Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 01-ACL commands | 370.21 KB |
display packet-filter statistics
display packet-filter statistics sum
packet-filter (interface view)
qos-acl resource hardware-mode
reset packet-filter statistics
ACL commands
The device supports MDCs only when it operates in the standard mode. For information about MDCs, see Virtual Technologies Configuration Guide.
acl
Use acl to create an ACL and enter its view, or enter the view of an existing ACL.
Use undo acl to delete the specified or all ACLs.
Syntax
Command for creating an IPv4, user-defined, or Layer 2 ACL by specifying a number:
acl { name acl-name | number acl-number [ name acl-name ] [ match-order { auto | config } ] }
undo acl { all | name acl-name | number acl-number }
Command for creating an IPv6 ACL by specifying a number:
acl ipv6 { name acl-name | number acl-number [ name acl-name ] [ match-order { auto | config } ] }
undo acl ipv6 { all | name acl-name | number acl-number }
Commands for creating ACLs by specifying the related keywords:
· Command for creating an IPv4 ACL by specifying the advanced or basic keyword:
acl { advanced | basic } { acl-number | name acl-name } [ match-order { auto | config } ]
undo acl { all | { advanced | basic } { acl-number | name acl-name } }
· Command for creating an IPv6 ACL by specifying the advanced or basic keyword:
acl ipv6 { advanced | basic } { acl-number | name acl-name } [ match-order { auto | config } ]
undo acl ipv6 { all | { advanced | basic } { acl-number | name acl-name } }
· Command for creating a Layer 2 ACL by specifying the mac keyword:
acl mac { acl-number | name acl-name } [ match-order { auto | config } ]
undo acl mac { all | acl-number | name acl-name }
· Command for creating a user-defined ACL by specifying the user-defined keyword:
acl user-defined { acl-number | name acl-name }
undo acl user-defined { all | acl-number | name acl-name }
Default
No ACLs exist.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
ipv6: Specifies the IPv6 ACL type. To specify the IPv4 ACL type, do not use this keyword.
basic: Specifies the basic ACL type.
advanced: Specifies the advanced ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
number acl-number: Assigns a number to the ACL. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name acl-name: Assigns a name to the ACL. The acl-name argument is a case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid confusion, it cannot be all.
match-order: Specifies the order in which ACL rules are compared against packets.
auto: Compares ACL rules in depth-first order.
config: Compares ACL rules in ascending order of rule ID. The rule with a smaller ID has a higher priority. If you do not specify a match order, the config order applies by default. The match order for the user-defined ACL can only be config.
all: Specifies all ACLs of the specified type.
Usage guidelines
If you create a numbered ACL, you can enter the view of the ACL by using either of the following commands:
· The acl [ ipv6 ] number acl-number command.
· The acl { [ ipv6 ] { advanced | basic } | mac | user-defined } acl-number command.
If you create a ACL by using the acl [ ipv6 ] number acl-number name acl-name command, you can enter the view of the ACL by using either of the following commands:
· acl [ ipv6 ] name acl-name (for only basic ACLs and advanced ACLs).
· acl [ ipv6 ] number acl-number [ name acl-name ].
· acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name.
If you create a named WLAN ACL by using the acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name command, you can enter the view of the ACL by using either of the following commands:
· acl [ ipv6 ] name acl-name (for only basic ACLs and advanced ACLs).
· acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name.
You can change the match order only for ACLs that do not contain any rules.
Examples
# Create IPv4 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000]
# Create IPv4 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl basic name flow
[Sysname-acl-ipv4-basic-flow]
# Create IPv4 advanced ACL 3000 and enter its view.
<Sysname> system-view
[Sysname] acl advanced 3000
[Sysname-acl-ipv4-adv-3000]
# Create IPv6 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic 2000
[Sysname-acl-ipv6-basic-2000]
# Create IPv6 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic name flow
[Sysname-acl-ipv6-basic-flow]
# Create IPv6 advanced ACL abc and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 advanced name abc
[Sysname-acl-ipv6-adv-abc]
# Create Layer 2 ACL 4000 and enter its view.
<Sysname> system-view
[Sysname] acl mac 4000
[Sysname-acl-mac-4000]
# Create Layer 2 ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl mac name flow
[Sysname-acl-mac-flow]
# Create user-defined ACL 5000 and enter its view.
<Sysname> system-view
[Sysname] acl user-defined 5000
[Sysname-acl-user-5000]
# Create user-defined ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl user-defined name flow
[Sysname-acl-user-flow]
Related commands
display acl
acl copy
Use acl copy to create an ACL by copying an ACL that already exists.
Syntax
acl [ ipv6 | mac | user-defined ] copy { source-acl-number | name source-acl-name } to { dest-acl-number | name dest-acl-name }
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
source-acl-number: Specifies an existing source ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name source-acl-name: Specifies an existing source ACL by its name. The source-acl-name argument is a case-insensitive string of 1 to 63 characters.
dest-acl-number: Assigns a unique number to the new ACL. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name dest-acl-name: Assigns a unique name to the new ACL. The dest-acl-name argument is a case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid confusion, it cannot be all.
Usage guidelines
The new ACL and the source ACL must be the same type.
When specifying an ACL by its number, follow these rules:
· To specify an IPv6 ACL, you must specify both its ACL number and the ipv6 keyword.
· To specify a Layer 2 ACL, you can specify its ACL number without the mac keyword.
· To specify a user-defined ACL, you can specify its ACL number without the user-defined keyword.
To specify an IPv6 ACL, Layer 2 ACL, or user-defined ACL by a name, you must specify both the ACL name and the ipv6, mac, or user-defined keyword.
The new ACL has the same properties and content as the source ACL, but uses a different number or name from the source ACL.
Examples
# Create IPv4 basic ACL 2002 by copying IPv4 basic ACL 2001.
<Sysname> system-view
[Sysname] acl copy 2001 to 2002
# Create IPv4 basic ACL paste by copying IPv4 basic ACL test.
<Sysname> system-view
[Sysname] acl copy name test to name paste
acl logging interval
Use acl logging interval to enable logging for packet filtering and set the interval.
Use undo acl logging interval to restore the default.
Syntax
acl logging interval interval
undo acl logging interval
Default
The interval is 0. The device does not generate log entries for packet filtering.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
interval: Specifies the interval at which log entries are generated and output. It must be a multiple of 5, in the range of 0 to 1440 minutes. To disable the logging, set the value to 0.
Usage guidelines
The logging feature is available for IPv4 or IPv6 ACL rules that have the logging keyword.
You can configure the ACL module to generate log entries for packet filtering and output them to the information center at the output interval. The log entry records the number of matching packets and the matched ACL rules. When the first packet of a flow matches an ACL rule, the output interval starts, and the device immediately outputs a log entry for this packet. When the output interval ends, the device outputs a log entry for subsequent matching packets of the flow. For more information about the information center, see Network Management and Monitoring Configuration Guide.
Examples
# Configure the device to generate and output packet filtering log entries every 10 minutes.
<Sysname> system-view
[Sysname] acl logging interval 10
Related commands
rule (IPv4 advanced ACL view)
rule (IPv4 basic ACL view)
rule (IPv6 advanced ACL view)
rule (IPv6 basic ACL view)
acl trap interval
Use acl trap interval to enable SNMP notifications for packet filtering and set the interval.
Use undo acl interval to restore the default.
Syntax
acl trap interval interval
undo acl trap interval
Default
The interval is 0. The device does not generate SNMP notifications for packet filtering.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
interval: Specifies the interval at which SNMP notifications are generated and output. It must be a multiple of 5, in the range of 0 to 1440 minutes. To disable SNMP notifications, set the value to 0.
Usage guidelines
The SNMP notifications feature is available for IPv4 or IPv6 ACL rules that have the logging keyword.
You can configure the ACL module to generate SNMP notifications for packet filtering and output them to the SNMP module at the output interval. The notification records the number of matching packets and the matched ACL rules. When the first packet of a flow matches an ACL rule, the output interval starts, and the device immediately outputs a notification for this packet. When the output interval ends, the device outputs a notification for subsequent matching packets of the flow. For more information about SNMP, see Network Management and Monitoring Configuration Guide.
Examples
# Configure the device to generate and output packet filtering SNMP notifications every 10 minutes.
<Sysname> system-view
[Sysname] acl trap interval 10
Related commands
rule (IPv4 advanced ACL view)
rule (IPv4 basic ACL view)
rule (IPv6 advanced ACL view)
rule (IPv6 basic ACL view)
description
Use description to configure a description for an ACL.
Use undo description to delete an ACL description.
Syntax
description text
undo description
Default
An ACL does not have a description.
Views
IPv4 basic/advanced ACL view
IPv6 basic/advanced ACL view
Layer 2 ACL view
User-defined ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
text: Specifies a description, a case-sensitive string of 1 to 127 characters.
Examples
# Configure a description for IPv4 basic ACL 2000.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] description This is an IPv4 basic ACL.
Related commands
display acl
display acl
Use display acl to display ACL configuration and match statistics.
Syntax
display acl [ ipv6 | mac | user-defined ] { acl-number | all | name acl-name }
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
all: Specifies all ACLs of the specified type.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
Usage guidelines
This command displays ACL rules in config or auto order, whichever is configured.
To specify the IPv4 ACL type, do not specify the ipv6, mac, or user-defined keyword.
Examples
# Display configuration and match statistics for IPv4 basic ACL 2001.
<Sysname> display acl 2001
Basic IPv4 ACL 2001, 1 rule, match-order is auto,
This is an IPv4 basic ACL.
ACL's step is 5, start ID is 0
rule 5 permit source 1.1.1.1 0
rule 5 comment This rule is used on Ten-GigabitEthernet3/0/1.
Table 1 Command output
|
Field |
Description |
|
Basic IPv4 ACL 2001 |
Type and number of the ACL. The following field information is about IPv4 basic ACL 2001. |
|
1 rule |
The ACL contains one rule. |
|
match-order is auto |
The match order for the ACL is auto, which sorts ACL rules in depth-first order. This field is not displayed when the match order is config. |
|
This is an IPv4 basic ACL. |
Description of the ACL. |
|
ACL's step is 5 |
The rule numbering step is 5. |
|
start ID is 0 |
The start rule ID is 0. |
|
rule 5 permit source 1.1.1.1 0 |
Content of rule 5. The rule permits packets sourced from the IP address 1.1.1.1. |
|
rule 5 comment This rule is used on Ten-GigabitEthernet3/0/1. |
Comment of rule 5. |
display packet-filter
Use display packet-filter to display ACL application information for packet filtering.
Syntax
In standalone mode:
display packet-filter { global | interface [ interface-type interface-number ] } [ inbound | outbound ] [ slot slot-number ]
In IRF mode:
display packet-filter { global | interface [ interface-type interface-number ] [ inbound | outbound ] } [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
global: Specifies all physical interfaces.
interface [ interface-type interface-number ]: Specifies an interface by its type and number. If you do not specify an interface, this command displays ACL application information for packet filtering on all interfaces. If you specify an Ethernet interface, you do not need to specify the slot slot-number or chassis chassis-number slot slot-number option.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays ACL application information for packet filtering for the active MPU. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays ACL application information for packet filtering for the global active MPU. (In IRF mode.)
Usage guidelines
If neither the inbound keyword nor the outbound keyword is specified, this command displays ACL application information for packet filtering in both directions.
Examples
# Display ACL application information for inbound packet filtering on interface Ten-GigabitEthernet 3/0/1.
<Sysname> display packet-filter interface ten-gigabitethernet 3/0/1 inbound
Interface: Ten-GigabitEthernet3/0/1
Inbound policy:
IPv4 ACL 2001r
IPv6 ACL 2002 (Failed)
MAC ACL 4003
# Display ACL application information for inbound and outbound packet filtering on all physical interfaces.
<Sysname> display packet-filter global
Global:
Inbound policy:
IPv4 ACL 2001
IPv6 ACL 2001
MAC ACL 4001
IPv4 default action: Deny (Failed)
IPv6 default action: Deny (Failed)
MAC default action: Deny
Outbound policy:
MAC ACL 4001
MAC default action: Deny
Table 2 Command output
|
Field |
Description |
|
Interface |
Interface to which the ACL applies. |
|
Global |
ACL application for packet filtering on all physical interfaces. |
|
Inbound policy |
ACL used for filtering incoming traffic. |
|
Outbound policy |
ACL used for filtering outgoing traffic. |
|
IPv4 ACL 2001 |
IPv4 basic ACL 2001 has been successfully applied. |
|
IPv6 ACL 2002 (Failed) |
The device has failed to apply IPv6 basic ACL 2002. |
|
IPv4 default action |
Packet filter default action for packets that do not match any IPv4 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
|
IPv6 default action |
Packet filter default action for packets that do not match any IPv6 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
|
MAC default action |
Packet filter default action for packets that do not match any Layer 2 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
display packet-filter statistics
Use display packet-filter statistics to display packet filtering statistics.
Syntax
display packet-filter statistics { global | interface interface-type interface-number } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ brief ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
global: Displays the statistics for all physical interfaces.
interface interface-type interface-number: Specifies an interface by its type and number.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
brief: Displays brief statistics.
Usage guidelines
If you do not specify any parameters, this command displays packet filtering statistics for all ACLs.
Examples
# Display packet filtering statistics for all ACLs on incoming packets of Ten-GigabitEthernet 3/0/1.
<Sysname> display packet-filter statistics interface ten-gigabitethernet 3/0/1 inbound
Interface: Ten-GigabitEthernet3/0/1
Inbound policy:
IPv4 ACL 2001, Hardware-count
From 2011-06-04 10:25:21 to 2011-06-04 10:35:57
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (No resource)
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
IPv6 ACL 2000
MAC ACL 4000
rule 0 permit
IPv4 default action: Deny
From 2011-06-04 10:25:21 to 2011-06-04 10:35:57
Totally 7 packets
IPv6 default action: Deny
From 2011-06-04 10:25:41 to 2011-06-04 10:35:57
Totally 0 packets
MAC default action: Deny
From 2011-06-04 10:25:34 to 2011-06-04 10:35:57
Totally 0 packets
Table 3 Command output
|
Field |
Description |
|
Interface |
Interface to which the ACL applies. |
|
Inbound policy |
ACL used for filtering incoming traffic. |
|
Outbound policy |
ACL used for filtering outgoing traffic. |
|
IPv4 ACL 2001 |
IPv4 basic ACL 2001 has been successfully applied. |
|
IPv4 ACL 2002 (Failed) |
The device has failed to apply IPv4 basic ACL 2002. |
|
From 2011-06-04 10:25:21 to 2011-06-04 10:35:57 |
Start time and end time of the statistics. The start time is the time when the packet filter was deployed to the card. |
|
2 packets |
Two packets matched the rule. This field is not displayed when no packets matched the rule. |
|
No resource |
Resources are not enough for counting matches for the rule. In packet filtering statistics, this field is displayed for a rule when resources are not sufficient for rule match counting. |
|
rule 5 permit source 1.1.1.1 0 (Failed) |
The device has failed to apply rule 5. |
|
Totally 2 packets permitted, 0 packets denied |
Number of packets permitted and denied by the ACL. |
|
Totally 100% permitted, 0% denied |
Ratios of permitted and denied packets to all packets. |
|
IPv4 default action |
Packet filter default action for packets that do not match any IPv4 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
|
IPv6 default action |
Packet filter default action for packets that do not match any IPv6 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
|
MAC default action |
Packet filter default action for packets that do not match any Layer 2 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
|
Totally 7 packets |
The default action has been executed on seven packets. |
Related commands
reset packet-filter statistics
display packet-filter statistics sum
Use display packet-filter statistics sum to display accumulated packet filtering statistics for an ACL.
Syntax
display packet-filter statistics sum { inbound | outbound } [ ipv6 | mac | user-defined ] { acl-number | name acl-name } [ brief ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
brief: Displays brief statistics.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6, mac, or user-defined keyword.
Examples
# Display accumulated packet filtering statistics for IPv4 basic ACL 2001 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2001
Sum:
Inbound policy:
IPv4 ACL 2001
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0
rule 10 permit vpn-instance test
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
# Display brief accumulated packet filtering statistics for IPv4 basic ACL 2000 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2000 brief
Sum:
Inbound policy:
IPv4 ACL 2000
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
Table 4 Command output
|
Field |
Description |
|
Sum |
Accumulated packet filtering statistics. |
|
Inbound policy |
Accumulated packet filtering statistics in the inbound direction. |
|
Outbound policy |
Accumulated packet filtering statistics in the outbound direction. |
|
IPv4 ACL 2001 |
Accumulated packet filtering statistics of IPv4 basic ACL 2001. |
|
2 packets |
Two packets matched the rule. This field is not displayed when no packets matched the rule. |
|
Totally 2 packets permitted, 0 packets denied |
Number of packets permitted and denied by the ACL. |
|
Totally 100% permitted, 0% denied |
Ratios of permitted and denied packets to all packets. |
Related commands
reset packet-filter statistics
display packet-filter verbose
Use display packet-filter verbose to display ACL application details for packet filtering.
Syntax
In standalone mode:
display packet-filter verbose { global | interface interface-type interface-number } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ slot slot-number ]
In IRF mode:
display packet-filter verbose { global | interface interface-type interface-number } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
global: Specifies all physical interfaces.
interface interface-type interface-number: Specifies an interface by its type and number. The chassis chassis-number and slot slot-number options are not available for an Ethernet interface.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays ACL application details for packet filtering for the active MPU. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays ACL application details for packet filtering for the global active MPU. (In IRF mode.)
Usage guidelines
If acl-number, name acl-name, ipv6, mac, or user-defined is not specified, this command displays application details of all ACLs for packet filtering.
Examples
# Display application details of all ACLs for inbound packet filtering on Ten-GigabitEthernet 3/0/1.
<Sysname> display packet-filter verbose interface ten-gigabitethernet 3/0/1 inbound
Interface: Ten-GigabitEthernet3/0/1
Inbound policy:
IPv4 ACL 2001
rule 0 permit
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (Failed)
IPv6 ACL 2000
rule 0 permit
MAC ACL 4000
IPv4 default action: Deny
IPv6 default action: Deny
MAC default action: Deny
# Display application details of all ACLs for inbound packet filtering on all physical interfaces.
<Sysname> display packet-filter verbose global inbound
Global:
Inbound policy:
IPv4 ACL 2001
rule 0 permit
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (Failed)
IPv4 ACL 2002 (Failed)
IPv6 ACL 2000, Hardware-count
MAC ACL 4000, Hardware-count
rule 0 permit
IPv4 default action: Deny
IPv6 default action: Deny
MAC default action: Deny
Table 5 Command output
|
Field |
Description |
|
Interface |
Interface to which the ACL applies. |
|
Global |
ACL application details for packet filtering on all physical interfaces. |
|
Inbound policy |
ACL used for filtering incoming traffic. |
|
Outbound policy |
ACL used for filtering outgoing traffic. |
|
IPv4 ACL 2001 |
IPv4 basic ACL 2001 has been successfully applied. |
|
IPv4 ACL 2002 (Failed) |
The device has failed to apply IPv4 basic ACL 2002. |
|
Hardware-count |
ACL rule match counting in hardware has been successfully enabled. |
|
Hardware-count (Failed) |
The device has failed to enable counting ACL rule matches in hardware. |
|
rule 5 permit source 1.1.1.1 0 |
The device has succeeded in applying rule 5. |
|
IPv4 default action |
Packet filter default action for packets that do not match any IPv4 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
|
IPv6 default action |
Packet filter default action for packets that do not match any IPv6 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
|
MAC default action |
Packet filter default action for packets that do not match any Layer 2 ACLs: · Deny—The default action deny has been successfully applied for packet filtering. · Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. · Permit—The default action permit has been successfully applied for packet filtering. |
display qos-acl resource
Use display qos-acl resource to display QoS and ACL resource usage.
Syntax
In standalone mode:
display qos-acl resource [ slot slot-number ]
In IRF mode:
display qos-acl resource [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
mdc-admin
mdc-operator
Parameters
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays ACL QoS and ACL resource usage for all cards. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays QoS and ACL resource usage for all cards. (In IRF mode.)
Usage guidelines
This command does not display any usage data if the specified card does not support counting QoS and ACL resources.
Examples
# Display QoS and ACL resource usage.
<Sysname> display qos-acl resource
Interfaces: XGE3/0/1 to XGE3/0/16 (slot 3)
---------------------------------------------------------------------
Type Total Reserved Configured Remaining Usage
---------------------------------------------------------------------
IGS ACL 5120 200 0 4920 3%
EGS ACL 4608 0 0 4608 0%
IGS Counter 5116 100 0 5016 1%
EGS Counter 1023 0 0 1023 0%
Meter 3840 100 1 3739 2%
Policer Counter 4095 300 3 3792 7%
Table 6 Command output
|
Field |
Description |
|
Interfaces |
Interface range for the resources. |
|
Type |
Resource type: · IGS ACL—Inbound ACL rule resources. · EGS ACL—Outbound ACL rule resources. · IGS Counter—Inbound traffic accounting resources. · EGS Counter—Outbound traffic accounting resources. · Meter—Traffic policing resources. · Policer Counter—Traffic accounting resources for colored packets. |
|
Total |
Total number of resources. |
|
Reserved |
Number of reserved resources. |
|
Configured |
Number of resources that has been applied. |
|
Remaining |
Number of resources that you can apply. |
|
Usage |
Configured and reserved resources as a percentage of total resources. If the percentage is not an integer, this field displays the integer part. For example, if the actual usage is 50.8%, this field displays 50%. |
packet-filter (interface view)
Use packet-filter to apply an ACL to an interface to filter packets.
Use undo packet-filter to remove an ACL from an interface.
Syntax
packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } { inbound | outbound } [ hardware-count ] [ share-mode ]
undo packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } { inbound | outbound }
Default
No ACL is applied to an interface to filter packets.
Views
Interface view
Predefined user roles
network-admin
mdc-admin
Parameters
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
inbound: Filters incoming packets.
outbound: Filters outgoing packets.
hardware-count: Enables counting ACL rule matches performed in hardware. If you do not specify this keyword, rule matches for the ACL are not counted in hardware.
share-mode: Applies the ACL in sharing mode to a Layer 2 Ethernet interface, Layer 3 Ethernet interface, or VLAN interface. In this mode, all interfaces on an interface card or member device with the same ACL applied in the inbound direction share one QoS and ACL resource.
Usage guidelines
If you use the acl-number argument to specify an ACL, follow these guidelines:
· To specify an IPv4 ACL, use the acl-number argument directly.
· To specify an IPv6 ACL, specify the ipv6 keyword, and then the acl-number argument.
· To specify a Layer 2 ACL or user-defined ACL, the mac or user-defined keyword is not a must. You can either specify the mac or user-defined keyword and then the acl-number argument or specify only the acl-number argument.
If you use the name acl-name option to specify an ACL, follow these guidelines:
· To specify an IPv4 ACL, use the name acl-name option.
· To specify an IPv6, Layer 2, or user-defined ACL, specify the related keyword and then the name acl-name option.
For an ACL applied to the following interfaces on an SD interface module, if the vpn-instance vpn-instance-name or microsegment parameter is specified in a rule, the rule does not take effect:
· Layer 3 Ethernet interface.
· Layer 3 aggregate interface.
· Layer 3 Ethernet subinterface.
· Layer 3 aggregate subinterface.
SF interface modules do not support matching a VPN instance in the outbound direction.
The hardware-count keyword in this command enables match counting in hardware for all rules in an ACL, and the counting keyword in the rule command enables match counting specific to rules.
To disable ACL rule match counting in hardware when resources are insufficient, you must execute the undo packet-filter command and then reconfigure the packet-filter command without specifying the hardware-count keyword.
To disable ACL rule match counting in hardware when resources are sufficient, you can directly reconfigure the packet-filter command without specifying the hardware-count keyword.
SF interface modules do not support applying an ACL to the outbound direction of a VSI interface for packet filtering.
You can use the packet-filter command in VLAN interface view to configure packet filtering in one direction of a VLAN interface.
Examples
# Apply IPv4 basic ACL 2001 to filter incoming traffic on Ten-GigabitEthernet 3/0/1, and enable counting ACL rule matches performed in hardware.
<Sysname> system-view
[Sysname] interface ten-gigabitethernet 3/0/1
[Sysname-Ten-GigabitEthernet3/0/1] packet-filter 2001 inbound hardware-count
display packet-filter
display packet-filter statistics
display packet-filter verbose
packet-filter default deny
Use packet-filter default deny to set the packet filtering default action to deny. The packet filter denies packets that do not match any ACL rule.
Use undo packet-filter default deny to restore the default.
Syntax
packet-filter default deny
undo packet-filter default deny
Default
The packet filtering default action is permit. The packet filter permits packets that do not match any ACL rule.
Views
System view
Predefined user roles
network-admin
mdc-admin
Usage guidelines
The packet filter applies the default action to all ACL applications for packet filtering. The default action appears in the display command output for packet filtering.
Examples
# Set the packet filter default action to deny.
<Sysname> system-view
[Sysname] packet-filter default deny
Related commands
display packet-filter
display packet-filter statistics
display packet-filter verbose
packet-filter filter
Use packet-filter filter to specify the applicable scope of packet filtering on a VLAN interface.
Use undo packet-filter filter to restore the default.
Syntax
packet-filter filter [ route | all ]
undo packet-filter filter
Default
The packet filtering filters packets forwarded at Layer 3.
Views
VLAN interface view
Predefined user roles
network-admin
mdc-admin
Parameters
route: Filters packets forwarded at Layer 3 by the VLAN interface.
all: Filters all packets, including packets forwarded at Layer 3 by the VLAN interface and packets forwarded at Layer 2 by the physical ports associated with the VLAN interface.
Examples
# Configure the packet filtering on VLAN-interface 2 to filter packets forwarded at Layer 3.
<Sysname> system-view
[Sysname] interface vlan-interface 2
[Sysname-Vlan-interface2] packet-filter filter route
packet-filter global
Use packet-filter global to apply an ACL to filter packets globally.
Use undo packet-filter global to remove an ACL for global packet filtering.
Syntax
packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } global { inbound | outbound } [ hardware-count ]
undo packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } global { inbound | outbound }
Default
No ACL is applied to filter packets globally.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
global: Specifies all physical interfaces.
inbound: Filters incoming packets.
outbound: Filters outgoing packets.
hardware-count: Enables counting ACL rule matches performed in hardware. If you do not specify this keyword, rule matches for the ACL are not counted in hardware.
Usage guidelines
If you use the acl-number argument to specify an ACL, follow these guidelines:
· To specify an IPv4 ACL, use the acl-number argument directly.
· To specify an IPv6 ACL, specify the ipv6 keyword, and then the acl-number argument.
· To specify a Layer 2 ACL or user-defined ACL, the mac or user-defined keyword is not a must. You can either specify the mac or user-defined keyword and then the acl-number argument or specify only the acl-number argument.
If you use the name acl-name option to specify an ACL, follow these guidelines:
· To specify an IPv4 ACL, use the name acl-name option.
· To specify an IPv6, Layer 2, or user-defined ACL, specify the related keyword and then the name acl-name option.
When you reference an ACL, follow these restrictions and guidelines:
· If the ACL does not exist or contains no rules, it does not take effect.
· If the vpn-instance vpn-instance-name option is specified in an ACL rule, the rule takes effect on the VPN packets of the VPN instance. If the vpn-instance vpn-instance-name option is not specified in an ACL rule, the rule takes effect on all VPN packets and non-VPN packets.
SF interface modules do not support matching a VPN instance in the outbound direction.
The hardware-count keyword in this command enables match counting in hardware for all rules in an ACL, and the counting keyword in the rule command enables match counting specific to rules.
To disable ACL rule match counting in hardware when resources are insufficient, you must execute the undo packet-filter command and then reconfigure the packet-filter command without specifying the hardware-count keyword.
To disable ACL rule match counting in hardware when resources are sufficient, you can directly reconfigure the packet-filter command without specifying the hardware-count keyword.
Examples
# Apply IPv4 basic ACL 2001 to filter incoming traffic on all physical interfaces, and enable counting ACL rule matches performed in hardware.
<Sysname> system-view
[Sysname] packet-filter 2001 global inbound hardware-count
Related commands
display packet-filter
display packet-filter statistics
display packet-filter verbose
qos-acl resource hardware-mode
Use qos-acl resource hardware-mode to configure the QoS and ACL resource hardware mode.
Use undo qos-acl resource hardware-mode to restore the default.
Syntax
qos-acl resource hardware-mode hardware-mode-value
undo qos-acl resource hardware-mode hardware-mode-value
Default
No QoS and ACL resource hardware mode is configured.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
hardware-mode-value: Specifies a hardware mode. Only the inbound-portrange-enhanced mode is supported in the current software version. This mode performs enhanced processing for ACL rules matching a range of port numbers (lt, gt, and range) in the inbound direction.
Usage guidelines
The inbound-portrange-enhanced mode takes effect only on ACLs applied after it is configured. For this mode to take effect on existing ACLs, perform one of the following tasks:
· Save the running configuration and reboot the device after configuring the mode.
· Remove applied ACLs before configuring the mode and reapply them after configuring the mode.
The inbound-portrange-enhanced mode enables the device to split a range of port numbers by using masks to save QoS and ACL resources.
Examples
# Configure the QoS and ACL resource hardware mode as inbound-portrange-enhanced.
<Sysname> system-view
[Sysname] qos-acl resource hardware-mode inbound-portrange-enhanced
Please save the running configuration and reboot the device to activate the settings.
qos-acl resource share-mode
Use qos-acl resource share-mode to configure the QoS and ACL resource sharing mode.
Use undo qos-acl resource share-mode to restore the default.
Syntax
qos-acl resource share-mode inbound share-mode
undo qos-acl resource share-mode inbound
Default
No QoS and ACL resource sharing mode is configured.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
inbound: Specifies the inbound direction.
share-mode: Specifies a sharing mode. Only the preemption sharing mode is supported. In this mode, for all QoS policies applied to interfaces to take effect in sharing mode, you must specify the share-mode keyword when applying each QoS policy. This mode does not affect PBR policies or packet filters applied to interfaces.
Usage guidelines
You can configure the same sharing mode or different sharing modes in the inbound and outbound directions.
The sharing mode (specified by the share-mode keyword when QoS policy, packet filter, or PBR policy is applied to an interface) allows multiple interfaces to share one QoS and ACL resource if they are applied with the same QoS policy, packet filter, or PBR policy. In nonsharing mode, each interface occupies one QoS and ACL resource even if multiple interfaces are applied with the same QoS policy, packet filter, or PBR policy.
If you do not configure this command, the following rules apply:
· Only one QoS policy can be applied to the same direction of interfaces in sharing mode.
· Only one PBR policy can be applied to the same direction of interfaces in sharing mode.
· If a QoS policy has been applied to interfaces in sharing mode, no packet filter can be applied to the same direction of interfaces in sharing mode, and vice versa.
· Packet filters are not supported on aggregate interfaces.
For more information about QoS polices and the sharing mode, see ACL and QoS Command Reference. For more information about PBR polices and the sharing mode, see PBR commands in Layer 3—IP Routing Command Reference.
For this task to take effect, you must save the running configuration by using the save command and reboot the device.
The preemption sharing mode takes effect only on QoS policies applied after it is specified. For them to take effect on QoS policies applied before they are applied, perform one of the following tasks:
· Save the running configuration by using the save command and reboot the device.
· Remove the QoS policies applied before specifying the mqc-pbmp or preemption sharing mode, and reapply them after specifying the sharing mode.
This command is not supported on non-default MDCs.
Examples
# Configure the QoS and ACL resource sharing mode as preemption.
<Sysname> system-view
[Sysname] qos-acl resource share-mode inbound preemption
reset acl counter
Use reset acl counter to clear statistics for ACLs.
Syntax
reset acl [ ipv6 | mac | user-defined ] counter { acl-number | all | name acl-name }
Views
User view
Predefined user roles
network-admin
mdc-admin
Parameters
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
all: Clears statistics for all ACLs of the specified type.
name acl-name: Clears statistics of an ACL specified by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
Usage guidelines
When specifying an ACL by its number, follow these rules:
· To specify an IPv6 ACL, you must specify both its ACL number and the ipv6 keyword.
· To specify a Layer 2 ACL, you can specify its ACL number without the mac keyword.
· To specify a user-defined ACL, you can specify its ACL number without the user-defined keyword.
To specify an IPv6 ACL, Layer 2 ACL, or user-defined ACL by a name, you must specify both the ACL name and the ipv6, mac, or user-defined keyword.
Examples
# Clear statistics for IPv4 basic ACL 2001.
<Sysname> reset acl counter 2001
Related commands
display acl
reset packet-filter statistics
Use reset packet-filter statistics to clear the packet filtering statistics.
Syntax
reset packet-filter statistics { global | interface [ interface-type interface-number ] } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name }]
Views
User view
Predefined user roles
network-admin
mdc-admin
Parameters
global: Specifies all physical interfaces.
interface [ interface-type interface-number ]: Specifies an interface by its type and number. If you do not specify an interface, this command clears packet filtering statistics for all interfaces.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
user-defined: Specifies the user-defined ACL type.
acl-number: Specifies an ACL by its number. The following are available value ranges:
· 2000 to 2999 for basic ACLs.
· 3000 to 3999 for advanced ACLs.
· 4000 to 4999 for Layer 2 ACLs.
· 5000 to 5999 for user-defined ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
Usage guidelines
If acl-number, name acl-name, ipv6, mac, or user-defined is not specified, this command clears the packet filtering statistics for all ACLs.
To specify the IPv4 ACL type, do not specify the ipv6, mac, or user-defined keyword.
Examples
# Clear IPv4 basic ACL 2001 statistics for inbound packet filtering on Ten-GigabitEthernet 3/0/1.
<Sysname> reset packet-filter statistics interface ten-gigabitethernet 3/0/1 inbound 2001
Related commands
display packet-filter statistics
display packet-filter statistics sum
rule (IPv4 advanced ACL view)
Use rule to create or edit an IPv4 advanced ACL rule.
Use undo rule to delete an entire IPv4 advanced ACL rule or some attributes in the rule.
Syntax
rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | dest-address dest-wildcard | any } | destination-port { object-group port-group-name | operator port1 [ port2 ] } | { { precedence precedence | tos tos } * | { precedence precedence | ecn ecn } * | { dscp dscp | ecn ecn } * } | fragment | icmp-type { icmp-type [ icmp-code ] | icmp-message } | logging | qos-local-id local-id-value | source { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | source-address source-wildcard | any } | source-port { object-group port-group-name | operator port1 [ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ] *
rule [ rule-id ] { deny | permit } vxlan [ destination { dest-address dest-wildcard | any } | source { source-address source-wildcard | any } | source-port operator port1 [ port2 ] | vxlan-id vxlan-id ] * inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-wildcard | any } | inner-destination-port operator port1 [ port2 ] | { { inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * | inner-established } | inner-source { source-address source-wildcard | any } | { { inner-dscp inner-dscp | inner-ecn inner-ecn } * | { inner-ecn inner-ecn | inner-precedence inner-precedence } * | { inner-precedence inner-precedence | inner-tos inner-tos } * } | inner-source-port operator port1 [ port2 ] | logging | time-range time-range-name ] *
undo rule rule-id [ { { ack | fin | psh | rst | syn | urg } * | established } | counting | destination | destination-port | { { precedence | tos } * | { precedence | ecn } * | { dscp | ecn } * } | fragment | icmp-type | inner-destination | inner-destination-port | { { inner-ack | inner-fin | inner-psh | inner-rst | inner-syn | inner-urg } * | inner-established } | inner-source | inner-source-port | { { inner-dscp | inner-ecn } * | { inner-ecn | inner-precedence } * | { inner-precedence |inner-tos } * } | logging | qos-local-id | source | source-port | time-range | vpn-instance | vxlan-id ] *
undo rule { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | dest-address dest-wildcard | any } | destination-port { object-group port-group-name | operator port1 [ port2 ] } | { { precedence precedence | tos tos } * | { precedence precedence | ecn ecn } * | { dscp dscp | ecn ecn } * } | fragment | icmp-type { icmp-type [ icmp-code ] | icmp-message } | logging | qos-local-id | source { microsegment microsegment-id [ mask-length mask-length ] | source-address source-wildcard | any } | source-port { object-group port-group-name | operator port1 [ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ] *
undo rule { deny | permit } vxlan [ destination { dest-address dest-wildcard | any } | source { source-address source-wildcard | any } | source-port operator port1 [ port2 ] | vxlan-id vxlan-id ] * inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-wildcard | any } | inner-destination-port operator port1 [ port2 ] | { { inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * | inner-established } | inner-source { source-address source-wildcard | any } | inner-source-port operator port1 [ port2 ] |{ { inner-dscp inner-dscp | inner-ecn inner-ecn } * | { inner-ecn inner-ecn | inner-precedence inner-precedence } * | { inner-precedence inner-precedence | inner-tos inner-tos } * } | logging | time-range time-range-name ] *
Default
No IPv4 advanced ACL rules exist.
Views
IPv4 advanced ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30.
deny: Denies matching packets.
permit: Allows matching packets to pass.
protocol: Specifies a protocol carried over IPv4 by its number in the range of 0 to 255 or by its keyword, as shown in Table 7.
Table 7 Protocols carried over IPv4
|
Number |
Keyword |
Description |
|
N/A |
ip |
Matches IPv4 packets. |
|
1 |
icmp |
Matches ICMP packets. |
|
2 |
igmp |
Matches IGMP packets. |
|
4 |
ipinip |
Matches IP-in-IP packets. |
|
6 |
tcp |
Matches TCP packets. |
|
17 |
udp |
Matches UDP packets. |
|
47 |
gre |
Matches GRE packets. |
|
89 |
ospf |
Matches OSPF packets. |
Table 8 describes the parameters that you can specify, regardless of the value for the protocol argument.
Table 8 Match criteria and other rule information for IPv4 advanced ACL rules
|
Parameters |
Function |
Description |
|
source { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | source-address source-wildcard | any } |
Specifies a source address. |
The microsegment-id argument specifies a source microsegment ID in the range of 0 to 65535. Microsegment 0 is a system-defined microsegment and contains IP addresses that are not members of microsegments. The mask-length mask-length option specifies a mask length for an aggregate microsegment. The value range for the mask-length argument is 1 to the number of contiguous 0s of the decimal number converted from the aggregate microsegment ID. If a mask length is specified, the microsegment-id argument must be an even number other than 0. For more information about microsegments, see Security Configuration Guide. The address-group-name argument specifies an object group of source IP addresses. The source-address source-wildcard arguments specify a source IP address and a wildcard mask in dotted decimal notation. An all-zero wildcard represents a host address. The any keyword specifies any source IP address. |
|
destination { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | dest-address dest-wildcard | any } |
Specifies a destination address. |
The microsegment-id argument specifies a destination microsegment ID in the range of 0 to 65535. Microsegment 0 is a system-defined microsegment and contains IP addresses that are not members of a microsegment. The mask-length mask-length option specifies a mask length for an aggregate microsegment. The value range for the mask-length argument is 1 to the number of contiguous 0s of the decimal number converted from the aggregate microsegment ID. If a mask length is specified, the microsegment-id argument must be an even number other than 0. For more information about microsegments, see Security Configuration Guide. The address-group-name argument specifies an object group of destination IP addresses. The dest-address dest-wildcard arguments specify a destination IP address and a wildcard mask in dotted decimal notation. An all-zero wildcard mask represents a host address. The any keyword represents any destination IP address. |
|
counting |
Enables rule match counting in software. |
The counting keyword enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL. If the counting keyword is not specified, matches for the rule are not counted in software. |
|
precedence precedence |
Specifies an IP precedence value. |
The precedence argument can be a number in the range of 0 to 7, or in words: routine (0), priority (1), immediate (2), flash (3), flash-override (4), critical (5), internet (6), or network (7). |
|
tos tos |
Specifies a ToS preference. |
The tos argument can be a number in the range of 0 to 15, or in words: max-reliability (2), max-throughput (4), min-delay (8), min-monetary-cost (1), or normal (0). |
|
ecn ecn |
Specifies an ECN value. |
The ecn argument is a number in the range of 0 to 3. The last two bits in the differentiated services (DS) field of the IP header are defined for use by ECN. For more information about the DS field and ECN, see QoS configuration in ACL and QoS Configuration Guide. |
|
dscp dscp |
Specifies a DSCP priority. |
The dscp argument can be a number in the range of 0 to 63, or in words: af11 (10), af12 (12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42 (36), af43 (38), cs1 (8), cs2 (16), cs3 (24), cs4 (32), cs5 (40), cs6 (48), cs7 (56), default (0), or ef (46). |
|
fragment |
Applies the rule only to non-first fragments. |
If you do not specify any fragment-related parameters, the rule applies to all fragments and non-fragments. |
|
logging |
Logs the number of matching packets. |
This feature requires that the module (for example, packet filtering) that uses the ACL supports logging. |
|
time-range time-range-name |
Specifies a time range for the rule. |
The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide. |
|
qos-local-id local-id-value |
Specifies a local QoS ID. |
The value range for the local-id-value argument is 1 to 4095. The local QoS ID cannot be matched in the outbound direction. |
|
vpn-instance vpn-instance-name |
Applies the rule to an MPLS L3VPN instance. |
The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. For an ACL used to filter packets, if you do not specify a VPN instance, the rule applies to both non-VPN packets and VPN packets. The vpn-instance vpn-instance-name option is not supported in the outbound direction on an SF interface module. For an ACL used by other features, if you do not specify a VPN instance, the implementation varies by feature. For more information, see the configuration guide of the feature. |
If the protocol argument is tcp (6) or udp (17), set the parameters shown in Table 9.
Table 9 TCP/UDP-specific parameters for IPv4 advanced ACL rules
|
Parameters |
Function |
Description |
|
source-port { object-group port-group-name | operator port1 [ port2 ] } |
Specifies one or more UDP or TCP source ports. |
The port-group-name argument specifies an object group of ports. The operator argument can be lt (lower than), gt (greater than), eq (equal to), or range (inclusive range). The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range. TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), dns (53), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), and www (80). UDP port numbers can be represented as: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), and xdmcp (177). |
|
destination-port { object-group port-group-name | operator port1 [ port2 ] } |
Specifies one or more UDP or TCP destination ports. |
|
|
{ ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * |
Specifies one or more TCP flags including ACK, FIN, PSH, RST, SYN, and URG. |
Parameters specific to TCP. The value for each argument can be 0 (flag bit not set) or 1 (flag bit set). The TCP flags in a rule are ANDed. For example, a rule configured with ack 0 psh 1 matches packets that have the ACK flag bit not set and the PSH flag bit set. |
|
established |
Specifies the flags for indicating the established status of a TCP connection. |
Parameter specific to TCP. The rule matches TCP connection packets with the ACK or RST flag bit set. |
If the protocol argument is icmp (1), set the parameters shown in Table 10.
Table 10 ICMP-specific parameters for IPv4 advanced ACL rules
|
Parameters |
Function |
Description |
|
icmp-type { icmp-type icmp-code | icmp-message } |
Specifies the ICMP message type and code. |
The icmp-type argument is in the range of 0 to 255. The icmp-code argument is in the range of 0 to 255. The icmp-message argument specifies a message name. Supported ICMP message names and their corresponding type and code values are listed in Table 11. |
Table 11 ICMP message names supported in IPv4 advanced ACL rules
|
ICMP message name |
ICMP message type |
ICMP message code |
|
echo |
8 |
0 |
|
echo-reply |
0 |
0 |
|
fragmentneed-DFset |
3 |
4 |
|
host-redirect |
5 |
1 |
|
host-tos-redirect |
5 |
3 |
|
host-unreachable |
3 |
1 |
|
information-reply |
16 |
0 |
|
information-request |
15 |
0 |
|
net-redirect |
5 |
0 |
|
net-tos-redirect |
5 |
2 |
|
net-unreachable |
3 |
0 |
|
parameter-problem |
12 |
0 |
|
port-unreachable |
3 |
3 |
|
protocol-unreachable |
3 |
2 |
|
reassembly-timeout |
11 |
1 |
|
source-quench |
4 |
0 |
|
source-route-failed |
3 |
5 |
|
timestamp-reply |
14 |
0 |
|
timestamp-request |
13 |
0 |
|
ttl-exceeded |
11 |
0 |
vxlan: Specifies VXLAN encapsulation. You can specify a VXLAN ID only after you specify this keyword.
vxlan-id vxlan-id: Specifies a VXLAN ID in the range of 0 to 16777215.
inner-protocol inner-protocol: Specifies an inner protocol type by its number in the range of 0 to 255 or by its name: gre (47), icmp (1), igmp (2), ip, ipinip (4), ospf (89), tcp (6), or udp (17). The ip keyword specifies all inner protocols. Table 12 describes the parameters that you can specify, regardless of the value for the inner-protocol argument.
Table 12 Match criteria and other rule information for IPv4 advanced ACL rules
|
Parameters |
Function |
Description |
|
{ inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * |
Specifies one or more inner TCP flags including ACK, FIN, PSH, RST, SYN, and URG. |
Parameters specific to TCP. The value for each argument can be 0 (flag bit not set) or 1 (flag bit set). The inner TCP flags in a rule are ANDed. For example, a rule configured with ack 0 psh 1 matches packets that have the ACK flag bit not set and the PSH flag bit set. |
|
inner-established |
Specifies the inner flags for indicating the established status of a TCP connection. |
Parameter specific to the inner TCP protocol. The rule matches TCP connection packets with the ACK or RST flag bit set. |
|
inner-source { source-address source-wildcard | any } |
Specifies inner source IPv4 addresses. |
The source-address source-wildcard arguments represent an inner source IPv4 address and an inner wildcard mask in dotted decimal notation. An all-zero wildcard mask specifies a host address. The any keyword specifies any inner source IPv4 addresses. |
|
inner-destination { dest-address dest-wildcard | any } |
Specifies inner destination IPv4 addresses. |
The dest-address dest-wildcard arguments represent an inner destination IPv4 address and an inner wildcard mask in dotted decimal notation. An all-zero wildcard mask specifies a host address. The any keyword represents any inner destination IPv4 addresses. |
|
inner-precedence inner-precedence |
Specifies an inner IP precedence value. |
The inner-precedence argument can be a number in the range of 0 to 7, or in words: routine (0), priority (1), immediate (2), flash (3), flash-override (4), critical (5), internet (6), or network (7). |
|
inner-tos inner-tos |
Specifies an inner ToS preference. |
The inner-tos argument can be a number in the range of 0 to 15, or in words: max-reliability (2), max-throughput (4), min-delay (8), min-monetary-cost (1), or normal (0). |
|
inner-ecn inner-ecn |
Specifies an inner ECN value. |
The inner-ecn argument is a number in the range of 0 to 3. The last two bits in the differentiated services (DS) field of the IP header are defined for use by ECN. For more information about the DS field and ECN, see QoS configuration in ACL and QoS Configuration Guide. |
|
inner-dscp inner-dscp |
Specifies an inner DSCP priority. |
The inner-dscp argument can be a number in the range of 0 to 63, or in words: af11 (10), af12 (12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42 (36), af43 (38), cs1 (8), cs2 (16), cs3 (24), cs4 (32), cs5 (40), cs6 (48), cs7 (56), default (0), or ef (46). |
If the inner-protocol argument is tcp (6) or udp (17), set the parameters shown in Table 13.
Table 13 TCP/UDP-specific parameters for IPv4 advanced ACL rules
|
Parameters |
Function |
Description |
|
inner-source-port operator port1 [ port2 ] |
Specifies inner UDP or TCP source ports. |
The operator argument can be lt (lower than), gt (greater than), eq (equal to), or range (inclusive range). The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range. TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), dns (53), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), and www (80). UDP port numbers can be represented as: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), and xdmcp (177). The TCP port domain is saved as dns in the configuration file. |
|
inner-destination-port operator port1 [ port2 ] |
Specifies inner UDP or TCP destination ports. |
Usage guidelines
Only SF modules support matching the inner packet information of VXLAN packets.
In a QoS policy applied on an SD module, the microsegment parameter in an ACL match criterion of a traffic class does not take effect.
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
You can edit ACL rules only when the match order is config.
To view the existing IPv4 basic and advanced ACL rules, use the display acl all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for the rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
Examples
# Create an IPv4 advanced ACL rule to permit TCP packets with the destination port 80 from 129.9.0.0/16 to 202.38.160.0/24.
<Sysname> system-view
[Sysname] acl advanced 3000
[Sysname-acl-ipv4-adv-3000] rule permit tcp source 129.9.0.0 0.0.255.255 destination 202.38.160.0 0.0.0.255 destination-port eq 80
# Create IPv4 advanced ACL rules to permit all IP packets but the ICMP packets destined for 192.168.1.0/24.
<Sysname> system-view
[Sysname] acl advanced 3001
[Sysname-acl-ipv4-adv-3001] rule deny icmp destination 192.168.1.0 0.0.0.255
[Sysname-acl-ipv4-adv-3001] rule permit ip
# Create IPv4 advanced ACL rules to permit inbound and outbound FTP packets.
<Sysname> system-view
[Sysname] acl advanced 3002
[Sysname-acl-ipv4-adv-3002] rule permit tcp source-port eq ftp
[Sysname-acl-ipv4-adv-3002] rule permit tcp source-port eq ftp-data
[Sysname-acl-ipv4-adv-3002] rule permit tcp destination-port eq ftp
[Sysname-acl-ipv4-adv-3002] rule permit tcp destination-port eq ftp-data
# Create IPv4 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets.
<Sysname> system-view
[Sysname] acl advanced 3003
[Sysname-acl-ipv4-adv-3003] rule permit udp source-port eq snmp
[Sysname-acl-ipv4-adv-3003] rule permit udp source-port eq snmptrap
[Sysname-acl-ipv4-adv-3003] rule permit udp destination-port eq snmp
[Sysname-acl-ipv4-adv-3003] rule permit udp destination-port eq snmptrap
# Create an IPv4 advanced ACL rule to permit VXLAN packets whose inner source IP address is in subnet 192.168.1.0/24.
<Sysname> system-view
[Sysname] acl advanced 3004
[Sysname-acl-ipv4-adv-3004] rule permit vxlan inner-protocol ip inner-source 192.168.1.0 0.0.0.255
# Create an IPv4 advanced ACL rule to permit the IP packets with its source IP address as a member of microsegment 1 and its destination IP address as a member of microsegment 2.
<Sysname> system-view
[Sysname] acl advanced 3005
[Sysname-acl-adv-3005] rule permit ip source microsegment 1 destination microsegment 2
Related commands
acl
acl logging interval
display acl
microsegment (Security Command Reference)
microsegment aggregation (Security Command Reference)
step
time-range
rule (IPv4 basic ACL view)
Use rule to create or edit an IPv4 basic ACL rule.
Use undo rule to delete an entire IPv4 basic ACL rule or some attributes in the rule.
Syntax
rule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { object-group address-group-name | source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
undo rule rule-id [ counting | fragment | logging | source | time-range | vpn-instance ] *
undo rule { deny | permit } [ counting | fragment | logging | source { object-group address-group-name | source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
Default
No IPv4 basic ACL rules exist.
Views
IPv4 basic ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30.
deny: Denies matching packets.
permit: Allows matching packets to pass.
counting: Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software.
fragment: Applies the rule only to non-first fragments. If you do not specify this keyword, the rule applies to both fragments and non-fragments.
logging: Logs the number of matching packets. This feature is available only when the application module (for example, packet filtering) that uses the ACL supports the logging feature.
source { object-group address-group-name | source-address source-wildcard | any }: Matches a source address. The object-group address-group-name option specifies an object group of source IP addresses. The source-address and source-wildcard arguments specify a source IP address and a wildcard mask in dotted decimal notation. A wildcard mask of zeros represents a host address. The any keyword represents any source IP address.
time-range time-range-name: Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide.
vpn-instance vpn-instance-name: Applies the rule to an MPLS L3VPN instance. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. For an ACL used to filter packets, if you do not specify a VPN instance, the rule applies to both non-VPN packets and VPN packets. The vpn-instance vpn-instance-name option is not supported in the outbound direction on an SF interface module. For an ACL used by other features, if you do not specify a VPN instance, the implementation varies by feature. For more information, see the configuration guide of the feature.
Usage guidelines
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
You can edit ACL rules only when the match order is config.
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL.
To view the existing IPv4 basic and advanced ACL rules, use the display acl all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for the rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify
all the attributes of the rule for the command.
Examples
# Create a rule in IPv4 basic ACL 2000 to deny the packets from any source IP subnet but 10.0.0.0/8, 172.17.0.0/16, or 192.168.1.0/24.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] rule permit source 10.0.0.0 0.255.255.255
[Sysname-acl-ipv4-basic-2000] rule permit source 172.17.0.0 0.0.255.255
[Sysname-acl-ipv4-basic-2000] rule permit source 192.168.1.0 0.0.0.255
[Sysname-acl-ipv4-basic-2000] rule deny source any
Related commands
acl
acl logging interval
display acl
step
time-range
rule (IPv6 advanced ACL view)
Use rule to create or edit an IPv6 advanced ACL rule.
Use undo rule to delete an entire IPv6 advanced ACL rule or some attributes in the rule.
Syntax
rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port { object-group port-group-name | operator port1 [ port2 ] } | { dscp dscp | ecn ecn } * | flow-label flow-label-value | fragment | icmp6-type { icmp6-type icmp6-code | icmp6-message } | logging | qos-local-id local-id-value | source { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | source-address source-prefix | source-address/source-prefix | any } | source-port { object-group port-group-name | operator port1 [ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ] *
rule [ rule-id ] { deny | permit } vxlan [ vxlan-id vxlan-id ] inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-prefix | dest-address/dest-prefix | any } | inner-destination-port operator port1 [ port2 ] | { { inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * | inner-established } | inner-source { source-address source-prefix | source-address/source-prefix | any } | inner-source-port operator port1 [ port2 ] | { inner-dscp inner-dscp | inner-ecn inner-ecn } * | logging | time-range time-range-name ] *
rule [ rule-id ] { deny | permit } vxlan-ipv6 [ destination { dest-address dest-prefix | dest-address/dest-prefix | any } | source { source-address source-prefix | source-address/source-prefix | any } | source-port operator port1 [ port2 ] | vxlan-id vxlan-id ] * inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-prefix | dest-address/dest-prefix | any } | inner-destination-port operator port1 [ port2 ] | { { inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * | inner-established } | inner-source { source-address source-prefix | source-address/source-prefix | any } | inner-source-port operator port1 [ port2 ] | { inner-dscp inner-dscp | inner-ecn inner-ecn } * | logging | time-range time-range-name ] *
undo rule rule-id [ { { ack | fin | psh | rst | syn | urg } * | established } | counting | destination | destination-port | { dscp | ecn } * | flow-label | fragment | icmp6-type | inner-destination | inner-destination-port | { { inner-ack | inner-fin | inner-psh | inner-rst | inner-syn | inner-urg } * | inner-established } | inner-source | inner-source-port | { inner-dscp | inner-ecn } * | logging | qos-local-id | source | source-port | time-range | vpn-instance | vxlan-id ] *
undo rule { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port { object-group port-group-name | operator port1 [ port2 ] } | { dscp dscp | ecn ecn } * | flow-label flow-label-value | fragment | icmp6-type { icmp6-type icmp6-code | icmp6-message } | logging | qos-local-id | | source { microsegment microsegment-id [ mask-length mask-length ] | object-group address-group-name | source-address source-prefix | source-address/source-prefix | any } | source-port { object-group port-group-name | operator port1 [ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ] *
undo rule { deny | permit } vxlan [ vxlan-id vxlan-id ] inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-prefix | dest-address/dest-prefix | any } | inner-destination-port operator port1 [ port2 ] | { { inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * | inner-established } | inner-source { source-address source-prefix | source-address/source-prefix | any } | inner-source-port operator port1 [ port2 ] | { inner-dscp inner-dscp | inner-ecn inner-ecn } * | logging | time-range time-range-name ] *
undo rule { deny | permit } vxlan-ipv6 [ destination { dest-address dest-prefix | dest-address/dest-prefix | any } | source { source-address source-prefix | source-address/source-prefix | any } | source-port operator port1 [ port2 ] | vxlan-id vxlan-id ] * inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-prefix | dest-address/dest-prefix | any } | inner-destination-port operator port1 [ port2 ] | { { inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * | inner-established } | inner-source { source-address source-prefix | source-address/source-prefix | any } | inner-source-port operator port1 [ port2 ] | { inner-dscp inner-dscp | inner-ecn inner-ecn } * | logging | time-range time-range-name ] *
Default
No IPv6 advanced ACL rules exist.
Views
IPv6 advanced ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30.
deny: Denies matching packets.
permit: Allows matching packets to pass.
protocol: Specifies a protocol carried over IPv6 by its number in the range of 0 to 255 or by its keyword, as shown in Table 14.
Table 14 Protocols carried over IPv6
|
Number |
Keyword |
Description |
|
N/A |
ipv6 |
Matches IPv6 packets. |
|
1 |
icmpv6 |
Matches ICMPv6 packets. |
|
6 |
tcp |
Matches TCP packets. |
|
17 |
udp |
Matches UDP packets. |
|
47 |
gre |
Matches GRE packets. |
|
50 |
ipv6-esp |
Matches IPv6-ESP packets. |
|
51 |
ipv6-ah |
Matches IPv6-AH packets. |
|
89 |
ospf |
Matches OSPF packets. |
Table 15 describes the parameters that you can specify, regardless of the value for the protocol argument.
Table 15 Match criteria and other rule information for IPv6 advanced ACL rules
|
Parameters |
Function |
Description |
|
source { microsegment microsegment-id [ mask-length mask-length ] | source-address source-prefix | source-address/source-prefix | any } |
Specifies a source IPv6 address. |
The microsegment-id argument specifies a source microsegment ID in the range of 0 to 65535. Microsegment 0 is a system-defined microsegment and contains IP addresses that are not members of a microsegment. The mask-length mask-length argument specifies a mask length for an aggregate microsegment. The value range for the argument is 1 to the number of contiguous 0s of the decimal number converted from the aggregate microsegment ID. If a mask length is specified, the microsegment-id argument must be an even number other than 0. For more information about microsegments, see Security Configuration Guide. The source-address argument specifies an IPv6 source address. The source-prefix argument specifies a prefix length in the range of 1 to 128. The any keyword represents any IPv6 source address. |
|
destination { microsegment microsegment-id [ mask-length mask-length ] | dest-address dest-prefix | dest-address/dest-prefix | any } |
Specifies a destination IPv6 address. |
The microsegment-id argument specifies a destination microsegment ID in the range of 0 to 65535. Microsegment 0 is a system-defined microsegment and contains IP addresses that are not members of a microsegment. The mask-length mask-length option specifies a mask length for an aggregate microsegment. The value range for the mask-length argument is 1 to the number of contiguous 0s of the decimal number converted from the aggregate microsegment ID. If a mask length is specified, the microsegment-id argument must be an even number other than 0. For more information about microsegments, see Security Configuration Guide. The dest-address argument specifies a destination IPv6 address. The dest-prefix argument specifies a prefix length in the range of 1 to 128. The any keyword represents any IPv6 destination address. |
|
counting |
Enables rule match counting in software. |
The counting keyword enables match counting specific to rules, and the hardware-count keyword in the packet-filter ipv6 command enables match counting in hardware for all rules in an ACL. If the counting keyword is not specified, matches for the rule are not counted in software. |
|
dscp dscp |
Specifies a DSCP preference. |
The dscp argument can be a number in the range of 0 to 63, or in words, af11 (10), af12 (12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42 (36), af43 (38), cs1 (8), cs2 (16), cs3 (24), cs4 (32), cs5 (40), cs6 (48), cs7 (56), default (0), or ef (46). |
|
ecn ecn |
Specifies an ECN value. |
The ecn argument is a number in the range of 0 to 3. This value represents the last two bits (ECN field) in the differentiated services (DS) field of the IP header. For more information about the DS field and ECN, see QoS configuration in ACL and QoS Configuration Guide. |
|
flow-label flow-label-value |
Specifies a flow label value in an IPv6 packet header. |
The flow-label-value argument is in the range of 0 to 1048575. |
|
fragment |
Applies the rule only to non-first fragments. |
If you do not specify any fragment-related parameters, the rule applies to all fragments and non-fragments. |
|
logging |
Logs the number of matching packets. |
This feature requires that the module (for example, packet filtering) that uses the ACL supports logging. |
|
time-range time-range-name |
Specifies a time range for the rule. |
The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide. |
|
qos-local-id local-id-value |
Specifies a local QoS ID. |
The value range for the local-id-value argument is 1 to 4095. The local QoS ID cannot be matched in the outbound direction. |
|
vpn-instance vpn-instance-name |
Applies the rule to an MPLS L3VPN instance. |
The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. For an ACL used to filter packets, if you do not specify a VPN instance, the rule applies to both non-VPN packets and VPN packets. The vpn-instance vpn-instance-name option is not supported in the outbound direction on an SF interface module For an ACL used by other features, if you do not specify a VPN instance, the implementation varies by feature. For more information, see the configuration guide of the feature. |
If the protocol argument is tcp (6) or udp (17), set the parameters shown in Table 16.
Table 16 TCP/UDP-specific parameters for IPv6 advanced ACL rules
|
Parameters |
Function |
Description |
|
source-port operator port1 [ port2 ] |
Specifies one or more UDP or TCP source ports. |
The operator argument can be lt (lower than), gt (greater than), eq (equal to), or range (inclusive range). The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range. TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), dns (53), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), and www (80). UDP port numbers can be represented as: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), and xdmcp (177). |
|
destination-port operator port1 [ port2 ] |
Specifies one or more UDP or TCP destination ports. |
|
|
{ ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * |
Specifies one or more TCP flags, including ACK, FIN, PSH, RST, SYN, and URG. |
Parameters specific to TCP. The value for each argument can be 0 (flag bit not set) or 1 (flag bit set). The TCP flags in a rule are ANDed. For example, a rule configured with ack 0 psh 1 matches packets that have the ACK flag bit not set and the PSH flag bit set. |
|
established |
Specifies the flags for indicating the established status of a TCP connection. |
Parameter specific to TCP. The rule matches TCP packets with the ACK or RST flag bit set. |
If the protocol argument is icmpv6 (58), set the parameters shown in Table 17.
Table 17 ICMPv6-specific parameters for IPv6 advanced ACL rules
|
Parameters |
Function |
Description |
|
icmp6-type { icmp6-type icmp6-code | icmp6-message } |
Specifies the ICMPv6 message type and code. |
The icmp6-type argument is in the range of 0 to 255. The icmp6-code argument is in the range of 0 to 255. The icmp6-message argument specifies a message name. Supported ICMP message names and their corresponding type and code values are listed in Table 18. |
Table 18 ICMPv6 message names supported in IPv6 advanced ACL rules
|
ICMPv6 message name |
ICMPv6 message type |
ICMPv6 message code |
|
echo-reply |
129 |
0 |
|
echo-request |
128 |
0 |
|
err-Header-field |
4 |
0 |
|
frag-time-exceeded |
3 |
1 |
|
hop-limit-exceeded |
3 |
0 |
|
host-admin-prohib |
1 |
1 |
|
host-unreachable |
1 |
3 |
|
neighbor-advertisement |
136 |
0 |
|
neighbor-solicitation |
135 |
0 |
|
network-unreachable |
1 |
0 |
|
packet-too-big |
2 |
0 |
|
port-unreachable |
1 |
4 |
|
redirect |
137 |
0 |
|
router-advertisement |
134 |
0 |
|
router-solicitation |
133 |
0 |
|
unknown-ipv6-opt |
4 |
2 |
|
unknown-next-hdr |
4 |
1 |
vxlan: Matches IPv4 VXLAN packets. The outer five-tuple is not available for matching IPv4 VXLAN packets
vxlan-ipv6: Matches IPv6 VXLAN packets.
vxlan-id vxlan-id: Specifies a VXLAN ID in the range of 0 to 16777215.
inner-protocol: Specifies one of the following values:
· A protocol number in the range of 0 to 255.
· A protocol name: gre (47), icmpv6 (58), ipv6, ospf (89), tcp (6), or udp (17). The ipv6 keyword specifies all protocols.
Table 19 describes the parameters that you can specify, regardless of the value for the protocol argument.
Table 19 Match criteria and other rule information for IPv6 advanced ACL rules
|
Parameters |
Function |
Description |
|
{ inner-ack inner-ack-value | inner-fin inner-fin-value | inner-psh inner-psh-value | inner-rst inner-rst-value | inner-syn inner-syn-value | inner-urg inner-urg-value } * |
Specifies one or more inner TCP flags including ACK, FIN, PSH, RST, SYN, and URG. |
Parameters specific to TCP. The value for each argument can be 0 (flag bit not set) or 1 (flag bit set). The inner TCP flags in a rule are ANDed. For example, a rule configured with ack 0 psh 1 matches packets that have the ACK flag bit not set and the PSH flag bit set. |
|
inner-established |
Specifies the inner flags for indicating the established status of a TCP connection. |
Parameter specific to the inner TCP protocol. The rule matches TCP connection packets with the ACK or RST flag bit set to 1. |
|
inner-source { source-address source-prefix | any } |
Specifies inner source IPv6 addresses. |
The source-address source-prefix arguments represent an inner source IPv4 address and an inner wildcard mask in dotted decimal notation. The value range for the dest-prefix argument is 1 to 128. The any keyword specifies any inner source IPv4 addresses. |
|
inner-destination { dest-address dest-prefix | any } |
Specifies inner destination IPv6 addresses. |
The dest-address dest-prefix arguments represent an inner destination IPv6 address and an inner wildcard mask in dotted decimal notation. The value range for the dest-prefix argument is 1 to 128. The any keyword represents any inner destination IPv6 addresses. |
|
inner-dscp inner-dscp |
Specifies an inner DSCP priority. |
The dscp argument can be a number in the range of 0 to 63, or in words: af11 (10), af12 (12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42 (36), af43 (38), cs1 (8), cs2 (16), cs3 (24), cs4 (32), cs5 (40), cs6 (48), cs7 (56), default (0), or ef (46). |
|
inner-ecn inner-ecn |
Specifies an inner ECN value. |
The ecn argument is a number in the range of 0 to 3. The last two bits in the differentiated services (DS) field of the IP header are defined for use by ECN. For more information about the DS field and ECN, see QoS configuration in ACL and QoS Configuration Guide. |
If the protocol argument is tcp (6) or udp (17), set the parameters shown in Table 20.
Table 20 TCP/UDP-specific parameters for IPv6 advanced ACL rules
|
Parameters |
Function |
Description |
|
inner-source-port operator port1 [ port2 ] |
Specifies inner UDP or TCP source ports. |
The operator argument can be lt (lower than), gt (greater than), eq (equal to), neq (not equal to), or range (inclusive range). The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range. TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), dns (53), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), and www (80). UDP port numbers can be represented as: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), and xdmcp (177). The TCP port domain is saved as dns in the configuration file. |
|
inner-destination-port operator port1 [ port2 ] |
Specifies inner UDP or TCP destination ports. |
Usage guidelines
Only SF interface modules support matching the inner header information of VXLAN packets.
If an IPv6 advanced ACL is used for outbound QoS traffic classification or outbound packet filtering, do not specify the flow-label parameter.
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
The object group you specify when creating or editing a rule must already exist. Otherwise, the rule will not be created or changed.
In a QoS policy applied on an SD module, the microsegment parameter in an ACL match criterion of a traffic class does not take effect.
You can edit ACL rules only when the match order is config.
To view the existing IPv6 basic and advanced ACL rules, use the display acl ipv6 all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for a rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
Examples
<Sysname> system-view
[Sysname] acl ipv6 advanced 3000
[Sysname-acl-ipv6-adv-3000] rule permit tcp source 2030:5060::/64 destination fe80:5060::/96 destination-port eq 80
# Create IPv6 advanced ACL rules to permit all IPv6 packets but the ICMPv6 packets destined for FE80:5060:1001::/48.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3001
[Sysname-acl-ipv6-adv-3001] rule deny icmpv6 destination fe80:5060:1001:: 48
[Sysname-acl-ipv6-adv-3001] rule permit ipv6
# Create IPv6 advanced ACL rules to permit inbound and outbound FTP packets.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3002
[Sysname-acl-ipv6-adv-3002] rule permit tcp source-port eq ftp
[Sysname-acl-ipv6-adv-3002] rule permit tcp source-port eq ftp-data
[Sysname-acl-ipv6-adv-3002] rule permit tcp destination-port eq ftp
[Sysname-acl-ipv6-adv-3002] rule permit tcp destination-port eq ftp-data
# Create IPv6 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3003
[Sysname-acl-ipv6-adv-3003] rule permit udp source-port eq snmp
[Sysname-acl-ipv6-adv-3003] rule permit udp source-port eq snmptrap
[Sysname-acl-ipv6-adv-3003] rule permit udp destination-port eq snmp
[Sysname-acl-ipv6-adv-3003] rule permit udp destination-port eq snmptrap
# Create an IPv6 advanced ACL rule to permit the IPv6 packets with its source IPv6 address as a member of microsegment 1 and its destination IPv6 address as a member of microsegment 2.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3006
[Sysname-acl-ipv6-adv-3006] rule permit ipv6 source microsegment 1 destination microsegment 2
Related commands
acl
acl logging interval
display acl
microsegment (Security Command Reference)
microsegment aggregation (Security Command Reference)
step
time-range
rule (IPv6 basic ACL view)
Use rule to create or edit an IPv6 basic ACL rule.
Use undo rule to delete an entire IPv6 basic ACL rule or some attributes in the rule.
Syntax
rule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { object-group address-group-name | source-address source-prefix | source-address/source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
undo rule rule-id [ counting | fragment | logging | source | time-range | vpn-instance ] *
undo rule { deny | permit } [ counting | fragment | logging | source { object-group address-group-name | source-address source-prefix | source-address/source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
Default
No IPv6 basic ACL rules exist.
Views
IPv6 basic ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30.
deny: Denies matching packets.
permit: Allows matching packets to pass.
counting: Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software.
fragment: Applies the rule only to non-first fragments. If you do not specify this keyword, the rule applies to both fragments and non-fragments.
logging: Logs the number of matching packets. This feature is available only when the application module (for example, packet filtering) that uses the ACL supports the logging feature.
source { source-address source-prefix | source-address/source-prefix | any }: Matches a source IPv6 address. The source-address argument specifies a source IPv6 address. The source-prefix argument specifies an address prefix length in the range of 1 to 128. The any keyword represents any IPv6 source address.
time-range time-range-name: Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide.
vpn-instance vpn-instance-name: Applies the rule to an MPLS L3VPN instance. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. For an ACL used to filter packets, if you do not specify a VPN instance, the rule applies to both non-VPN packets and VPN packets. The vpn-instance vpn-instance-name option is not supported in the outbound direction on an SF interface module. For an ACL used by other features, if you do not specify a VPN instance, the implementation varies by feature. For more information, see the configuration guide of the feature
Usage guidelines
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
You can edit ACL rules only when the match order is config.
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter ipv6 command enables match counting in hardware for all rules in an ACL.
To view the existing IPv6 basic and advanced ACL rules, use the display acl ipv6 all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for a rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
Examples
# Create an IPv6 basic ACL rule to deny the packets from any source IP subnet but 1001::/16, 3124:1123::/32, or FE80:5060:1001::/48.
<Sysname> system-view
[Sysname] acl ipv6 basic 2000
[Sysname-acl-ipv6-basic-2000] rule permit source 1001:: 16
[Sysname-acl-ipv6-basic-2000] rule permit source 3124:1123:: 32
[Sysname-acl-ipv6-basic-2000] rule permit source fe80:5060:1001:: 48
[Sysname-acl-ipv6-basic-2000] rule deny source any
Related commands
acl
acl logging interval
display acl
step
time-range
rule (Layer 2 ACL view)
Use rule to create or edit a Layer 2 ACL rule.
Use undo rule to delete an entire Layer 2 ACL rule or some attributes in the rule.
Syntax
rule [ rule-id ] { deny | permit } [ cos dot1p | counting | dest-mac dest-address dest-mask | type protocol-type protocol-type-mask | source-mac source-address source-mask | time-range time-range-name ] *
rule [ rule-id ] { deny | permit } vxlan [ counting | dest-mac dest-address dest-mask | inner-dest-mac inner-dest-address inner-dest-mask | inner-source-mac inner-source-address inner-source-mask | inner-type inner-protocol-type inner-protocol-type-mask | source-mac source-address source-mask | time-range time-range-name | type protocol-type protocol-type-mask | vxlan-id vxlan-id ] *
undo rule rule-id [ counting | time-range ] *
undo rule { deny | permit } [ cos dot1p | counting | dest-mac dest-address dest-mask | type protocol-type protocol-type-mask | source-mac source-address source-mask | time-range time-range-name ] *
undo rule { deny | permit } vxlan [ counting | dest-mac dest-address dest-mask | inner-dest-mac inner-dest-address inner-dest-mask | inner-source-mac inner-source-address inner-source-mask | inner-type inner-protocol-type inner-protocol-type-mask | source-mac source-address source-mask | time-range time-range-name | type protocol-type protocol-type-mask | vxlan-id vxlan-id ] *
Default
No Layer 2 ACL rules exist.
Views
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30.
deny: Denies matching packets.
permit: Allows matching packets to pass.
cos dot1p: Matches an 802.1p priority. The 802.1p priority can be specified by one of the following values:
· A priority number in the range of 0 to 7.
· A priority name: best-effort (0), background (1), spare (2), excellent-effort (3), controlled-load (4), video (5), voice (6), or network-management (7).
counting: Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software.
dest-mac dest-address dest-mask: Matches a destination MAC address range. The dest-address and dest-mask arguments represent a destination MAC address and mask in the H-H-H format.
type protocol-type protocol-type-mask: Matches one or more protocols in the Layer 2. The protocol-type argument is a hexadecimal number that represents a protocol type in Ethernet_II and Ethernet_SNAP frames. The value range for the protocol-type argument is 0 to ffff. The protocol-type-mask argument is a hexadecimal number that represents a protocol type mask. The value range for the protocol-type-mask argument is 0 to ffff for the inbound direction of SF interface modules. For the outbound direction of SF interface modules and on SD interface modules, the protocol-type-mask argument can only be ffff.
source-mac source-address source-mask: Matches a source MAC address range. The source-address argument represents a source MAC address, and the sour-mask argument represents a mask in the H-H-H format.
time-range time-range-name: Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide.
vxlan: Specifies VXLAN encapsulation.
vxlan-id vxlan-id: Specifies a VXLAN ID in the range of 0 to 16777215.
inner-type inner-protocol-type inner-protocol-type-mask: Matches inner link layer protocols. The inner-protocol-type argument is a 16-bit hexadecimal number that represents a protocol type in inner Ethernet_II and Ethernet_SNAP frames. The protocol-type-mask argument is a 16-bit hexadecimal number that represents a protocol type mask.
inner-source-mac inner-source-address inner-source-mask: Matches an inner source MAC address range. The inner-source-address argument represents an inner source MAC address in the H-H-H format and the inner-source-mask argument represents a mask in the H-H-H format.
inner-dest-mac inner-dest-address inner-dest-mask: Matches an inner destination MAC address range. The inner-dest-address and inner-dest-mask arguments represent an inner destination MAC address and a mask in the H-H-H format.
Usage guidelines
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
You can edit ACL rules only when the match order is config.
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL.
To view the existing Layer 2 ACL rules, use the display acl mac all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for the rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
In the outbound direction of SF interface modules and on the SD interface modules, to match IPv6 packets based on the source MAC address, or destination MAC address, or 802.1p priority, you must specify the type parameter, and the protocol-type argument must be 86dd.
Only SF interface modules support matching the inner header information of VXLAN packets.
Examples
# Create a rule in Layer 2 ACL 4000 to permit ARP packets and deny RARP packets.
<Sysname> system-view
[Sysname] acl mac 4000
[Sysname-acl-mac-4000] rule permit type 0806 ffff
[Sysname-acl-mac-4000] rule deny type 8035 ffff
# Create a rule in Layer 2 ACL 4001 to permit VXLAN packets whose VXLAN ID is 300.
<Sysname> system-view
[Sysname] acl mac 4001
[Sysname-acl-mac-4001] rule permit vxlan vxlan-id 300
Related commands
acl
display acl
step
time-range
rule (user-defined ACL view)
Use rule to create or edit a user-defined ACL rule.
Use undo rule to delete a user-defined ACL rule.
Syntax
Command set 1:
rule [ rule-id ] { deny | permit } [ { { l2 | l4 } rule-string rule-mask offset }&<1-8> ] [ counting | time-range time-range-name ] *
undo rule rule-id
undo rule { deny | permit } [ { { l2 | l4 } rule-string rule-mask offset }&<1-8> ] [ counting | time-range time-range-name ] *
Command set 2:
rule [ rule-id ] { deny | permit } [ ipv6-protocol ] protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | destination { dest-address dest-wildcard | any | microsegment microsegment-id [ mask-length mask-length ] } | destination-port { operator port1 [ port2 ] } | { { precedence precedence | tos tos } * | { precedence precedence | ecn ecn } * | { dscp dscp | ecn ecn } * } | source { source-address source-wildcard | any | microsegment microsegment-id [ mask-length mask-length ] } | source-port { operator port1 [ port2 ] } | vpn-instance vpn-instance-name ] * [ { { l2 | l4 } rule-string rule-mask offset }&<1-8> ] [ counting | time-range time-range-name ] *
undo rule rule-id [ ipv6-protocol ] [ { { ack | fin | psh | rst | syn | urg } * | established } | destination | destination-port | { { precedence | tos } * | { precedence | ecn } * | { dscp | ecn } * } | source | source-port | vpn-instance | l2 | l4 | counting | time-range ] *
undo rule { deny | permit } [ ipv6-protocol ] protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | destination { dest-address dest-wildcard | any | microsegment microsegment-id [ mask-length mask-length ] } | destination-port { operator port1 [ port2 ] } } | { { precedence precedence | tos tos } * | { precedence precedence | ecn ecn } * | { dscp dscp | ecn ecn } * } | source { source-address source-wildcard | any | microsegment microsegment-id [ mask-length mask-length ] } | source-port { operator port1 [ port2 ] } | vpn-instance vpn-instance-name ] * [ { { l2 | l4 } rule-string rule-mask offset }&<1-8> ] [ counting | time-range time-range-name ] *
Default
No user-defined ACL rules exist.
Views
User-defined ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from 0. The numbering step for user-defined ACLs is fixed at 5. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30.
deny: Denies matching packets.
permit: Allows matching packets to pass.
l2: Specifies that the offset is relative to the beginning of the Layer 2 frame header.
l4: Specifies that the offset is relative to the beginning of the Layer 4 header.
rule-string: Defines a match pattern in hexadecimal format. Its length must be a multiple of two.
rule-mask: Defines a match pattern mask in hexadecimal format. Its length must be the same as that of the match pattern. A match pattern mask is used for ANDing the selected string of a packet.
offset: Specifies an offset in bytes after which the match operation begins.
&<1-8>: Specifies that up to eight match patterns can be defined in the ACL rule.
counting: Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software.
time-range time-range-name: Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide.
ipv6-protocol: Matches IPv6 packets. If you do not specify this parameter, the command matches IPv4 packets.
protocol: Specifies one of the following values:
· For IPv4:
¡ A protocol number in the range of 0 to 255.
¡ A protocol by its name: gre (47), icmp (1), igmp (2), ip, ipinip (4), ospf (89), tcp (6), or udp (17). The ip keyword specifies all protocols.
· For IPv6:
¡ A protocol number in the range of 0 to 255.
¡ A protocol by its name: gre (47), icmpv6 (58), ipv6, ipv6-ah (51), ipv6-esp (50), ospf (89), tcp (6), or udp (17). The ipv6 keyword specifies all protocols.
If the protocol argument is tcp (6), set the parameters shown in Table 21.
Table 21 TCP-specific parameters for user-defined ACL rules
|
Parameters |
Function |
Description |
|
ack ack-value |
Specifies one or more TCP flags including ACK, FIN, PSH, RST, SYN, and URG. |
The value for each argument can be 0 (flag bit not set) or 1 (flag bit set). The TCP flags in a rule are ANDed. For example, a rule configured with ack 0 psh 1 matches packets that have the ACK flag bit not set and the PSH flag bit set. |
|
fin fin-value |
||
|
psh psh-value |
||
|
rst rst-value |
||
|
syn syn-value |
||
|
urg urg-value |
||
|
established |
Specifies the flags for indicating the established status of a TCP connection. |
The rule matches TCP connection packets with the ACK or RST flag bit set to 1. |
precedence precedence: Specifies an IP precedence value in the range of 0 to 7 or specifies one of the following keywords: routine (0), priority (1), immediate (2), flash (3), flash-override (4), critical (5), internet (6), and network (7).
tos tos: Specifies a ToS value in the range of 0 to 15 or specifies one of the following keywords: max-reliability (2), max-throughput (4), min-delay (8), min-monetary-cost (1), and normal (0).
dscp dscp: Specifies a DSCP value, which can be a number from 0 to 63 or a keyword in Table 22.
Table 22 DSCP keywords and values
|
Keyword |
DSCP value (binary) |
DSCP value (decimal) |
|
af11 |
001010 |
10 |
|
af12 |
001100 |
12 |
|
af13 |
001110 |
14 |
|
af21 |
010010 |
18 |
|
af22 |
010100 |
20 |
|
af23 |
010110 |
22 |
|
af31 |
011010 |
26 |
|
af32 |
011100 |
28 |
|
af33 |
011110 |
30 |
|
af41 |
100010 |
34 |
|
af42 |
100100 |
36 |
|
af43 |
100110 |
38 |
|
cs1 |
001000 |
8 |
|
cs2 |
010000 |
16 |
|
cs3 |
011000 |
24 |
|
cs4 |
100000 |
32 |
|
cs5 |
101000 |
40 |
|
cs6 |
110000 |
48 |
|
cs7 |
111000 |
56 |
|
default |
000000 |
0 |
|
ef |
101110 |
46 |
ecn ecn: Specifies an ECN value in the range of 0 to 3. The last two bits in the differentiated services (DS) field of the IP header are defined for use by ECN. For more information about the DS field and ECN, see QoS configuration in ACL and QoS Configuration Guide.
source { source-address source-wildcard | any }: Specifies a source IP address.
· The source-address source-wildcard arguments specify a source IP address and a wildcard mask in dotted decimal notation. An all-zero wildcard represents a host address.
· The any keyword specifies any source IP address.
destination { dest-address dest-wildcard | any }: Specifies a destination IP address.
· The dest-address dest-wildcard arguments specify a destination IP address and a wildcard mask in dotted decimal notation. An all-zero wildcard represents a host address.
· The any keyword specifies any destination IP address.
source microsegment microsegment-id [ mask-length mask-length ]: Specifies source microsegments.
destination microsegment microsegment-id [ mask-length mask-length ]: Specifies destination microsegments.
· microsegment-id: Secifies a destination microsegment ID in the range of 0 to 65535. Microsegment 0 is a system-defined microsegment and contains IP addresses that are not members of microsegments.
· mask-length mask-length: Specifies a mask length for an aggregate microsegment. The value range for the argument is 1 to the number of contiguous 0s of the decimal number converted from the aggregate microsegment ID. If the aggregate microsegment has not been created, it is automtically created and can be displayed by using the display acl command instead of the display microsegment aggregation command.
source-port { operator port1 [ port2 ] }: Specifies one or more source TCP or UDP ports.
· The operator argument can be lt (lower than), gt (greater than), eq (equal to), neq (not equal to), or range (inclusive range).
· The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range.
destination-port { operator port1 [ port2 ] }: Specifies one or more destination TCP or UDP ports.
· The operator argument can be lt (lower than), gt (greater than), eq (equal to), neq (not equal to), or range (inclusive range).
· The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range.
vpn-instance vpn-instance-name: Applies the rule to an MPLS L3VPN instance. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. For an ACL used to filter packets, if you do not specify a VPN instance, the rule applies only to non-VPN packets. For an ACL used by other features, if you do not specify a VPN instance, the implementation varies by feature. For more information, see the configuration guide of the feature.
Usage guidelines
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
If the rule ID has been used when you create a rule, the contents in the new rule are incrementally added to the existing rule.
A user-defined ACL takes effect on only incoming packets on SF interface modules and can only match the first 128 bytes of a packet.
Both the undo rule rule-id command and the undo rule { deny | permit } command can delete an entire rule. When you use the undo rule { deny | permit } command, you must specify all the attributes of the rule. The undo rule { deny | permit } command is used to delete rules without rule IDs created by scripts.
For command set 2:
· In addition to user-defined strings, a rule can use the source IP address, destination IP address, port number, and protocol type to match packets.
· To match TCP packets, specify tcp for the protocol argument.
· To match UDP packets, specify udp for the protocol argument, and specify l4 for offset purposes.
· To match IP packets, specify ip for the protocol argument, and specify l4 for offset purposes.
· You can use the undo rule rule-id command to delete some attributes of the rule by specifying keywords in the command or delete the entire rule without specifying any keywords.
· For a rule to take effect, do not configure both IPv4 and IPv6 attributes in the rule.
· The precedence and tos parameters cannot be used to match IPv6 packets.
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL.
To view the existing user-defined ACL rules, use the display acl user-defined all command.
Examples
# Create a rule for user-defined ACL 5005 to permit ARP packets where the 12th and 13th bytes starting from the Layer 2 header are 0x0806.
<Sysname> system-view
[Sysname] acl user-defined 5005
[Sysname-acl-user-5005] rule permit l2 0806 ffff 12
# Create a rule for user-defined ACL 5006 to allow hosts in subnet 129.9.0.0/16 to establish connections with destination port 80 on hosts in subnet 202.38.160.0/24.
<Sysname> system-view
[Sysname] acl user-defined 5006
[Sysname-acl-user-5006] rule permit tcp source 129.9.0.0 0.0.255.255 destination 202.38.160.0 0.0.0.255
# Create a rule for user-defined ACL 5007 to allow hosts in subnet 2030:5060::/64 to establish connections with destination port 80 on hosts in subnet FE80:5060::/96.
<Sysname> system-view
[Sysname] acl user-defined 5007
[Sysname-acl-user-5007] rule permit ipv6-protocol tcp source 2030:5060::/64 destination fe80:5060::/96
# Create a rule for user-defined ACL 5009 to allow the TCP packets with the ACK bit set to pass through.
<Sysname> system-view
[Sysname] acl user-defined 5009
[Sysname-acl-user-5009] rule permit tcp ack 1
Related commands
acl
display acl
microsegment (Security Command Reference)
microsegment aggregation (Security Command Reference)
time-range
rule comment
Use rule comment to configure a comment for an ACL rule.
Use undo rule comment to delete an ACL rule comment.
Syntax
rule rule-id comment text
undo rule rule-id comment
Default
A rule does not have a comment.
Views
IPv4 basic/advanced ACL view
IPv6 basic/advanced ACL view
Layer 2 ACL view
User-defined ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies an ACL rule ID in the range of 0 to 65534. The ACL rule must already exist.
text: Specifies a comment about the ACL rule, a case-sensitive string of 1 to 127 characters.
Usage guidelines
This command adds a comment to a rule if the rule does not have a comment. It modifies the comment for a rule if the rule already has a comment.
Examples
# Create a rule for IPv4 basic ACL 2000, and add a comment about the rule.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] rule 0 deny source 1.1.1.1 0
[Sysname-acl-ipv4-basic-2000] rule 0 comment This rule is used on ten-gigabitethernet 3/0/1.
Related commands
display acl
rule remark
Use rule remark to insert a remark for an ACL rule.
Use undo rule remark to delete ACL rule remarks.
Syntax
rule [ rule-id ] remark text
undo rule [ rule-id ] remark [ text ]
Default
An ACL rule does not have a remark.
Views
IPv4 basic/advanced ACL view
IPv6 basic/advanced ACL view
Layer 2 ACL view
User-defined ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
rule-id: Specifies an ACL rule ID in the range of 0 to 65534. The ACL rule can be an existing or nonexistent one. The rule ID determines the position where a remark is placed:
· For the config match order, if the rule ID is the same as an existing rule ID, the device inserts the remark before the existing rule. If the rule ID is a new rule ID, the device inserts the remark according to ascending order of rule IDs.
· For the auto match order, if the rule ID is the same as an existing rule ID, the device inserts the remark before the existing rule. If the rule ID is a new rule ID, the device inserts the remark at the end of the ACL rules.
text: Specifies a remark for the ACL rule, a case-sensitive string of 1 to 127 characters.
Usage guidelines
If you do not specify the rule-id argument in the rule remark command, the system automatically assigns a rule ID to the remark. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from 0.
If you do not specify the rule-id or text argument in the undo rule remark command, the system deletes all rule remarks. If you do not specify the rule-id argument but specify the text argument, the system deletes only the specified remark.
Examples
# Add remarks Rules for VIP_start and Rules for VIP_end for rule 10 and rule 25, respectively, to indicate that rule 10, rule 15, rule 20, and rule 25 are designed for VIP users.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-basic-2000] rule 10 remark Rules for VIP_start
[Sysname-acl-basic-2000] rule 26 remark Rules for VIP_end
[Sysname-acl-basic-2000] display this
#
acl number 2000
rule 0 permit source 14.1.1.0 0.0.0.255
rule 5 permit source 10.1.1.1 0 time-range work-time
rule 10 remark Rules for VIP_start
rule 10 permit source 192.168.0.0 0.0.0.255
rule 15 permit source 1.1.1.1 0
rule 20 permit source 10.1.1.1 0
rule 25 permit counting
rule 26 remark Rules for VIP_end
#
return
Related commands
display acl
step
Use step to set a rule numbering step for an ACL.
Use undo step to restore the default.
Syntax
step step-value [ start start-value ]
undo step
Default
The rule numbering step is 5, and the start rule ID is 0.
Views
IPv4 basic/advanced ACL view
IPv6 basic/advanced ACL view
Layer 2 ACL view
Predefined user roles
network-admin
mdc-admin
Parameters
step-value: Specifies the ACL rule numbering step in the range of 1 to 20.
start start-value: Specifies the start rule ID in the range of 0 to 20.
Usage guidelines
The rule numbering step sets the increment by which the system numbers rules automatically. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 12, the rule is numbered 15.
The wider the numbering step, the more rules you can insert between two rules. Whenever the step or start rule ID changes, the rules are renumbered, starting from the start rule ID. For example, if there are five rules numbered 0, 5, 9, 10, and 15, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4, 6, and 8.
Examples
# Set the rule numbering step to 2 for IPv4 basic ACL 2000.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] step 2
Related commands
display acl
