H3C WA2220X-AG Configuration manual

Brand: H3C

Model: WA2220X-AG

Type: Configuration manual

H3C WA Series WLAN Access Points

ACL and QoS Configuration Guide

Hangzhou H3C Technologies Co., Ltd.

http://www.h3c.com

Document Version: 6W100-20100910

No part of this manual may be reproduced or transmitted in any form or by any means without prior

written consent of Hangzhou H3C Technologies Co., Ltd.

Trademarks

H3C, , Aolynk, , H

Care,

, TOP G, , IRF, NetPilot, Neocean, NeoVTL,

SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V

G, V

G, PSPT,

XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,

Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners.

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface

The H3C WA documentation set includes 10 configuration guides, which describe the software features

for the H3C WA series WLAN access points and guide you through the software configuration

procedures. These configuration guides also provide configuration examples to help you apply the

software features to different network scenarios.

The ACL and QoS Configuration Guide describes ACL and QoS configurations.

This preface includes:

z Audience

z Conventions

z About the H3C WA Documentation Set

z Obtaining Documentation

z Documentation Feedback

Audience

This documentation is intended for:

z Network planners

z Field technical support and servicing engineers

z Network administrators working with the WA series

Conventions

This section describes the conventions used in this documentation set.

Command conventions

Convention Description

Boldface Bold

text represents commands and keywords that you enter literally as shown.

italic

Italic text represents arguments that you replace with actual values.

[ ]

Square brackets enclose syntax choices (keywords or arguments) that are

optional.

{ x | y | ... }

Braces enclose a set of required syntax choices separated by vertical bars,

from which you select one.

[ x | y | ... ]

Square brackets enclose a set of optional syntax choices separated by vertical

bars, from which you select one or none.

{ x | y | ... } *

Asterisk marked braces enclose a set of required syntax choices separated by

vertical bars, from which you select at least one.

[ x | y | ... ] *

Asterisk marked square brackets enclose optional syntax choices separated by

vertical bars, from which you may select multiple choices or none.

&<1-n>

The argument or keyword and argument combination before the ampersand (&)

sign can be entered 1 to n times.

Convention Description

# A line that starts with a pound (#) sign is comments.

GUI conventions

Convention Description

Boldface

Window names, button names, field names, and menu items are in Boldface.

For example, the

New User

window appears; click

Multi-level menus are separated by angle brackets. For example,

File

Create

Folder

Symbols

Convention Description

Means reader be extremely careful. Improper operation may cause bodily

injury.

Means reader be careful. Improper operation may cause data loss or damage to

equipment.

Means an action or information that needs special attention to ensure

successful configuration or good performance.

Means a complementary description.

Means techniques helpful for you to make configuration with ease.

About the H3C WA Documentation Set

The H3C WA documentation set includes:

Category Documents Purposes

Marketing brochures Describe product specifications and benefits.

Product

description and

specifications

Technology white papers

Provide an in-depth description of software features and

technologies.

Compliance and safety

manual

Provides regulatory information and the safety instructions

that must be followed during installation.

Quick start

Guides you through initial installation and setup procedures to

help you quickly set up and use your AP with the minimum

configuration.

Hardware

specifications

and installation

Installation guide

Guides you through hardware specifications and installation

methods to help you install your AP.

Getting started guide

Guides you through the main functions of your AP, and

describes how to install and log in to your AP, perform basic

configurations, maintain software, and troubleshoot your AP.

Configuration guides Describe software features and configuration procedures.

Software

configuration

Command references Provide a quick reference to all available commands.

Category Documents Purposes

User FAQ

Provides answers to some of the most frequently asked

questions on how to troubleshoot your AP.

Operations and

maintenance

Release notes

Provide information about the product release, including the

version history, hardware and software compatibility matrix,

version upgrade information, technical support information,

and software upgrading.

Obtaining Documentation

You can access the most up-to-date H3C product documentation on the World Wide Web at

http://www.h3c.com.

Click the links on the top navigation bar to obtain different categories of product documentation:

[Technical Support & Documents > Technical Documents] – Provides hardware installation, software

upgrading, getting started, and software feature configuration and maintenance documentation.

[Products & Solutions] – Provides information about products and technologies, as well as solutions.

[Technical Support & Documents > Software Download] – Provides the documentation released with

the software version.

Documentation Feedback

You can e-mail your comments about product documentation to inf[email protected].

We appreciate your comments.

Table of Contents

1 Applicable Models and Software Versions·····························································································1-1

2 Feature Matrix············································································································································2-1

3 Command/Parameter Matrix·····················································································································3-1

4 ACL Configuration·····································································································································4-1

ACL Overview·········································································································································4-1

ACL Categories·······························································································································4-2

ACL Numbering and Naming ··········································································································4-2

Match Order·····································································································································4-2

ACL Rule Numbering·······················································································································4-4

Implementing Time-Based ACL Rules····························································································4-4

IPv4 Fragments Filtering with ACLs································································································4-4

ACL Configuration Task List ···················································································································4-4

Configuring an ACL·································································································································4-5

Creating a Time Range ···················································································································4-5

Configuring a WLAN ACL················································································································4-5

Configuring a Basic ACL ·················································································································4-6

Configuring an Advanced ACL········································································································4-7

Configuring an Ethernet Frame Header ACL··················································································4-9

Copying an ACL ····························································································································4-10

Displaying and Maintaining ACLs·········································································································4-10

ACL Configuration Examples················································································································4-10

IPv4 ACL Configuration Example··································································································4-10

IPv6 ACL Configuration Example··································································································4-12

5 QoS Overview ············································································································································5-1

Introduction to QoS·································································································································5-1

Introduction to QoS Service Models ·······································································································5-1

Best-Effort Service Model················································································································5-1

IntServ Service Model ·····················································································································5-2

DiffServ Service Model····················································································································5-2

QoS Techniques Overview ·····················································································································5-2

Applying QoS Techniques in a Network··························································································5-3

QoS Processing Flow in an AP ·······································································································5-4

6 QoS Policy Configuration·························································································································6-1

QoS Configuration Approach Overview··································································································6-1

Non-Policy Approach·······················································································································6-1

Policy Approach·······························································································································6-1

Configuring a QoS Policy························································································································6-1

Defining a Class ······························································································································6-2

Defining a Traffic Behavior··············································································································6-2

Defining a QoS Policy and Applying the QoS Policy to an Interface ··············································6-3

Displaying and Maintaining QoS Policies ·······························································································6-3

7 Priority Mapping Configuration················································································································7-1

Introduction to Packet Precedences·······································································································7-1

IP Precedence and DSCP Values···································································································7-1

802.1p Priority ·································································································································7-2

802.11e Priority ·······························································································································7-3

Priority Mapping Overview······················································································································7-3

Introduction to Priority Mapping·······································································································7-3

Introduction to Priority Mapping Tables···························································································7-4

Priority Mapping Configuration Task List································································································7-5

Configuring Priority Mapping···················································································································7-6

Configuring a Priority Mapping Table······························································································7-6

Configuring a Port to Trust Packet Priority for Priority Mapping······················································7-6

Changing the Port Priority of an Interface·······················································································7-7

Displaying and Maintaining Priority Mapping··························································································7-7

Priority Mapping Configuration Example·································································································7-7

8 Index ···························································································································································8-1

1-1

z The models listed in this document are not applicable to all regions. Please consult your local sales

office for the models applicable to your region.

z Read this chapter before using an H3C WA series WLAN access point.

1 Applicable Models and Software Versions

H3C WA series WLAN access points include the WA2200 series and WA2600 series. Table 1-1 shows

the applicable models and software versions.

Table 1-1 Applicable models and software versions

Series Model Software version

WA2210-AG

WA2200 series access

points (indoors)

WA2220-AG

WA2210X-G

WA2200 series

WA2200 series access

points (outdoors)

WA2220X-AG

R 1115

WA2610-AGN

WA2612-AGN

WA2600 series access

points (indoors)

WA2620-AGN

R 1106

WA2610E-AGN

WA2600 series

WA2600 series access

points (enhanced)

WA2620E-AGN

R 1109

2-1

2 Feature Matrix

z Support of the H3C WA series WLAN access points for features, commands and parameters may

vary by device model. See this document for more information.

z For information about feature support, see Table 2-1. For information about command and

parameter support, see

Table 3-1.

z The term AP in this document refers to common APs, wireless bridges, or mesh APs.

Table 2-1 Feature matrix

Document Feature WA2200 series WA2600 series

Fundamentals

Configuration Guide

HTTPS Not supported Supported

802.11n radio mode Not supported Supported

802.11n bandwidth mode Not supported Supported

WLAN Configuration

Guide

802.11n rate configuration Not supported Supported

Optical Ethernet interface

Supported on

WA2210X-G/WA2220X-

AG only

Not supported

Layer 2 – LAN

Switching

Configuration Guide

GE interface Not supported Supported

DHCP server configuration Not supported Supported

Layer 3 – IP Services

Configuration Guide

DHCPv6 configuration Not supported Supported

IGMP snooping configuration Not supported Supported

IP Multicast

Configuration Guide

MLD snooping configuration Not supported Supported

Security Configuration

Guide

SSH2.0 Not supported Supported

3-1

3 Command/Parameter Matrix

Table 3-1 Command/Parameter matrix

Document Module Command/Parameter WA2200 series WA2600 series

display ip https

Not supported Supported

ip https acl

Not supported Supported

ip https certificate

access-control-policy

Not supported Supported

Fundamentals

Command

Reference

HTTP commands

ip https enable

Not supported Supported

a-mpdu enable

Not supported Supported

a-msdu enable

Not supported Supported

channel band-width

Not supported Supported

client dot11n-only

Not supported Supported

preamble

{

long

short

}

Only APs that

support the

802.11b/g radio

mode support this

command.

Only APs that

support the

802.11b/g radio

mode support this

command.

radio-type

Keywords

dot11an

and

dot11gn

not

supported

Supported

WLAN service

commands

short-gi enable

Not supported Supported

dot11a

{

disabled-rate |

mandatory-rate |

supported-rate

} rate-value

Only APs that

support 802.11a

radio mode

support this

command.

Only APs that

support 802.11a

radio mode

support this

command.

dot11n mandatory

maximum-mcs

Not supported Supported

dot11n support

maximum-mcs

Not supported Supported

WLAN

Command

Reference

WLAN RRM

commands

power-constraint

Only APs that

support the

802.11a radio

mode support this

command.

Only APs that

support the

802.11a radio

mode support this

command.

3-2

Document Module Command/Parameter WA2200 series WA2600 series

The maximum

number of

broadcast packets

that can be

forwarded on an

Ethernet interface

per second

broadcast-suppression

{ ratio |

pps

max-pps }

pps

max-pps

ranges from 1 to

148810.

pps

max-pps

ranges from 1 to

1488100.

The maximum

number of multicast

packets allowed on

an Ethernet

interface per

second

multicast-suppression

{ ratio |

pps

max-pps }

pps

max-pps

ranges from 1 to

148810.

pps

max-pps

ranges from 1 to

1488100.

Layer 2 – LAN

Switching

Command

Reference

The maximum

number of unknown

unicast packets

allowed on an

Ethernet interface

per second

unicast-suppression

{ ratio

pps

max-pps }

pps

max-pps

ranges from 1 to

148810.

pps

max-pps

ranges from 1 to

1488100.

DHCP commands

DHCP server configuration

commands

Not supported Supported

display ipv6 dhcp client

[

interface

interface-type

interface-number ]

Not supported Supported

display ipv6 dhcp client

statistics

[

interface

interface-type

interface-number

]

Not supported Supported

display ipv6 dhcp duid

Not supported Supported

Layer 3 - IP

Services

Command

Reference

DHCPv6

commands

reset ipv6 dhcp client

statistics

[

interface

interface-type

interface-number

]

Not supported Supported

4-1

z The models listed in this document are not applicable to all regions. Please consult your local sales

office for the models applicable to your region.

z Support of the H3C WA series WLAN access points (APs) for features may vary by AP model. For

more information, see Feature Matrix.

z The interface types and the number of interfaces vary by AP model.

z The term AP in this document refers to common APs, wireless bridges, and mesh APs.

4 ACL Configuration

This chapter includes these sections:

z ACL Overview

z ACL Configuration Task List

z Configuring an ACL

z Creating a Time Range

z Configuring a WLAN ACL

z Configuring a Basic ACL

z Configuring an Advanced ACL

z Configuring an Ethernet Frame Header ACL

z Copying an ACL

z Displaying and Maintaining ACLs

z ACL Configuration Examples

Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document.

ACL Overview

An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based

on criteria such as source IP address, destination IP address, and port number.

ACLs are essentially used for packet filtering. A packet filter drops packets that match a deny rule and

permits packets that match a permit rule. ACLs are also widely used by many modules, for example,

QoS and IP routing, for traffic identification.

This section covers these topics:

4-2

z ACL Categories

z ACL Numbering and Naming

z Match Order

z ACL Rule Numbering

z Implementing Time-Based ACL Rules

z IPv4 Fragments Filtering with ACLs

ACL Categories

ACLs fall into four categories, as shown in Table 4-1.

Table 4-1 ACL categories

Category ACL number IP version Match criteria

WLAN ACLs 100 to 199 IPv4 Wireless client SSID

IPv4 Source IPv4 address

Basic ACLs 2000 to 2999

IPv6 Source IPv6 address

IPv4

Source/destination IPv4 address, protocols over

IPv4, and other Layer 3 and Layer 4 header fields

Advanced ACLs 3000 to 3999

IPv6

Source/destination IPv6 address, protocols over

IPv6, and other Layer 3 and Layer 4 header fields

Ethernet frame

header ACLs

4000 to 4999 IPv4

Layer 2 header fields, such as source and

destination MAC addresses, 802.1p priority, and

link layer protocol type

ACL Numbering and Naming

Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a

number for identification, and in addition, you can also assign the ACL a name for the ease of

identification. After creating an ACL with a name, you can neither rename it nor delete its name.

You cannot assign a name for a WLAN ACL.

For a WLAN and Ethernet frame header, the ACL number and name must be globally unique. For an

IPv4 basic or advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and for

an IPv6 basic or advanced ACL, among all IPv6 ACLs. You can assign an IPv4 ACL the same number

and name as an IPv6 ACL.

Match Order

The rules in an ACL are sorted in certain order. When a packet matches a rule, the device stops the

match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting

rules, the matching result and action to take depend on the rule order.

Two ACL match orders are available:

z config – Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a

rule with a higher ID. If you use this approach, check rule content and order carefully.

4-3

z auto – Sorts ACL rules in depth-first order. Depth-first ordering ensures that any subset of a rule is

always matched before the rule.

Table 4-2 lists the sequence of tie breakers that depth-first

ordering uses to sort rules for each type of ACL.

The match order of WLAN ACLs can only be config.

Table 4-2 Sort ACL rules in depth-first order

ACL category Sequence of tie breaker

IPv4 basic ACL

1) VPN instance

2) More 0s in the source IP address wildcard (more 0s means a narrower IP address

range)

3) Smaller rule ID

IPv4 advanced ACL

1) VPN instance

2) Specific protocol type rather than IP (IP represents any protocol over IP)

3) More 0s in the source IP address wildcard mask

4) More 0s in the destination IP address wildcard

5) Narrower TCP/UDP service port number range

6) Smaller ID

IPv6 basic ACL

1) Longer prefix for the source IP address (a longer prefix means a narrower IP

address range)

2) Smaller ID

IPv6 advanced ACL

1) Specific protocol type rather than IP (IP represents any protocol over IPv6)

2) Longer prefix for the source IPv6 address

3) Longer prefix for the destination IPv6 address

4) Narrower TCP/UDP service port number range

5) Smaller ID

Ethernet frame

header ACL

1) More 1s in the source MAC address mask (more 1s means a smaller MAC

address)

2) More 1s in the destination MAC address mask

3) Smaller ID

z The AP does not support ACL rules with the VPN instance attribute.

z A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal

notation. In contrast to a network mask, the 0 bits in a wildcard mask represent 'do care' bits, while

the 1 bits represent 'don’t care bits'. If the 'do care' bits in an IP address identical to the 'do care' bits

in an IP address criterion, the IP address matches the criterion. All 'don’t care' bits are ignored. The

0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard

mask.

4-4

ACL Rule Numbering

What is the ACL rule numbering step

If you do not assign an ID for the rule you are creating, the system automatically assigns it a rule ID. The

rule numbering step sets the increment by which the system automatically numbers rules. For example,

the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are

numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert between

two rules.

By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of

inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are matched

in ascending order of rule ID.

Automatic rule numbering and re-numbering

The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to

the current highest rule ID, starting with 0.

For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10,

and 12, the newly defined rule will be numbered 15. If the ACL does not contain any rule, the first rule

will be numbered 0.

Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five

rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered

0, 2, 4, 6 and 8.

Implementing Time-Based ACL Rules

You can implement ACL rules based on the time of day by applying a time range to them. A time-based

ACL rule takes effect only in any time periods specified by the time range.

Two basic types of time range are available:

z Periodic time range, which recurs periodically on a day or days of the week.

z Absolute time range, which represents only a period of time and does not recur.

You may apply a time range to ACL rules before or after you create it. However, the rules using the time

range can take effect only after you define the time range.

IPv4 Fragments Filtering with ACLs

Traditional packet filtering matches only first fragments of IPv4 packets, and allows all subsequent

non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks.

To avoids the risks, the H3C ACL implementation:

z Filters all fragments by default, including non-first fragments.

z Provides standard and exact match modes for matching ACLs that contain advanced attributes

such as TCP/UDP port number and ICMP type. Standard match is the default mode. It considers

only Layer 3 attributes. Exact match considers all header attributes defined in IPv4 ACL rules.

ACL Configuration Task List

IPv4 configuration task list

Complete the following tasks to configure an IPv4 ACL:

4-5

Task Remarks

Creating a Time Range Optional

Configuring a WLAN ACL

Configuring an IPv4 basic ACL

Configuring an IPv4 advanced ACL

Configuring an Ethernet Frame Header ACL

Required

Configure at least one task.

Copying an IPv4 ACL Optional

IPv6 ACL configuration task list

Complete the following tasks to configure an IPv6 ACL:

Task Remarks

Creating a Time Range Optional

Configuring an IPv6 basic ACL

Configuring an IPv6 Advanced ACL

Required

Configure at least one task.

Copying an IPv6 ACL Optional

Configuring an ACL

Creating a Time Range

Follow these steps to create a time range:

To do… Use the command… Remarks

Enter system view

system-view

––

Create a time

range

time-range

time-range-name { start-time

end-time

days [

from

time1 date1 ] [

time2 date2 ] |

from

time1

date1 [

time2 date2 ] |

time2 date2 }

Required

By default, no time range

exists.

You may create time ranges identified with the same name. They are regarded as one time range

whose active period is the result of ORing periodic ones, ORing absolute ones, and ANDing periodic

and absolute ones.

You may create a maximum of 256 uniquely named time ranges, each with 32 periodic time ranges at

most and 12 absolute time ranges at most.

Configuring a WLAN ACL

WLAN ACLs match packets based on SSIDs of wireless clients.

Follow these steps to configure a WLAN ACL:

To do… Use the command… Remarks

Enter system view

system-view

––

4-6

To do… Use the command… Remarks

Create a WLAN ACL and

enter its view

acl number

acl-number

Required

By default, no ACL exists.

WLAN ACLs are numbered in the range 100 to 199.

Configure a description

for the WLAN ACL

description

text

Optional

By default, a WLAN ACL has no ACL description.

Set the rule numbering

step

step-value

Optional

5 by default.

Create or edit a rule

rule

[ rule-id ] {

permit

deny

} [

ssid

ssid-name ]

Required

By default, a WLAN ACL does not contain any rule.

To create or edit multiple rules, repeat this step.

Configure or edit a rule

description

rule

rule-id

comment

text

Optional

By default, a WLAN ACL rule has no description.

Configuring a Basic ACL

Configuring an IPv4 basic ACL

IPv4 basic ACLs match packets based on only source IP address.

Follow these steps to configure an IPv4 basic ACL:

To do… Use the command… Remarks

Enter system view

system-view

––

Create an IPv4 basic ACL

and enter its view

acl number

acl-number

[

name

acl-name ]

[

match-order

{

auto

config

} ]

Required

By default, no ACL exists.

IPv4 basic ACLs are numbered in the range 2000

to 2999.

You can use the

acl

name

acl-name command to

enter the view of an existing named IPv4 ACL.

Configure a description

for the IPv4 basic ACL

description

text

Optional

By default, an IPv4 basic ACL has no ACL

description.

Set the rule numbering

step

step-value

Optional

5 by default.

Create or edit a rule

rule

[ rule-id ] {

deny

permit

} [

fragment

logging

source

{ sour-addr

sour-wildcard |

any

} |

time-range

time-range-name ] *

Required

By default, an IPv4 basic ACL does not contain

any rule.

To create or edit multiple rules, repeat this step.

The

logging

keyword takes effect only when the

module that uses the ACL supports logging.

Configure or edit a rule

description

rule

rule-id

comment

text

Optional

By default, an IPv4 ACL rule has no rule

description.

Configuring an IPv6 basic ACL

Follow these steps to configure an IPv6 basic ACL:

4-7

To do… Use the command… Remarks

Enter system view

system-view

––

Create an IPv6 basic

ACL view and enter its

view

acl ipv6 number

acl6-number

[

name

acl6-name ]

[

match-order

{

auto

config

} ]

Required

By default, no ACL exists.

IPv6 basic ACLs are numbered in the range 2000

to 2999.

You can use the

acl

ipv6

name

acl6-name

command to enter the view of an existing named

IPv6 ACL.

Configure a description

for the IPv6 basic ACL

description

text

Optional

By default, an IPv6 basic ACL has no ACL

description.

Set the rule numbering

step

step-value

Optional

5 by default

Create or edit a rule

rule

[ rule-id ] {

deny

permit

}

[

fragment

logging

source

{ ipv6-address prefix-length |

ipv6-address/prefix-length |

any

} |

time-range

time-range-name ] *

Required

By default, an IPv6 basic ACL does not contain

any rule.

To create or edit multiple rules, repeat this step.

The

logging

keyword takes effect only when the

module using the ACL supports logging.

Configure or edit a rule

description

rule

rule-id

comment

text

Optional

By default, an IPv6 basic ACL rule has no rule

description.

Configuring an Advanced ACL

Configuring an IPv4 advanced ACL

IPv4 advanced ACLs match packets based on source and destination IP addresses, protocols over IP,

and other protocol header information, such as TCP/UDP source and destination port numbers, TCP

flags, ICMP message types, and ICMP message codes.

IPv4 advanced ACLs also allow you to filter packets based on three priority criteria: type of service (ToS),

IP precedence, and differentiated services codepoint (DSCP) priority.

Compared with IPv4 basic ACLs, IPv4 advanced ACLs allow of more flexible and accurate filtering.

Follow these steps to configure an IPv4 advanced ACL:

To do… Use the command… Remarks

Enter system view

system-view

––

Create an IPv4 advanced

ACL and enter its view

acl number

acl-number [

name

acl-name ] [

match-order

{

auto

config

} ]

Required

By default, no ACL exists.

IPv4 advanced ACLs are numbered in the

range 3000 to 3999.

You can use the

acl

name

acl-name

command to enter the view of an existing

named IPv4 ACL.

Configure a description for

the IPv4 advanced ACL

description

text

Optional

By default, an IPv4 advanced ACL has no

ACL description.

4-8

To do… Use the command… Remarks

Set the rule numbering

step

step-value

Optional

5 by default.

Create or edit a rule

rule

[ rule-id ] {

deny

permit

}

protocol [ { {

ack

ack-value |

fin

fin-value |

psh

psh-value |

rst

rst-value |

syn

syn-value |

urg

urg-value } * |

established

} |

destination

{ dest-addr

dest-wildcard |

any

} |

destination-port

operator port1

[ port2 ] |

dscp

dscp |

fragment

icmp-type

{ icmp-type icmp-code |

icmp-message } |

logging

precedence

precedence |

reflective

source

{ sour-addr

sour-wildcard |

any

} |

source-port

operator port1 [ port2 ] |

time-range

time-range-name |

tos

tos ] *

Required

By default, an IPv4 advanced ACL does

not contain any rule.

To create or edit multiple rules, repeat this

step.

The

logging

keyword takes effect only

when the module using the ACL supports

logging.

Configure or edit a rule

description

rule

rule-id

comment

text

Optional

By default, an IPv4 advanced ACL rule has

no rule description.

Configuring an IPv6 Advanced ACL

IPv6 advanced ACLs match packets based on the source IPv6 address, destination IPv6 address,

protocol carried over IPv6, and other protocol header fields such as the TCP/UDP source port number,

TCP/UDP destination port number, ICMP message type, and ICMP message code.

Compared with IPv6 basic ACLs, they allow of more flexible and accurate filtering.

Follow these steps to configure an IPv6 advanced ACL:

To do… Use the command… Remarks

Enter system view

system-view

––

Create an IPv6

advanced ACL and

enter its view

acl ipv6

number

acl6-number [

name

acl6-name ] [

match-order

{

auto

config

} ]

Required

By default, no ACL exists.

IPv6 advanced ACLs are numbered in

the range 3000 to 3999.

You can use the

acl

ipv6

name

acl6-name command to enter the view

of an existing named IPv6 ACL.

Configure a

description for the

IPv6 advanced ACL

description

text

Optional

By default, an IPv6 advanced ACL has

no ACL description.

Set the rule

numbering step

step

step-value

Optional

5 by default.

4-9

To do… Use the command… Remarks

Create or edit a rule

rule

[ rule-id ] {

deny

permit

} protocol

[ { {

ack

ack-value |

fin

fin-value |

psh

psh-value |

rst

rst-value |

syn

syn-value |

urg

urg-value } * |

established

} |

destination

{ dest dest-prefix |

dest/dest-prefix |

any

} |

destination-port

operator port1 [ port2 ] |

dscp

dscp |

fragment

icmp6-type

{ icmp6-type

icmp6-code | icmp6-message } |

logging

source

{ source source-prefix |

source/source-prefix

| any

} |

source-port

operator port1 [ port2 ] |

time-range

time-range-name ] *

Required

By default IPv6 advanced ACL does not

contain any rule.

To create or edit multiple rules, repeat

this step.

The

logging

keyword takes effect only

when the module using the ACL

supports logging.

Configure or edit a

rule description

rule

rule-id

comment

text

Optional

By default, an IPv6 advanced ACL rule

has no rule description.

Configuring an Ethernet Frame Header ACL

Ethernet frame header ACLs, also called Layer 2 ACLs, match packets based on Layer 2 protocol

header fields such as source MAC address, destination MAC address, 802.1p priority (VLAN priority),

and link layer protocol type.

Follow these steps to configure an Ethernet frame header ACL:

To do… Use the command… Remarks

Enter system view

system-view ––

Create an Ethernet frame

header ACL and enter its

view

acl number

acl-number [

name

acl-name ] [

match-order

{

auto

config

} ]

Required

By default, no ACL exists.

Ethernet frame header ACLs are numbered

in the range 4000 to 4999.

You can use the

acl

name

acl-name

command to enter the view of an existing

named Ethernet frame header ACL.

Configure a description

for the Ethernet frame

header ACL

description

text

Optional

By default, an Ethernet frame header ACL

has no ACL description.

Set the rule numbering

step

step-value

Optional

5 by default.

Create or edit a rule

rule

[ rule-id ] {

deny

permit

}

[

cos

vlan-pri |

dest-mac

dest-addr

dest-mask | {

lsap

lsap-type

lsap-type-mask |

type

protocol-type protocol-type-mask }

source-mac

sour-addr

source-mask |

time-range

time-range-name ] *

Required

By default, an Ethernet frame header ACL

does not contain any rule.

To create or edit multiple rules, repeat this

step.

Configure or edit a rule

description

rule

rule-id

comment

text

Optional

By default, an Ethernet frame header ACL

rule has no rule description.

Page is loading ...

H3C WA2220X-AG Configuration manual

H3C WA2220X-AG Configuration manual

H3C WA2220X-AG Configuration manual

Related papers

Other documents