HP Moonshot-45XGc Guia do Utilizador descarregar pdf (Página 38)

Predefined user roles

network-admin

Parameters

rule-id: Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an

ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the

numbering step to the current highest rule ID, starting from 0. For example, if the rule numbering step is

5 and the current highest rule ID is 28, the rule is numbered 30.

deny: Denies matching packets.

permit: Allows matching packets to pass.

l2: Specifies that the offset is relative to the beginning of the Layer 2 frame header.

rule-string: Defines a match pattern in hexadecimal format. Its length must be a multiple of two.

rule-mask: Defines a match pattern mask in hexadecimal format. Its length must be the same as that of the

match pattern. A match pattern mask is used for ANDing the selected string of a packet.

offset: Specifies an offset in bytes after which the match operation begins.

&<1-8>: Specifies that up to eight match patterns can be defined in the ACL rule.

counting: Counts the number of times the user-defined ACL rule has been matched. The counting

keyword enables match counting specific to rules, and the hardware-count keyword in the packet-filter

command enables match counting for all rules in an ACL. If the counting keyword is not specified,

matches for the rule are not counted.

time-range time-range-name: Specifies a time range for the rule. The time-range-name argument is a

case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not

configured, the system creates the rule. However, the rule using the time range can take effect only after

you configure the timer range. For more information about time range, see ACL and QoS Configuration

Guide.

Usage guidelines

Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating

or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created

or changed.

To view rules in an ACL and their rule IDs, use the display acl all command.

Examples

# Create a rule for user-defined ACL 5005 to permit packets in which the 13th and 14th bytes starting

from the Layer 2 header are 0x0806 (the ARP packets).

<Sysname> system-view

[Sysname] acl number 5005

[Sysname-acl-user-5005] rule permit l2 0806 ffff 12

Related commands

• acl

• display acl

• time-range

1 2 ... 33 34 35 36 37 38 39 40 41 42 43 ... 123 124

Sem comentários

HP Moonshot-45XGc Guia do Utilizador Página 38