HP 6125G HP 6125G & 6125G/XG Blade Switches ACL and QoS Command Refere - Page 33

rule (IPv6 basic ACL view), Examples, Syntax

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 33 highlights

Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating or editing has the same deny or permit statement as another rule in the ACL, your creation or editing attempt will fail. To view rules in an ACL and their rule IDs, use the display acl ipv6 all command. If an IPv6 advanced ACL is for QoS traffic classification or packet filtering: • Do not specify the fragment or routing keyword, or specify neq for the operator argument. • Do not specify the flow-label keyword if the ACL is for outbound QoS traffic classification or outbound packet filtering. • The counting keyword (even if specified) does not take effect for QoS traffic classification. Related commands: acl ipv6, display ipv6 acl, step, and time-range. Examples # Create an IPv6 ACL rule to permit TCP packets with the destination port 80 from 2030:5060::/64 to FE80:5060::/96. system-view [Sysname] acl ipv6 number 3000 [Sysname-acl6-adv-3000] rule permit tcp source 2030:5060::/64 destination fe80:5060::/96 destination-port eq 80 # Create IPv6 advanced ACL rules to permit all IPv6 packets but the ICMPv6 packets destined for FE80:5060:1001::/48. system-view [Sysname] acl ipv6 number 3001 [Sysname-acl6-adv-3001] rule permit ipv6 [Sysname-acl6-adv-3001] rule deny icmpv6 destination fe80:5060:1001:: 48 # Create IPv6 advanced ACL rules to permit inbound and outbound FTP packets. system-view [Sysname] acl ipv6 number 3002 [Sysname-acl6-adv-3002] rule permit tcp source-port eq ftp [Sysname-acl6-adv-3002] rule permit tcp source-port eq ftp-data [Sysname-acl6-adv-3002] rule permit tcp destination-port eq ftp [Sysname-acl6-adv-3002] rule permit tcp destination-port eq ftp-data # Create IPv6 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets. system-view [Sysname] acl ipv6 number 3003 [Sysname-acl6-adv-3003] rule permit udp source-port eq snmp [Sysname-acl6-adv-3003] rule permit udp source-port eq snmptrap [Sysname-acl6-adv-3003] rule permit udp destination-port eq snmp [Sysname-acl6-adv-3003] rule permit udp destination-port eq snmptrap rule (IPv6 basic ACL view) Syntax rule [ rule-id ] { deny | permit } [ counting | fragment | routing [ type routing-type ] | source { ipv6-address prefix-length | ipv6-address/prefix-length | any } | time-range time-range-name ] * undo rule rule-id [ counting | fragment | routing | source | time-range ] * 28

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
28
Within an ACL, the permit or deny statement of each rule must be unique. If the ACL rule you are creating
or editing has the same deny or permit statement as another rule in the ACL, your creation or editing
attempt will fail.
To view rules in an ACL and their rule IDs, use the
display acl ipv6 all
command.
If an IPv6 advanced ACL is for QoS traffic classification or packet filtering:
•
Do not specify the
fragment
or
routing
keyword, or specify
neq
for the
operator
argument.
•
Do not specify the
flow-label
keyword if the ACL is for outbound QoS traffic classification or
outbound packet filtering.
•
The
counting
keyword (even if specified) does not take effect for QoS traffic classification.
Related commands:
acl ipv6
,
display ipv6 acl
,
step
, and
time-range
.
Examples
# Create an IPv6 ACL rule to permit TCP packets with the destination port 80 from 2030:5060::/64 to
FE80:5060::/96.
<Sysname> system-view
[Sysname] acl ipv6 number 3000
[Sysname-acl6-adv-3000] rule permit tcp source 2030:5060::/64 destination fe80:5060::/96
destination-port eq 80
# Create IPv6 advanced ACL rules to permit all IPv6 packets but the ICMPv6 packets destined for
FE80:5060:1001::/48.
<Sysname> system-view
[Sysname] acl ipv6 number 3001
[Sysname-acl6-adv-3001] rule permit ipv6
[Sysname-acl6-adv-3001] rule deny icmpv6 destination fe80:5060:1001:: 48
# Create IPv6 advanced ACL rules to permit inbound and outbound FTP packets.
<Sysname> system-view
[Sysname] acl ipv6 number 3002
[Sysname-acl6-adv-3002] rule permit tcp source-port eq ftp
[Sysname-acl6-adv-3002] rule permit tcp source-port eq ftp-data
[Sysname-acl6-adv-3002] rule permit tcp destination-port eq ftp
[Sysname-acl6-adv-3002] rule permit tcp destination-port eq ftp-data
# Create IPv6 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets.
<Sysname> system-view
[Sysname] acl ipv6 number 3003
[Sysname-acl6-adv-3003] rule permit udp source-port eq snmp
[Sysname-acl6-adv-3003] rule permit udp source-port eq snmptrap
[Sysname-acl6-adv-3003] rule permit udp destination-port eq snmp
[Sysname-acl6-adv-3003] rule permit udp destination-port eq snmptrap
rule (IPv6 basic ACL view)
Syntax
rule
[
rule-id
] {
deny
|
permit
} [
counting
|
fragment
|
routing
[
type
routing-type
]
|
source
{
ipv6-address
prefix-length
|
ipv6-address
/
prefix-length
| any
} |
time-range
time-range-name
] *
undo
rule
rule-id
[
counting
|
fragment
|
routing
|
source
|
time-range
] *