HP 6125G HP 6125G & 6125G/XG Blade Switches ACL and QoS Command Refere - Page 27

ICMP message name, display acl all, vpn-instance, counting, time-range, Do not specify

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 27 highlights

ICMP message name ttl-exceeded ICMP message type 11 ICMP message code 0 Description Use rule to create or edit an IPv4 advanced ACL rule. You can edit ACL rules only when the match order is config. Use undo rule to delete an entire IPv4 advanced ACL rule or some attributes in the rule. If no optional keywords are provided, you delete the entire rule. If optional keywords or arguments are provided, you delete the specified attributes. By default, an IPv4 advanced ACL does not contain any rule. Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating or editing has the same deny or permit statement as another rule in the ACL, your creation or editing attempt will fail. To view rules in an ACL and their rule IDs, use the display acl all command. If an IPv4 advanced ACL is for QoS traffic classification or packet filtering: • Do not specify the vpn-instance keyword. • Do not specify neq for the operator argument. • The counting keyword (even if specified) does not take effect for QoS traffic classification. Related commands: acl, display acl, step, and time-range. Examples # Create an IPv4 advanced ACL rule to permit TCP packets with the destination port 80 from 129.9.0.0/16 to 202.38.160.0/24. system-view [Sysname] acl number 3000 [Sysname-acl-adv-3000] rule permit tcp source 129.9.0.0 0.0.255.255 destination 202.38.160.0 0.0.0.255 destination-port eq 80 # Create IPv4 advanced ACL rules to permit all IP packets but the ICMP packets destined for 192.168.1.0/24. system-view [Sysname] acl number 3001 [Sysname-acl-adv-3001] rule permit ip [Sysname-acl-adv-3001] rule deny icmp destination 192.168.1.0 0.0.0.255 # Create IPv4 advanced ACL rules to permit inbound and outbound FTP packets. system-view [Sysname] acl number 3002 [Sysname-acl-adv-3002] rule permit tcp source-port eq ftp [Sysname-acl-adv-3002] rule permit tcp source-port eq ftp-data [Sysname-acl-adv-3002] rule permit tcp destination-port eq ftp [Sysname-acl-adv-3002] rule permit tcp destination-port eq ftp-data # Create IPv4 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets. system-view [Sysname] acl number 3003 [Sysname-acl-adv-3003] rule permit udp source-port eq snmp 22

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
22
ICMP message name
ICMP message type
ICMP message code
ttl-exceeded
11
0
Description
Use
rule
to create or edit an IPv4 advanced ACL rule. You can edit ACL rules only when the match order
is config.
Use
undo
rule
to delete an entire IPv4 advanced ACL rule or some attributes in the rule. If no optional
keywords are provided, you delete the entire rule. If optional keywords or arguments are provided, you
delete the specified attributes.
By default, an IPv4 advanced ACL does not contain any rule.
Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating
or editing has the same deny or permit statement as another rule in the ACL, your creation or editing
attempt will fail.
To view rules in an ACL and their rule IDs, use the
display acl all
command.
If an IPv4 advanced ACL is for QoS traffic classification or packet filtering:
•
Do not specify the
vpn-instance
keyword.
•
Do not specify
neq
for the
operator
argument.
•
The
counting
keyword (even if specified) does not take effect for QoS traffic classification.
Related commands:
acl
,
display acl
,
step
, and
time-range
.
Examples
# Create an IPv4 advanced ACL rule to permit TCP packets with the destination port 80 from
129.9.0.0/16 to 202.38.160.0/24.
<Sysname> system-view
[Sysname] acl number 3000
[Sysname-acl-adv-3000] rule permit tcp source 129.9.0.0 0.0.255.255 destination
202.38.160.0 0.0.0.255 destination-port eq 80
# Create IPv4 advanced ACL rules to permit all IP packets but the ICMP packets destined for
192.168.1.0/24.
<Sysname> system-view
[Sysname] acl number 3001
[Sysname-acl-adv-3001] rule permit ip
[Sysname-acl-adv-3001] rule deny icmp destination 192.168.1.0 0.0.0.255
# Create IPv4 advanced ACL rules to permit inbound and outbound FTP packets.
<Sysname> system-view
[Sysname] acl number 3002
[Sysname-acl-adv-3002] rule permit tcp source-port eq ftp
[Sysname-acl-adv-3002] rule permit tcp source-port eq ftp-data
[Sysname-acl-adv-3002] rule permit tcp destination-port eq ftp
[Sysname-acl-adv-3002] rule permit tcp destination-port eq ftp-data
# Create IPv4 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets.
<Sysname> system-view
[Sysname] acl number 3003
[Sysname-acl-adv-3003] rule permit udp source-port eq snmp