Operation Manual – ACLH3C S3100 Series Ethernet Switches Chapter 1 ACL Configuration1-7Acl's step is 1rule 0 deny source 192.168.0.1 01.2.3 Configuring Advanced ACLAn advanced ACL can filter packets by their source and destination IP addresses, theprotocols carried by IP, and protocol-specific features such as TCP/UDP source anddestination ports, ICMP message type and message code.An advanced ACL can be numbered from 3000 to 3999. Note that ACL 3998 and ACL3999 cannot be configured because they are reserved for cluster management.Advanced ACLs support analysis and processing of three packet priority levels: type ofservice (ToS) priority, IP priority and differentiated services codepoint (DSCP) priority.Using advanced ACLs, you can define classification rules that are more accurate, moreabundant, and more flexible than those defined for basic ACLs.I. Configuration Prerequisitesz To configure a time range-based advanced ACL rule, you need to create thecorresponding time ranges first. For information about of time range configuration,refer to section 1.2.1 Configuring Time Range.z The settings to be specified in the rule, such as source and destination IPaddresses, the protocols carried by IP, and protocol-specific features, aredetermined.II. Configuration ProcedureTable 1-3 Define an advanced ACL ruleOperation Command DescriptionEnter system view system-view —Create anadvanced ACL andenter advancedACL viewacl number acl-number[ match-order { auto |config } ]Requiredconfig by defaultDefine an ACL rule rule [ rule-id ] { permit |deny } protocol [ rule-string ]RequiredFor information about protocoland rule-string, refer to ACLCommands.Assign adescription stringto the ACL rulerule rule-id comment text OptionalNo description by defaultAssign adescription stringto the ACLdescription text OptionalNo description by default
