1-18Network diagramFigure 1-6 Network diagram for user-defined ACLConfiguration procedure# Define a periodic time range that is active from 8:00 to 18:00 everyday. system-view[Sysname] time-range test 8:00 to 18:00 daily# Define ACL 5000 to deny any ARP packet whose source IP address is 192.168.0.1 from8:00 to 18:00 everyday. In the ACL rule, 0806 is the ARP protocol number, ffff is the maskof the rule, 20 is the protocol type field offset of the internally processed Ethernet frame,c0a80001 is the hexadecimal form of 192.168.0.1, and 36 is the source IP address fieldoffset of the internally processed ARP packet.[Sysname] acl number 5000[Sysname-acl-user-5000] rule 1 deny 0806 ffff 20 c0a80001 ffffffff 36 time-rangetest# Apply ACL 5000 on GigabitEthernet 1/0/1.[Sysname] interface GigabitEthernet1/0/1[Sysname-GigabitEthernet1/0/1] packet-filter inbound user-group 5000Example for Applying an ACL to a VLANNetwork requirementsPC 1, PC 2 and PC 3 belong to VLAN 10 and connect to the switch through GigabitEthernet1/0/1, GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 respectively. The IP address of thedatabase server is 192.168.1.2. Apply an ACL to deny packets from PCs in VLAN 10 to thedatabase server from 8:00 to 18:00 in working days.
