【正文】 otocol (177) Who(513) Talk (517) talk tacacsds SUN Remote Procedure Call (111) SNMP (161) snmp ntp Host Name Server (42) mobilipag Discard (9) bootps Mail notify (512) biff 065535 Between two port numbers Not equal to given port number Less than given port number lt Specify tos dscp Wildcard of destination any cr sourceport precedence Specify destination port destination any vpninstance Specify a special time Specify source port Specify dscp Specify destination address tcp ipinip Internet Group Management Protocol(2) igmp Protocol number高級(jí)ACL規(guī)則配置高級(jí)ACL編號(hào)aclnumber的范圍是3000～3999。當(dāng)用戶指定參數(shù)timerange引入ACL規(guī)則生效時(shí)間段時(shí)，如果timename不存在，該規(guī)則將無(wú)法綁定該生效時(shí)間段。 ACL description (no more than 127 characters)對(duì)分組片段類型有效 Wildcard of source any cr Specify a special time timerange fragmenttype permit deny Specify a numbered ACL Specify a named ACL ACL IPv6 Advanced accesslist(add to current using rules) 基本acl INTEGER20002999 INTEGER1000010999 INTEGER4276875535 INTEGER20002999 crs match order Specify a number for the named ACL Set ACL39。 advance Auto order Config order或[Huawei]acl number 2000 matchorder ?在周一到周五每天8:00到18:00生效，這是一個(gè)周期時(shí)間段。 Monday to Friday 工作日每一天 offday Wed星期四 Sun Mon Fri 06[Huawei]timerange test 8:00 to ? to hh:mm華為ACL配置教程一、ACL基本配置ACL規(guī)則生效時(shí)間段配置（需要先配置設(shè)備的時(shí)間，建議用ntp同步時(shí)間）某些引用ACL的業(yè)務(wù)或功能需要限制在一定的時(shí)間范圍內(nèi)生效，比如，在流量高峰期時(shí)啟動(dòng)設(shè)備的QoS功能。 Starting time The ending point of periodic timerange hh:mm Friday Monday 星期一 Sunday 星期天 Tue Wednesday 星期三 Every day of the week Saturday and Sunday [Huawei]timerange test from 8:00 2016/1/17 to 18:00 2016/11/17在周六、周日下午14:00到18:00生效，這是一個(gè)周期時(shí)間段。 auto config Specify an advanced named ACL s match order cr[Huawei]acl name test advance ? number Number of the advanced named ACL Apply MPLS ACL INTEGER30003999高級(jí)acl MAC address accesslist(add to current using rules) number、ACL描述設(shè)置（可選）[Huaweiaclbasic2600]description ? TEXT、ACL步長(zhǎng)設(shè)置（可選）[Huaweiaclbasictest]step ?二、ACL類型規(guī)則配置基本ACL規(guī)則配置基本ACL編號(hào)aclnumber的范圍是2000～2999。 Specify matched packet permit Specify the fragment type of packet vpninstance [Huaweiaclbasictest]rule 1 deny source ? Any source[Huaweiaclbasictest]rule 1 deny source 0 ? timerange Specify a special time Specify a VPNInstance [Huaweiaclbasic2600]description ? 配置規(guī)則描述在ACL中配置首條規(guī)則時(shí)，如果未指定參數(shù)ruleid，設(shè)備使用步長(zhǎng)值作為規(guī)則的起始編號(hào)。如果不指定參數(shù)vpninstance vpninstancename，設(shè)備會(huì)對(duì)公網(wǎng)和私網(wǎng)的報(bào)文均進(jìn)行匹配。高級(jí)acl主要對(duì)源/目的IP地址、端口號(hào)、優(yōu)先級(jí)、時(shí)間段等報(bào)文進(jìn)行過濾。 gre ip Transmission Control Protocol (6)[Huaweiacladv3000]rule 1 permit udp ? destinationport fragmenttype Specify the fragment type of packet Specify precedenceSpecify source address timerange tos Specify a VPNInstance[Huaweiacladv3000]rule 1 permit udp source ? Any source dscp Specify tos[Huaweiacladv3000]rule 1 permit udp source any destination ? Any destination IP address[Huaweiacladv3000]rule 1 permit udp source any destination 0 ? Specify dscp Specify source port Specify a special time vpninstance[Huaweiacladv3000]rule 1 permit udp source any destination 0 destinationport ? neq bootpc dns MobilIPMN (435) netbiosdgm NETBIOS Name Service (137) Network Time Protocol (123) snmptrap SNMPTRAP (162) syslog tftp Trivial File Transfer (69) xdmcp[Huaweiacladv3000]rule 1 permit udp source any destination 0 destinationport eqSpecify dscp sourceport timerange Specify a special time Specify tos cr、高級(jí)acl常用功能說明參數(shù)說明deny拒絕符合條件的報(bào)文permit允許符合條件的報(bào)文source{souraddr sourwildcard|any}souraddr sourwildcard:源ip地址參數(shù)一起共同構(gòu)成DSCP組成的二選一參數(shù)。tcpflag指定acl規(guī)則匹配TCP報(bào)文中的SYN標(biāo)志的類型timerange指定acl規(guī)則生效時(shí)間段destinationport{eq prot|gt port|lt port|rage portstart port end}指定acl規(guī)則匹配報(bào)文的UDP或TCP的目的端口，僅在報(bào)文協(xié)議是UDP或TCP時(shí)生效。end為結(jié)束端口soureport{eq prot|gt port|lt port|rage portstart port end}指定acl規(guī)則匹配報(bào)文的UDP或TCP的源端口，僅在報(bào)文協(xié)議是UDP或TCP時(shí)生效。啟用此命令表示過濾。udp source destination 0. destinationport eq 9090二層ACL規(guī)則配置二層ACL編號(hào)aclnumber的范圍是4000～4999。 deny Specify matched packet deny Vlan priority of inner vlan doubletag l2protocol cr[HuaweiaclL24000]rule 1 deny sourcemac 111111111111 destinationmac 222222222222 ? format Vlan priority Destination MAC address mask, default is ffffffffffff doubletag l2protocol crcvlan8021pdoubletagetherii指定acl規(guī)則匹配報(bào)文的幀封裝格式用戶自定義ACL規(guī)則配置用戶自定義ACL編號(hào)aclnumber的范圍是5000～5999。[Huaweiacluser5000]rule 1 deny ? Offset from L4 head Specify a special time具體配置及參數(shù)同前。 INTEGER20002999 name number descriptionSpecify matched packet permit Specify source address X:X::X:X X:X::X:X/M fragment logging Log matched packet description Specify matched packet permit[Huaweiacl6adv3000]rule 1 ? permit 1255 icmpv6 ospf OSPF routing protocol(89) User Datagram Protocol(17)ACL資源告警閾值百分比設(shè)置[Huawei]upperlimit}*[Huawei]slotid 配置接口板擴(kuò)展表項(xiàng)空間資源的分配模式，用來靜態(tài)分配MAC、ACL和FIB表項(xiàng)的底層空間大小。modeid缺省情況下，擴(kuò)展表項(xiàng)空間寄存器的資源模式為1，僅擴(kuò)展MAC表項(xiàng)。IPV4NAC：表示同時(shí)擴(kuò)展IPV4的三層ACL表項(xiàng)和NAC特性專用的ACL表項(xiàng)。設(shè)備接口板提供擴(kuò)展表項(xiàng)空間寄存器，通過配置擴(kuò)展表項(xiàng)空間資源的分配模式，可以選擇性擴(kuò)大MAC、ACL和FIB表項(xiàng)的底層空間大小?；騕Huaweiuivty04]acl ?Apply basic or advanced ACLFilter login connections from the current user interfaceFilter logou