1-11Note that:z You can modify any existent rule of a user-defined ACL. If you modify only the timerange and/or action, the unmodified parts of the rule remain the same. If you modify therule-string rule-mask offset combinations, however, the new combinations will replaceall of the original ones.z If you do not specify the rule-id argument when creating an ACL rule, the rule will benumbered automatically. If the ACL has no rules, the rule is numbered 0; otherwise, thenumber of the rule will be the greatest rule number plus one. If the current greatest rulenumber is 65534, however, the system will tell you that the rule cannot be created andyou need to specify a number for the rule.z The content of a modified or created rule cannot be identical with the content of anyexisting rules; otherwise the rule modification or creation will fail, and the systemprompts that the rule already exists.Configuration example# Configure ACL 5000 to deny all TCP packets. In the ACL rule, 06 is the TCP protocolnumber, ff is the mask of the rule, and 31 is the protocol field offset of an internallyprocessed IP packet. system-view[Sysname] acl number 5000[Sysname-acl-user-5000] rule deny 06 ff 31# Display the configuration information of ACL 5000.[Sysname-acl-user-5000] display acl 5000User defined ACL 5000, 1 ruleAcl's step is 1rule 0 deny 06 ff 31Configuring IPv6 ACLYou can match IPv6 packets by IPv6 ACLs to process IPv6 data flows as required. Thenumber of an IPv6 ACL is in the range from 5000 to 5999.S5600 Series Ethernet switches support matching the following fields:z cos: Matches the CoS field in IPv6 packets.z dest-ip: Matches the destination IP address field in IPv6 packets.z dest-mac: Matches the destination MAC address field in IPv6 packets.z double-tag: Matches IPv6 packets with two tags.z dscp: Matches the traffic class field in IPv6 packets.z ip-protocol: Matches the next header field in IPv6 packets.z ipv6-type: Matches IPv6 packets with the Layer 2 protocol being IPv6.z src-ip: Matches the source address field in IPv6 packets.z dest-ip: Matches the destination address field in IPv6 packets.z src-port: Matches the TCP/UDP source port field in IPv6 packets.z dest-port: Matches the TCP/UDP destination port field in IPv6 packets.
