax

display flow-template user-defined [ flow-template-name ]

View

Any view

Default Level

1: Monitor level

Parameters

flow-template-name: Name of a user-defined flow template.

Description

Use the display flow-template user-defined command to display the configuration of the specified or all user-defined flow templates.

Examples

# Display the configuration of all user-defined flow templates.

<Sysname> display flow-template user-defined

user-defined flow template: basic

name:f1, index:1, total reference counts:1

fields: ip-protocol fragments ip-precedence

user-defined flow template: extend

name:f2, index:2, total reference counts:0

fields: start 22 33 l2 55 66

user-defined flow template: basic

name:f3, index:3, total reference counts:1

fields: tos

Table 2-1 Description on the fields of display flow-template user-defined

Field	Description
user-defined flow template	Type of the user-defined flow template: basic or extend
name	Name of the user-defined flow template
index	Index of the user-defined flow template
total reference counts	Total number of the times that the user-defined flow template is referenced.
fields	Fields included in the user-defined flow template

2.1.2 display flow-template interface

Syntax

display flow-template interface [ interface-type interface-number ]

View

Any view

Default Level

1: Monitor level

Parameters

interface-type interface-number: Specifies an interface by its type and number.

Description

Use the display flow-template interface command to display information about the user-defined flow template applied to the specified interface or all the interfaces.

Examples

# Display information about the user-defined flow templates applied to all interfaces.

<Sysname> display flow-template interface

Interface: Ethernet1/1/1

user-defined flow template: basic

name:f1, index:1, total reference counts:1

fields: ip-protocol fragments ip-precedence

Table 2-2 Description on the fields of display flow-template interface

Field	Description
Interface	Interface where the user-defined flow template is referenced
user-defined flow template	Type of the user-defined flow template: basic or extend
name	Name of the user-defined flow template
index	Index of the user-defined flow template
total reference counts	Reference count for the user-defined flow templates
fields	Fields included in the user-defined flow template

2.1.3 flow-template

Syntax

flow-template flow-template-name

undo flow-template

View

Ethernet interface view, port group view

Default Level

2: System level

Parameters

flow-template-name: Name of a user-defined flow template.

Description

Use the flow-template command to reference a flow template on an Ethernet interface or port group.

Use the undo flow-template command to remove the reference.

Note that:

l The specified user-defined flow template must exist.

l You can reference only one user-defined flow template on an interface.

Examples

# Reference user-defined flow template f1 on Ethernet 1/1/1.

<Sysname> system-view

[Sysname] interface ethernet 1/1/1

[Sysname-Ethernet1/1/1] flow-template f1

# Remove the referenced flow template on Ethernet 1/1/1.

[Sysname-Ethernet1/1/1] undo flow-template

# Reference user-defined flow template f1 on port group 1.

<Sysname> system-view

[Sysname] link-aggregation group 1 mode manual

[Sysname] interface ethernet 1/1/2

[Sysname-Ethernet1/1/2] port link-aggregation group 1

[Sysname-Ethernet1/1/2] interface ethernet 1/1/3

[Sysname-Ethernet1/1/3] port link-aggregation group 1

[Sysname-Ethernet1/1/3] quit

[Sysname] port-group aggregation 1

[Sysname-port-group-aggregation-1] flow-template f1

2.1.4 flow-template basic

Syntax

flow-template flow-template-name basic { customer-vlan-id | dip | dipv6 | dmac | dport | dscp | ethernet-protocol | fragments | icmp-code | icmp-type | icmpv6-code | icmpv6-type | ip-precdence | ip-protocol | ip-ttl | ipv6-dscp | ipv6-fragment | ipv6-protocol | mpls-exp | service-cos | service-vlan-id | sip | sipv6 | smac | sport | tcp-flag | tos } *

undo flow-template { all | name flow-template-name }

View

System view

Default Level

2: System level

Parameters

flow-template-name: Name of a user-defined flow template, a case-insensitive string of 1 to 31 characters.

customer-vlan-id: Customer VLAN ID.

dip: Destination IP address.

dipv6: Destination IPv6 address.

dmac: Destination MAC address.

dport: Destination Layer 4 port.

dscp: Differentiated service code point (DSCP) field in the IP header.

ethernet-protocol: Protocol type field in the Ethernet frame header.

fragments: Fragments field in the IP header.

icmp-code: ICMP code field.

icmp-type: ICMP type field.

icmpv6-code: IPv6 code field.

Icmpv6-type: IPv6 type field.

ip-precedence: Precedence field in the IP header.

ip-protocol: Protocol type field in the IP header.

ip-ttl: TTL value of the IPv4 packet.

ipv6-dscp: DSCP field in the IPv6 header.

ipv6-fragments: IPv6 fragments flag.

ipv6-protocol: Protocol type in the IPv6 header.

mpls-exp: EXP field in the MPLS label.

service-cos: Specifies the service provider 802.1p COS field.

service-vlan-id: Service provider VLAN ID.

sip: Source IP address.

sipv6: Source IPv6 address.

smac: Source MAC address.

sport: Source Layer 4 port.

tcp-flag: Flags field.

tos: ToS field.

all: All user-defined flow templates.

Description

Use the flow-template basic command to create a basic user-defined flow template.

Use the undo flow-template command to remove the specified or all user-defined flow templates.

When removing templates, make sure that they are not referenced on interfaces. Otherwise, your removing attempt will fail.

Examples

# Create a basic user-defined flow template.

<Sysname> system-view

[Sysname] flow-template f1 basic dip smac ip-protocol tcp-flag

2.1.5 flow-template extend

Syntax

flow-template flow-template-name extend { ipv4 offset-max-value length-max-value | ipv6 offset-max-value length-max-value | l2 offset-max-value length-max-value | l4 offset-max-value length-max-value | l5 offset-max-value length-max-value } *

undo flow-template { all | name flow-template-name }

View

System view

Default Level

2: System level

Parameters

flow-template-name: Name of a user-defined flow template, a case-insensitive string of 1 to 31 characters.

ipv4: Sets the offset from the beginning of the IPv4 header.

ipv6: Sets the offset from the beginning of the IPv6 header.

l2: Sets the offset from the beginning of the Layer 2 frame header.

l4: Sets the offset from the beginning of the Layer 4 header.

l5: Sets the offset from the beginning of the Layer 5 header.

offset-max-value: The maximum offset relative to the referential location.

length-max-value: The maximum comparing length.

all: Specifies to remove all user-defined flow templates.

Description

Use the flow-template extend command to create an extended user-defined flow template.

Use the undo flow-template command to remove the specified or all user-defined flow templates.

When removing templates, make sure that they are not referenced on interfaces. Otherwise, your removing attempt will fail.

Examples

# Create an extended user-defined flow template.

<Sysname> system-view

[Sysname] flow-template f2 extend l2 3 10 ipv4 5 8

H3C S9500 Command Manual-Release2132[V2.03]-06 QoS ACL Volume

1.2.2 description (for IPv4)

1.2.3 display acl

1.2.4 reset acl counter

1.2.10 step (for IPv4)

1.3 IPv6 ACL Configuration Commands

1.3.2 description (for IPv6)

1.3.3 display acl ipv6

1.3.4 reset acl ipv6 counter

1.3.6 rule (in advanced IPv6 ACL view)

1.3.7 rule comment (for IPv6)

1.3.8 step (for IPv6)

2.1.3 flow-template

2.1.4 flow-template basic

2.1.5 flow-template extend

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us