1-5A referenced time range can be one that has not been created yet. The rule, however, can take effectonly after the time range is defined and comes active.IP Fragments Filtering with IPv4 ACLTraditional packet filtering performs match operation on, rather than all IP fragments, the first ones only.All subsequent non-first fragments are handled in the way the first fragments are handled. This causessecurity risk as attackers may fabricate non-first fragments to attack your network.A rule defined with the fragment keyword applies to only IP fragments. Note that a rule defined with thefragment keyword matches non-last IP fragments on an SA or EA Series LPUs while matching non-firstIP fragments on an SC, EB, or SD Series LPUs. For detailed information about types of LPUs, refer tothe 3Com S7900E Family Getting Started Guide.Introduction to IPv6 ACLThis section covers these topics:z IPv6 ACL Classificationz IPv6 ACL Namingz IPv6 ACL Match Orderz IPv6 ACL Stepz Effective Period of an IPv6 ACLIPv6 ACL ClassificationIPv6 ACLs, identified by ACL numbers, fall into three categories, as show in Table 1-2.Table 1-2 IPv6 ACL categoriesCategory ACL number Matching criteriaBasic IPv6 ACL 2000 to 2999 Source IPv6 addressAdvanced IPv6 ACL 3000 to 3999Source IPv6 address, destinationIPv6 address, protocol carried onIPv6, and other Layer 3 or Layer 4protocol header fieldsIPv6 ACL NamingWhen creating an IPv6 ACL, you can specify a unique name for it. Afterwards, you can identify the IPv6ACL by its name.An IPv6 ACL can have only one name. Whether to specify a name for an ACL is up to you. After creatingan ACL, you cannot specify a name for it, nor can you change or remove the name of the ACL.
