Operation Manual – ACLH3C S5600 Series Ethernet Switches Chapter 1 ACL Configuration1-18II. Network diagramFigure 1-6 Network diagram for user-defined ACLIII. Configuration procedure# Define a periodic time range that is active from 8:00 to 18:00 everyday. system-view[Sysname] time-range test 8:00 to 18:00 daily# Define ACL 5000 to deny any ARP packet whose source IP address is 192.168.0.1from 8:00 to 18:00 everyday. In the ACL rule, 0806 is the ARP protocol number, ffff isthe mask of the rule, 20 is the protocol type field offset of the internally processedEthernet frame, c0a80001 is the hexadecimal form of 192.168.0.1, and 36 is the sourceIP address field offset of the internally processed ARP packet.[Sysname] acl number 5000[Sysname-acl-user-5000] rule 1 deny 0806 ffff 20 c0a80001 ffffffff 36time-range test# Apply ACL 5000 on GigabitEthernet 1/0/1.[Sysname] interface GigabitEthernet1/0/1[Sysname-GigabitEthernet1/0/1] packet-filter inbound user-group 50001.5.5 Example for Applying an ACL to a VLANI. Network requirementsPC 1, PC 2 and PC 3 belong to VLAN 10 and connect to the switch throughGigabitEthernet 1/0/1, GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 respectively.The IP address of the database server is 192.168.1.2. Apply an ACL to deny packetsfrom PCs in VLAN 10 to the database server from 8:00 to 18:00 in working days.
