12IPv4 fragments filtering with ACLsTraditional packet filtering matched only first fragments of IPv4 packets, and allowed allsubsequent non-first fragments to pass through. This mechanism resulted in security risks,because attackers may fabricate non-first fragments to attack networks.To avoids the risks, the H3C ACL implementation:Filters all fragments by default, including non-first fragments.Provides standard and exact match modes for matching ACLs that containadvanced attributes such as TCP/UDP port number and ICMP type. Standardmatch is the default mode. It considers only Layer 3 attributes. Exact matchconsiders all header attributes defined in IPv4 ACL rules.ACL configuration task listIPv4 ACL configuration task listComplete the following tasks to configure an IPv4 ACL:Creating a time range (Optional)The following four tasks are required: (Configure at least one task.)Configuring a WLAN ACLConfiguring an IPv4 basic ACLConfiguring an IPv4 advanced ACLConfiguring an Ethernet frame header ACLCopying an IPv4 ACL (Optional)IPv6 ACL configuration task listComplete the following tasks to configure an IPv6 ACL:Creating a time range (Optional)The following two tasks are required: (Configure at least one task.)Configuring an IPv6 basic ACLConfiguring an IPv6 advanced ACLCopying an IPv6 ACL (Optional)
