Operation Manual – ACLH3C S3100 Series Ethernet Switches Chapter 1 ACL Configuration1-8Note that:z With the config match order specified for the advanced ACL, you can modify anyexistent rule. The unmodified part of the rule remains. With the auto match orderspecified for the ACL, you cannot modify any existent rule; otherwise the systemprompts error information.z If you do not specify the rule-id argument when creating an ACL rule, the rule willbe numbered automatically. If the ACL has no rules, the rule is numbered 0;otherwise, the number of the rule will be the greatest rule number plus one. If thecurrent greatest rule number is 65534, however, the system will display an errormessage and you need to specify a number for the rule.z The content of a modified or created rule cannot be identical with the content ofany existing rules; otherwise the rule modification or creation will fail, and thesystem prompts that the rule already exists.z If the ACL is created with the auto keyword specified, the newly created rules willbe inserted in the existent ones by depth-first principle, but the numbers of theexistent rules are unaltered.III. Configuration Example# Configure ACL 3000 to permit the TCP packets sourced from the network129.9.0.0/16 and destined for the network 202.38.160.0/24 and with the destinationport number being 80. system-view[Sysname] acl number 3000[Sysname-acl-adv-3000] rule permit tcp source 129.9.0.0 0.0.255.255destination 202.38.160.0 0.0.0.255 destination-port eq 80# Display the configuration information of ACL 3000.[Sysname-acl-adv-3000] display acl 3000Advanced ACL 3000, 1 ruleAcl's step is 1rule 0 permit tcp source 129.9.0.0 0.0.255.255 destination 202.38.160.00.0.0.255 destination-port eq www1.2.4 Configuring Layer 2 ACLLayer 2 ACLs filter packets according to their Layer 2 information, such as the sourceand destination MAC addresses, VLAN priority, and Layer 2 protocol types.A Layer 2 ACL can be numbered from 4000 to 4999.I. Configuration Prerequisitesz To configure a time range-based Layer 2 ACL rule, you need to create thecorresponding time ranges first. For information about time range configuration,refer to section 1.2.1 Configuring Time Range
