H3C SR6600 Configuration Manual

Also see for SR6600 SPE-FWM: Configuration guide Configuration guide Command reference Command reference Command reference

Contents

1-13rule 5 deny ip destination 192.168.0.100 0 time-range work (Inactive)IPv6 ACL Configuration ExampleNetwork RequirementsA company interconnects its departments through Device. Configure an ACL to deny access from alldepartments but the President’s office to the salary server during working hours (from 8:00 to 18:00) onworking days.Figure 1-2 Network diagram for IPv6 ACL configurationConfiguration Procedure# Create a periodic time range from 8:00 to 18:00 on working days. system-view[DeviceA] time-range work 8:0 to 18:0 working-day# Create an IPv6 advanced ACL numbered 3000 and configure two rules in the ACL. One rule allowsaccess from the President’s office to the salary server, and the other denies access from otherdepartments to the salary server in the time range.[DeviceA] acl ipv6 number 3000[DeviceA-acl6-adv-3000] rule permit ipv6 source 1001:: 4 destination 1000::100 128[DeviceA-acl6-adv-3000] rule deny ipv6 source any destination 1000::100 128 time-range work[DeviceA-acl6-adv-3000] quit# Enable IPv6 firewall, and apply IPv6 ACL 3000 to filter outgoing packets on interface GigabitEthernet1/0/1.[DeviceA] firewall ipv6 enable[DeviceA] interface gigabitethernet 1/0/1[DeviceA-GigabitEthernet1/0/1] firewall packet-filter ipv6 3000 outboundVerification# Display the configuration and match statistics for IPv6 ACL 3000.[DeviceA] display acl ipv6 3000Advanced IPv6 ACL 3000, named -none-, 2 rules,ACL's step is 5rule 0 permit ipv6 source 1000::/4 destination 1000::100/128rule 5 deny ipv6 destination 1000::100/128 time-range work (Inactive)