1-5Configuration ProcedureTable 1-2 Define a basic ACL ruleOperation Command DescriptionEnter system view system-view —Create an ACL andenter basic ACL viewacl number acl-number [ match-order{ auto | config } ]Requiredconfig by defaultDefine an ACL rule rule [ rule-id ] { deny | permit }[ rule-string ]RequiredFor information aboutrule-string, refer to ACLCommand.Configure a descriptionstring to the ACL description text OptionalNot configured by defaultNote that:z With the config match order specified for the basic ACL, you can modify any existent rule. Theunmodified part of the rule remains. With the auto match order specified for the basic ACL, youcannot modify any existent rule; otherwise the system prompts error information.z If you do not specify the rule-id argument when creating an ACL rule, the rule will be numberedautomatically. If the ACL has no rules, the rule is numbered 0; otherwise, the number of the rule willbe the greatest rule number plus one. If the current greatest rule number is 65534, however, thesystem will display an error message and you need to specify a number for the rule.z The content of a modified or created rule cannot be identical with the content of any existing rule;otherwise the rule modification or creation will fail, and the system prompts that the rule alreadyexists.z With the auto match order specified, the newly created rules will be inserted in the existent ones bydepth-first principle, but the numbers of the existent rules are unaltered.Configuration Example# Configure ACL 2000 to deny packets whose source IP addresses are 192.168.0.1. system-view[Sysname] acl number 2000[Sysname-acl-basic-2000] rule deny source 192.168.0.1 0# Display the configuration information of ACL 2000.[Sysname-acl-basic-2000] display acl 2000Basic ACL 2000, 1 ruleAcl's step is 1rule 0 deny source 192.168.0.1 0Configuring Advanced ACLAn advanced ACL can filter packets by their source and destination IP addresses, the protocols carriedby IP, and protocol-specific features such as TCP/UDP source and destination ports, ICMP messagetype and message code.An advanced ACL can be numbered from 3000 to 3999. Note that ACL 3998 and ACL 3999 cannot beconfigured because they are reserved for cluster management.
