H3C S5820X Series Acl And Qos Command Reference

Also see for s5800 series: Installation manual Instruction manual Command reference Quick start Troubleshooting guide

Contents

H3C S5820X Series Acl And Qos Command Reference Manual pdf 39 page image

28To view rules in an ACL and their rule IDs, use the display acl ipv6 all command.Related commands: acl ipv6, display ipv6 acl, and step.NOTE:If an IPv6 advanced ACL is for packet filtering, the operator cannot be neq.If an IPv6 advanced ACL is for QoS traffic classification:• Do not specify the fragment keyword or specify neq for theoperator argument. The keywords can causeACL application failure.• The logging and counting keywords (even if specified) do not take effect for QoS.Examples# Create an IPv6 ACL rule to permit TCP packets with the destination port of 80 from 2030:5060::/64to FE80:5060::/96. system-view[Sysname] acl ipv6 number 3000[Sysname-acl6-adv-3000] rule permit tcp source 2030:5060::/64 destination fe80:5060::/96destination-port eq 80rule (IPv6 basic ACL view)Syntaxrule [ rule-id ] { deny | permit } [ counting | fragment | logging | source { ipv6-address prefix-length |ipv6-address/prefix-length | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *undo rule rule-id [ counting | fragment | logging | source | time-range | vpn-instance ] *ViewIPv6 basic ACL viewDefault level2: System levelParametersrule-id: Specifies a rule ID, which ranges from 0 to 65534. If no rule ID is provided when you create anACL rule, the system automatically assigns it a rule ID. This rule ID takes the nearest higher multiple of thenumbering step to the current highest rule ID, starting from 0. For example, if the rule numbering step is5 and the current highest rule ID is 28, the rule is numbered 30.deny: Denies matching packets.permit: Allows matching packets to pass.counting: Counts the number of times the IPv6 ACL rule has been matched in hardware.fragment: Applies the rule only to non-first fragments. A rule without this keyword applies to bothfragments and non-fragments.logging: Logs matching packets.source { ipv6-address prefix-length | ipv6-address/prefix-length | any }: Matches a source IP address.The ipv6-address and prefix-length arguments represent a source IPv6 address and address prefix lengthin the range 1 to 128. The any keyword represents any IPv6 source address.