Typical ACL Configuration

S300, S500, S2700, S3700, S5700, S6700, S7700, and S9700 Series Switches Typical Configuration Examples

This document provides campus networks typical configuration examples and feature typical configuration examples. "Campus Networks Typical Configuration Examples" provides typical campus network networking modes and a variety of deployment examples."Feature Typical Configuration Examples" provides typical configuration examples of a single feature on a switch. You can configure required features after deploying a campus network.

Rate and give feedback:

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

Typical ACL Configuration

Example for Using an ACL to Restrict FTP Access Rights
Example for Using ACLs to Control Access to the Specified Server in the Specified Time Range
Example for Using an ACL to Block Network Access of the Specified Users
Example for Using Reflective ACL to Implement Unidirectional Access Control
Example for Allowing Certain Users to Access the Internet in the Specified Time Range
Example for Using ACLs to Restrict Mutual Access Between Network Segments
Example for Using an ACL to Prevent Internal Hosts from Accessing the Internet
Example for Using an ACL to Prevent External Hosts from Accessing Internal Servers
Example for Applying ACLs to SNMP to Filter NMSs

Example for Using an ACL to Restrict FTP Access Rights

ACL Overview

An Access Control List (ACL) consists of one rule or a set of rules that describe the packet matching conditions. These conditions include source addresses, destination addresses, and port numbers of packets.

An ACL filters packets based on rules. A device with an ACL configured matches packets based on the rules to obtain the packets of a certain type, and then decides to forward or discard these packets according to the policies used by the service module to which the ACL is applied.

Depending on the rule definition methods, ACLs include basic ACL, advanced ACL, and Layer 2 ACL. A basic ACL defines rules to filter IPv4 packets based on information such as source IP addresses, fragment information, and time ranges. If you only need to filter packets based on source IP addresses, you can configure a basic ACL.

In this example, a basic ACL is applied to the FTP module to allow only the specified clients to access the FTP server, improving FTP server security.

Configuration Notes

In this example, the local user password is in irreversible-cipher mode, indicating that the password is encrypted using the irreversible algorithm. Unauthorized users cannot obtain the password through decryption. Therefore, this algorithm is secure. This password mode only applies to V200R003C00 and later versions. In versions earlier than V200R003C00, the local user passwords can only be in cipher mode, indicating that the passwords are encrypted using the reversible algorithm. Unauthorized users can obtain the passwords through decryption. This algorithm is less secure.
This example applies to all versions of all S series switches.

Networking Requirements

As shown in Figure 3-237, the Switch functions as an FTP server. The requirements are as follows:

All the users on subnet 1 (172.16.105.0/24) are allowed to access the FTP server anytime.
All the users on subnet 2 (172.16.107.0/24) are allowed to access the FTP server only during the specified period of time.
Other users are not allowed to access the FTP server.

Reachable routes exist between the Switch and subnets. You need to configure the Switch to limit user access to the FTP server.

Figure 3-237 Using basic ACLs to restrict FTP access rights

Procedure

Configure a time range.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] time-range ftp-access from 0:0 2014/1/1 to 23:59 2014/12/31  //Create an absolute time range for an ACL.
[Switch] time-range ftp-access 14:00 to 18:00 off-day    //Create a periodic time range for an ACL. The time range is 14:00-18:00 on every weekend. The validity period of ftp-access is the overlap of the two time ranges.

Configure a basic ACL.

[Switch] acl number 2001
[Switch-acl-basic-2001] rule permit source 172.16.105.0 0.0.0.255  //Allow users on network segment 172.16.105.0/24 to access the FTP server anytime.
[Switch-acl-basic-2001] rule permit source 172.16.107.0 0.0.0.255 time-range ftp-access  //Allow users on network segment 172.16.107.0/24 to access the FTP server only in the ftp-access time range.
[Switch-acl-basic-2001] rule deny source any  //Prevent other users from accessing the FTP server.
[Switch-acl-basic-2001] quit

Configure basic FTP functions.

[Switch] ftp server enable  //Enable the FTP server to allow users to log in to the device through FTP. 
[Switch] ftp server-source -i Vlanif 10    //Configure the source interface of the server as the interface corresponding to 172.16.104.110. Assume that the interface is Vlanif 10.
[Switch] aaa            
[Switch-aaa] local-user huawei password irreversible-cipher SetUserPassword@123  //Configure the FTP user name and password. The password in irreversible-cipher mode only applies to V200R003C00 and later versions. In versions earlier than V200R003C00, only the passwords in cipher mode can be used.
[Switch-aaa] local-user huawei privilege level 15  //Set the FTP user level.
[Switch-aaa] local-user huawei service-type ftp  //Set the FTP user service type.
[Switch-aaa] local-user huawei ftp-directory cfcard:/  //Configure the FTP working directory, which must be configured as flash:/ on a fixed switch.
[Switch-aaa] quit

Configure access permissions on the FTP server.

[Switch] ftp acl 2001  //Apply an ACL to the FTP module.

Verify the configuration.
Run the ftp 172.16.104.110 command on PC1 (172.16.105.111/24) in subnet 1. PC1 can connect to the FTP server.

Run the ftp 172.16.104.110 command on PC2 (172.16.107.111/24) in subnet 2 on Monday in 2014. PC2 cannot connect to the FTP server. Run the ftp 172.16.104.110 command on PC2 (172.16.107.111/24) in subnet 2 at 15:00 on a Saturday in 2014. PC2 can connect to the FTP server.

Run the ftp 172.16.104.110 command on PC3 (10.10.10.1/24). PC3 cannot connect to the FTP server.

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
FTP server enable
FTP server-source -i Vlanif 10
FTP acl 2001
#
time-range ftp-access 14:00 to 18:00 off-day
time-range ftp-access from 00:00 2014/1/1 to 23:59 2014/12/31
#
acl number 2001
 rule 5 permit source 172.16.105.0 0.0.0.255
 rule 10 permit source 172.16.107.0 0.0.0.255 time-range ftp-access
 rule 15 deny 
#
aaa
 local-user huawei password irreversible-cipher %^%#uM-!TkAaGB5=$$6SQuw$#batog!R7M_d^!o{*@N9g'e0baw#%^%#
 local-user huawei privilege level 15
 local-user huawei ftp-directory cfcard:/
 local-user huawei service-type ftp
#
return

Example for Using ACLs to Control Access to the Specified Server in the Specified Time Range

ACL Overview

Depending on the rule definition methods, ACLs include basic ACL, advanced ACL, and Layer 2 ACL. An advanced ACL defines rules to filter IPv4 packets based on source IP addresses, destination addresses, IP protocol types, TCP source/destination port numbers, UDP source/destination port numbers, fragment information, and time ranges. Compared with a basic ACL, an advanced ACL is more accurate, flexible, and provides more functions. For example, if you want to filter packets based on source and destination IP addresses, configure an advanced ACL.

In this example, advanced ACLs are applied to the traffic policy module so that the device can filter the packets sent from users to the specified server and thus restrict access to the specified server during a time range.

Configuration Notes

This example applies to all versions of all S series switches.

The following commands and output information are obtained from S7712 running V200R007C00.

Networking Requirements

As shown in Figure 3-238, the departments of an enterprise are connected through the Switch. The R&D and marketing departments cannot access the salary query server at 10.164.9.9 in work hours (08:00 to 17:30), whereas the president office can access the server at anytime.

Figure 3-238 Using ACLs to control access to the specified server in the specified time range

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

Configure the time range, advanced ACL, and ACL-based traffic classifier to filter packets from users to the server in the specified time range. In this way, you can restrict the access of different users to the server in the specified time range.
Configure a traffic behavior to discard the packets matching the ACL.
Configure and apply a traffic policy to make the ACL and traffic behavior take effect.

Procedure

Add interfaces to VLANs and assign IP addresses to the VLANIF interfaces.
# Add GE 1/0/1 through GE1/0/3 to VLANs 10, 20, and 30 respectively, add GE2/0/1 to VLAN 100, and assign IP addresses to VLANIF interfaces. The configurations on GE 1/0/1 and VLANIF 10 are used as an example here. The configurations on GE1/0/2, GE1/0/3, and GE2/0/1 are similar to the configurations on GE 1/0/1, and the configurations on VLANIF 20, VLANIF 30, and VLANIF 100 are similar to the configurations on VLANIF 10.
```
<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 10 20 30 100
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface vlanif 10
[Switch-Vlanif10] ip address 10.164.1.1 255.255.255.0
[Switch-Vlanif10] quit
```

Configure the time range.

# Configure the time range as 8:00 to 17:30.

[Switch] time-range satime 8:00 to 17:30 working-day  //Configure a periodic time range for an ACL.

Configure ACLs.

# Configure an ACL for the marketing department accessing the salary query server.

[Switch] acl 3002
[Switch-acl-adv-3002] rule deny ip source 10.164.2.0 0.0.0.255 destination 10.164.9.9 0.0.0.0 time-range satime  //Prevent the marketing department from accessing the salary query server in the time range satime.
[Switch-acl-adv-3002] quit

# Configure an ACL for the R&D department accessing the salary query server.

[Switch] acl 3003
[Switch-acl-adv-3003] rule deny ip source 10.164.3.0 0.0.0.255 destination 10.164.9.9 0.0.0.0 time-range satime  //Prevent the R&D department from accessing the salary query server in the time range satime.
[Switch-acl-adv-3003] quit

Configure ACL-based traffic classifiers.

# Configure the traffic classifier c_market to classify the packets that match ACL 3002.

[Switch] traffic classifier c_market  //Create a traffic classifier.
[Switch-classifier-c_market] if-match acl 3002  //Associate an ACL with the traffic classifier.
[Switch-classifier-c_market] quit

# Configure the traffic classifier c_rd to classify the packets that match ACL 3003.

[Switch] traffic classifier c_rd  //Create a traffic classifier.
[Switch-classifier-c_rd] if-match acl 3003  //Associate an ACL with the traffic classifier.
[Switch-classifier-c_rd] quit

Configure traffic behaviors.

# Configure the traffic behavior b_market to reject packets.

[Switch] traffic behavior b_market  //Create a traffic behavior.
[Switch-behavior-b_market] deny  //Set the action of the traffic behavior to deny.
[Switch-behavior-b_market] quit

# Configure the traffic behavior b_rd to reject packets.

[Switch] traffic behavior b_rd  //Create a traffic behavior.
[Switch-behavior-b_rd] deny  //Set the action of the traffic behavior to deny.
[Switch-behavior-b_rd] quit

Configure traffic policies.

# Configure the traffic policy p_market and associate the traffic classifier c_market and the traffic behavior b_market with the traffic policy.

[Switch] traffic policy p_market  //Create a traffic policy.
[Switch-trafficpolicy-p_market] classifier c_market behavior b_market  //Associate the traffic classifier c_market with the traffic behavior b_market.
[Switch-trafficpolicy-p_market] quit

# Configure the traffic policy p_rd and associate the traffic classifier c_rd and the traffic behavior b_rd with the traffic policy.

[Switch] traffic policy p_rd  //Create a traffic policy.
[Switch-trafficpolicy-p_rd] classifier c_rd behavior b_rd  //Associate the traffic classifier c_rd with the traffic behavior b_rd.
[Switch-trafficpolicy-p_rd] quit

Apply the traffic policy.

# Packets from the marketing department to the server are received by GE1/0/2; therefore, apply the traffic policy p_market to the inbound direction of GE1/0/2.

[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] traffic-policy p_market inbound  //Apply the traffic policy to the inbound direction of an interface.
[Switch-GigabitEthernet1/0/2] quit

# Packets from the R&D department to the server are received by GE1/0/3; therefore, apply the traffic policy p_rd to the inbound direction of GE1/0/3.

[Switch] interface gigabitethernet 1/0/3
[Switch-GigabitEthernet1/0/3] traffic-policy p_rd inbound  //Apply the traffic policy to the inbound direction of an interface.
[Switch-GigabitEthernet1/0/3] quit

Verify the configuration.

# Check the configuration of ACL rules.

[Switch] display acl all
 Total nonempty ACL number is 2

Advanced ACL 3002, 1 rule
Acl's step is 5
 rule 5 deny ip source 10.164.2.0 0.0.0.255 destination 10.164.9.9 0 time-range satime (match-counter 0)(Active)

Advanced ACL 3003, 1 rule
Acl's step is 5
 rule 5 deny ip source 10.164.3.0 0.0.0.255 destination 10.164.9.9 0 time-range satime (match-counter 0)(Active)

# Check the configuration of the traffic classifier.

[Switch] display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: c_market
    Precedence: 5
    Operator: OR
    Rule(s) : if-match acl 3002

   Classifier: c_rd
    Precedence: 10
    Operator: OR
    Rule(s) : if-match acl 3003

Total classifier number is 2

# Check the configuration of the traffic policy.

[Switch] display traffic policy user-defined
  User Defined Traffic Policy Information:                                      
  Policy: p_market                                                              
   Classifier: c_market                                                         
    Operator: OR                                                                
     Behavior: b_market                                                         
      Deny                                                                      
                                                                                
  Policy: p_rd                                                                  
   Classifier: c_rd                                                             
    Operator: OR                                                                
     Behavior: b_rd                                                             
      Deny                                                                      

Total policy number is 2

# Check the traffic policy application records.

[Switch] display traffic-policy applied-record
#                                                                                                                                   
-------------------------------------------------                                                                                   
  Policy Name:   p_market                                                                                                           
  Policy Index:  0                                                                                                                  
     Classifier:c_market     Behavior:b_market                                                                                      
-------------------------------------------------                                                                                   
 *interface GigabitEthernet1/0/2                          
    traffic-policy p_market inbound                                                                                                 
      slot 1    :  success                                                                                                          
-------------------------------------------------                                                                                   
  Policy total applied times: 1.                                                                                                    
#                                                                                                                                   
-------------------------------------------------                                                                                   
  Policy Name:   p_rd                                                                                                               
  Policy Index:  1                                                                                                                  
     Classifier:c_rd     Behavior:b_rd                                                                                              
-------------------------------------------------                                                                                   
 *interface GigabitEthernet1/0/3                                                                                                    
    traffic-policy p_rd inbound                                                                                                     
      slot 1    :  success                                                                                                          
-------------------------------------------------                                                                                   
  Policy total applied times: 1.                                                                                                    
#

# The R&D and marketing departments cannot access the salary query server in work hours (08:00 to 17:30).

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
vlan batch 10 20 30 100 
#
time-range satime 08:00 to 17:30 working-day
#
acl number 3002
 rule 5 deny ip source 10.164.2.0 0.0.0.255 destination 10.164.9.9 0 time-range satime
acl number 3003
 rule 5 deny ip source 10.164.3.0 0.0.0.255 destination 10.164.9.9 0 time-range satime
#
traffic classifier c_market operator or precedence 5
 if-match acl 3002
traffic classifier c_rd operator or precedence 10
 if-match acl 3003
#
traffic behavior b_market
 deny
traffic behavior b_rd
 deny
#
traffic policy p_market match-order config
 classifier c_market behavior b_market
traffic policy p_rd match-order config
 classifier c_rd behavior b_rd
#
interface Vlanif10
 ip address 10.164.1.1 255.255.255.0
#
interface Vlanif20
 ip address 10.164.2.1 255.255.255.0
#
interface Vlanif30
 ip address 10.164.3.1 255.255.255.0
#
interface Vlanif100
 ip address 10.164.9.1 255.255.255.0  
#
interface GigabitEthernet1/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 10 
#
interface GigabitEthernet1/0/2
 port link-type trunk                                                           
 port trunk allow-pass vlan 20 
 traffic-policy p_market inbound
#
interface GigabitEthernet1/0/3
 port link-type trunk                                                           
 port trunk allow-pass vlan 30 
 traffic-policy p_rd inbound  
#
interface GigabitEthernet2/0/1

 port link-type trunk                                                           
 port trunk allow-pass vlan 100 
#
return

Related Information

Support Community

ACL Application

Example for Using an ACL to Block Network Access of the Specified Users

ACL Overview

Depending on the rule definition methods, ACLs include basic ACL, advanced ACL, and Layer 2 ACL. A Layer 2 ACL defines rules to filter IPv4 and IPv6 packets based on Ethernet frame information, such as source MAC addresses, destination MAC addresses, VLANs, and Layer 2 protocol types. Basic ACLs and advanced ACLs filter packets based on Layer 3 and Layer 4 information, while Layer 2 ACLs filter packets based on Layer 2 information. For example, if you want to filter packets based on MAC addresses and VLANs, configure a Layer 2 ACL.

In this example, a Layer 2 ACL is applied to the traffic policy module so that the device can filter the packets sent from users with certain MAC addresses to the Internet and thus prevent these users from accessing the Internet.

Configuration Notes

This example applies to all versions of all S series switches.

The following commands and output information are obtained from S7712 running V200R007C00.

Networking Requirements

As shown in Figure 3-239, the Switch that functions as the gateway is connected to PCs, and there are reachable routes to all subnets on Switch. The administrator wants to block network access of PC1 after detecting that PC1 (00e0-f201-0101) is an unauthorized user.

Figure 3-239 Using Layer 2 ACLs to block network access of the specified users

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

Configure a Layer 2 ACL and ACL-based traffic classifier to discard packets from MAC address 00e0-f201-0101 (preventing the user with this MAC address from accessing the network).
Configure a traffic behavior to discard the packets matching the ACL.
Configure and apply a traffic policy to make the ACL and traffic behavior take effect.

Procedure

Configure an ACL.

# Configure a Layer 2 ACL to meet the preceding requirement.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] acl 4000
[Switch-acl-L2-4000] rule deny source-mac 00e0-f201-0101 ffff-ffff-ffff  //Reject the packets from source MAC address 00e0-f201-0101.
[Switch-acl-L2-4000] quit

Configure an ACL-based traffic classifier.

# Configure the traffic classifier tc1 to classify packets that match ACL 4000.

[Switch] traffic classifier tc1  //Create a traffic classifier.
[Switch-classifier-tc1] if-match acl 4000  //Associate an ACL with the traffic classifier.
[Switch-classifier-tc1] quit

Configure the traffic behavior.

# Configure the traffic behavior tb1 to reject packets.

[Switch] traffic behavior tb1  //Create a traffic behavior.
[Switch-behavior-tb1] deny  //Set the action of the traffic behavior to deny.
[Switch-behavior-tb1] quit

Configure the traffic policy.

# Configure the traffic policy tp1 and associate tc1 and tb1 with the traffic policy.

[Switch] traffic policy tp1  //Create a traffic policy.
[Switch-trafficpolicy-tp1] classifier tc1 behavior tb1  //Associate the traffic classifier tc1 with the traffic behavior tb1.
[Switch-trafficpolicy-tp1] quit

Apply the traffic policy.

# Packets from PC1 to the Internet are received by GE2/0/1; therefore, apply the traffic policy tp1 to the inbound direction of GE2/0/1.

[Switch] interface gigabitethernet 2/0/1
[Switch-GigabitEthernet2/0/1] traffic-policy tp1 inbound  //Apply the traffic policy to the inbound direction of an interface.
[Switch-GigabitEthernet2/0/1] quit

Verify the configuration.

# Check the configuration of the ACL rule.

[Switch] display acl 4000
L2 ACL 4000, 1 rule                                                             
Acl's step is 5                                                                 
 rule 5 deny source-mac 00e0-f201-0101

# Check the configuration of the traffic classifier.

[Switch] display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: tc1
    Precedence: 5
    Operator: OR
    Rule(s) : if-match acl 4000  
                                                                               
Total classifier number is 1

# Check the configuration of the traffic policy.

[Switch] display traffic policy user-defined tp1
  User Defined Traffic Policy Information:                                      
  Policy: tp1                                                                   
   Classifier: tc1                                                              
    Operator: OR                                                                
     Behavior: tb1                                                              
      Deny

# Check the traffic policy application records.

[Switch] display traffic-policy applied-record
#                                                                                                                                   
-------------------------------------------------                                                                                   
  Policy Name:   tp1                                                                                                                
  Policy Index:  0                                                                                                                  
     Classifier:tc1     Behavior:tb1                                                                                                
-------------------------------------------------                                                                                   
 *interface GigabitEthernet2/0/1                                                                             
    traffic-policy tp1 inbound                                                                                                      
      slot 2    :  success                                                                                                          
-------------------------------------------------                                                                                   
  Policy total applied times: 1.                                                                                                    
#

# The user with MAC address 00e0-f201-0101 cannot access the Internet.

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
acl number 4000
 rule 5 deny source-mac 00e0-f201-0101
#
traffic classifier tc1 operator or precedence 5
 if-match acl 4000
#
traffic behavior tb1
 deny
#
traffic policy tp1 match-order config
 classifier tc1 behavior tb1
#
interface GigabitEthernet2/0/1
 traffic-policy tp1 inbound  
#
return

Example for Using Reflective ACL to Implement Unidirectional Access Control

Reflective ACL Overview

Reflective ACL is a type of dynamic ACL. The device creates a reflective ACL by swapping the source/destination IP addresses and source/destination port numbers of an ACL. A reflective ACL has an aging time. If packets passing the interface match the reflective ACL within the aging time, this reflective ACL is kept in the next aging time interval. If no packet passing the interface matches the reflective ACL within the aging time, the reflective ACL is deleted. This mechanism improves device security.

Reflective ACL implements unidirectional access control. An external host can access an internal host only after the internal host accesses the external host. Therefore, reflective ACL protects enterprises' internal networks against attacks initiated by external users.

In this example, an advanced reflective ACL is used to prevent the servers on the Internet from actively establishing UDP connections with internal hosts before the internal hosts connect to the external servers. Reflective ACL implements unidirectional access control between internal and external networks.

Configuration Notes

This example applies to all versions of modular switches, but does not apply to fixed switches.

Networking Requirements

As shown in Figure 3-240, Switch functions as the gateway to connect PCs to the Internet. There are reachable routes among the devices. To ensure internal network security, the administrator allows servers on the Internet to establish UDP connections with internal PCs only after the internal PCs have established UDP connections with the external servers.

Figure 3-240 Using reflective ACL to implement unidirectional access control

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

Configure an advanced ACL based on which the device will generate a reflective ACL.
Configure the reflective ACL function to allow internal PC1 to establish a UDP connection with a server on the Internet and prevent the external server from actively establishing a UDP connection with internal hosts.

Procedure

Configure an advanced ACL.

# Create advanced ACL 3000 and configure a rule to permit UDP packets.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] acl 3000
[Switch-acl-adv-3000] rule permit udp  //Allow UDP packets to pass.
[Switch-acl-adv-3000] quit

Configure the reflective ACL function.
# Packets from the Internet are received by GE2/0/1; therefore, configure the reflective ACL function in the outbound direction of GE2/0/1 so that the Switch can generate reflective ACL for UDP packets.
```
[Switch] interface gigabitethernet 2/0/1
[Switch-GigabitEthernet2/0/1] traffic-reflect outbound acl 3000  //Apply the reflective ACL to the outbound direction of an interface.
[Switch-GigabitEthernet2/0/1] quit
```

Verify the configuration.

Run the display traffic-reflect command to check reflective ACL information.

[Switch] display traffic-reflect outbound acl 3000
Proto  SP   DP   DIP             SIP             Count   Timeout  Interface
------------------------------------------------------------------------------
UDP    2    80   192.168.1.2       10.1.1.2       9       300(s)   GigabitEthernet2/0/1
------------------------------------------------------------------------------
* Total <1> flows accord with condition, <1> items was displayed.
------------------------------------------------------------------------------
* Proto=Protocol,SIP=Source IP,DIP=Destination IP,Timeout=Time to cutoff,
* SP=Source port,DP=Destination port,Count=Packets count(data).

The preceding information will be displayed only after internal hosts have established UDP connections with external servers. The preceding information shows that a reflective ACL has been generated on GE2/0/1 for the UDP packets between PC1 and server (192.168.1.2), and provides packet statistics.

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
acl number 3000
 rule 5 permit udp
#
interface GigabitEthernet2/0/1
 traffic-reflect outbound acl 3000
#
return

Example for Allowing Certain Users to Access the Internet in the Specified Time Range

ACL Time Range Overview

An ACL defines many matching conditions to filter most packets transmitted on a network; however, it cannot filter packets in the specified time range.

You can configure a time range and associate the time range with an ACL rule to filter packets based on time. This specifies different policies for users in different time ranges.

In this example, a basic ACL associated with a time range is applied to the traffic policy module so that the device can filter packets sent from internal users to the Internet in the specified time range. As a result, users can access the Internet only in the specified time range.

Configuration Notes

This example applies to all versions of all S series switches.

The following commands and output information are obtained from S7712 running V200R007C00.

Networking Requirements

As shown in Figure 3-241, the departments of an enterprise are connected through the Switch. The enterprise allows all employees to access the Internet on work days (Monday to Friday), and only the managers to access the Internet on weekends (Saturday and Sunday).

Figure 3-241 Allowing certain users to access the Internet in the specified time range

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

Configure the time range, basic ACL, and ACL-based traffic classifier to filter packets sent from internal users to the Internet and thus allow only certain users to access the Internet in the specified time range.
Configure a traffic behavior to permit the packets that match the ACL permit rule.
Configure and apply a traffic policy to make the ACL and traffic behavior take effect.

Procedure

Configure VLANs and IP addresses for interfaces.

# Create VLAN 10 and VLAN 20.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 10 20

# Configure GE1/0/1 and GE1/0/2 of the Switch as trunk interfaces and add them to VLAN 10 and VLAN 20 respectively. Configure GE2/0/1 of the Switch as a trunk interface and add it to both VLAN 10 and VLAN 20.

[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] port link-type trunk
[Switch-GigabitEthernet1/0/2] port trunk allow-pass vlan 20
[Switch-GigabitEthernet1/0/2] quit
[Switch] interface gigabitethernet 2/0/1
[Switch-GigabitEthernet2/0/1] port link-type trunk
[Switch-GigabitEthernet2/0/1] port trunk allow-pass vlan 10 20
[Switch-GigabitEthernet2/0/1] quit

# Create VLANIF 10 and VLANIF 20 and assign IP addresses to them.

[Switch] interface vlanif 10
[Switch-Vlanif10] ip address 10.1.1.1 24
[Switch-Vlanif10] quit
[Switch] interface vlanif 20
[Switch-Vlanif20] ip address 10.1.2.1 24
[Switch-Vlanif20] quit

Configure a time range.

# Configure the periodic time range from Saturday to Sunday.

[Switch] time-range rest-time 0:00 to 23:59 off-day  //Configure a periodic time range for an ACL.

Configure an ACL.

# Create basic ACL 2001 and configure rules to allow the R&D and marketing managers (10.1.1.11 and 10.1.2.12) to access the Internet anytime and prevent other employees from accessing the Internet on Saturday and Sunday. That is, only the managers of R&D and marketing departments can access the Internet on Saturday and Sunday.

[Switch] acl 2001
[Switch-acl-basic-2001] rule permit source 10.1.1.11 0  //Allow the manager of the R&D department to access the Internet anytime.
[Switch-acl-basic-2001] rule permit source 10.1.2.12 0  //Allow the manager of the marketing department to access the Internet anytime.
[Switch-acl-basic-2001] rule deny time-range rest-time  //Prevent other users from accessing the Internet On Saturday and Sunday.
[Switch-acl-basic-2001] quit

Configure the basic ACL-based traffic classifier.

# Configure the traffic classifier tc1 to classify packets that match ACL 2001.

[Switch] traffic classifier tc1  //Create a traffic classifier.
[Switch-classifier-tc1] if-match acl 2001  //Associate an ACL with the traffic classifier.
[Switch-classifier-tc1] quit

Configure traffic behaviors.
# Configure the traffic behavior tb1 and set the action to permit (default value).

Packets matching the ACL are discarded as long as a deny action exists in an ACL rule or traffic behavior.
```
[Switch] traffic behavior tb1  //Create a traffic behavior.
[Switch-behavior-tb1] quit
```

Configure the traffic policy.

# Define the traffic policy and associate the traffic classifier and traffic behavior with the traffic policy.

[Switch] traffic policy tp1  //Create a traffic policy.
[Switch-trafficpolicy-tp1] classifier tc1 behavior tb1  //Associate the traffic classifier tc1 with the traffic behavior tb1.
[Switch-trafficpolicy-tp1] quit

Apply the traffic policy to an interface.

# Packets from internal hosts are forwarded to the Internet through GE2/0/1; therefore, apply the traffic policy tp1 to the outbound direction of GE2/0/1.

[Switch] interface gigabitethernet 2/0/1
[Switch-GigabitEthernet2/0/1] traffic-policy tp1 outbound  //Apply the traffic policy to the outbound direction of an interface.
[Switch-GigabitEthernet2/0/1] quit

Verify the configuration.

# Check the configuration of ACL rules.

[Switch] display acl 2001
Basic ACL 2001, 3 rules                                                         
Acl's step is 5                                                                 
 rule 5 permit source 10.1.1.11 0 (match-counter 0)                             
 rule 10 permit source 10.1.2.12 0 (match-counter 0)                            
 rule 15 deny time-range rest-time(match-counter 0) (Inactive)

# Check the configuration of the traffic classifier.

[Switch] display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: tc1
    Precedence: 5
    Operator: OR
    Rule(s) : if-match acl 2001                                                 

Total classifier number is 1

# Check the configuration of the traffic policy.

[Switch] display traffic policy user-defined tp1
  User Defined Traffic Policy Information:                                      
  Policy: tp1                                                                   
   Classifier: tc1                                                              
    Operator: OR                                                                
     Behavior: tb1                                                              
      Permit  
Total policy number is 1

# All employees can access the Internet on work days. Only the managers (10.1.1.11 and 10.1.2.12) of R&D and marketing departments can access the Internet on weekends.

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
vlan batch 10 20 
#                                                                               
time-range rest-time 00:00 to 23:59 off-day 
#
acl number 2001                                                                 
 rule 5 permit source 10.1.1.11 0                                               
 rule 10 permit source 10.1.2.12 0                                              
 rule 15 deny time-range rest-time 
#
traffic classifier tc1 operator or precedence 5  
 if-match acl 2001                                                              
#
traffic behavior tb1
 permit
#
traffic policy tp1 match-order config
 classifier tc1 behavior tb1
#
interface Vlanif10
 ip address 10.1.1.1 255.255.255.0
#
interface Vlanif20
 ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 10 
#
interface GigabitEthernet1/0/2
 port link-type trunk                                                           
 port trunk allow-pass vlan 20 
#
interface GigabitEthernet2/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 10 20 
 traffic-policy tp1 outbound
#
return

Example for Using ACLs to Restrict Mutual Access Between Network Segments

ACL Overview

In this example, advanced ACLs are applied to the traffic policy module so that the device can filter the packets between different network segments and thus restrict mutual access between network segments.

Configuration Notes

This example applies to all versions and models.

The following commands and output information are obtained from S7712 running V200R007C00.

Networking Requirements

As shown in Figure 3-242, the departments of an enterprise are connected through the Switch. To facilitate network management, the administrator allocates the IP addresses on two network segments to the R&D and marketing departments respectively. The two departments belong to different VLANs. The mutual access between two network segments must be controlled to ensure information security.

Figure 3-242 Using advanced ACLs to restrict mutual access between network segments

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

Configure an advanced ACL and an ACL-based traffic classifier to filter the packets exchanged between R&D and marketing departments.
Configure a traffic behavior to discard the packets matching the ACL.
Configure and apply a traffic policy to make the ACL and traffic behavior take effect.

Procedure

Configure VLANs and IP addresses for interfaces.

# Create VLAN 10 and VLAN 20.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 10 20

# Configure GE 1/0/1 and GE1/0/2 of the Switch as trunk interfaces and add them to VLAN 10 and VLAN 20 respectively.

[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] port link-type trunk
[Switch-GigabitEthernet1/0/2] port trunk allow-pass vlan 20
[Switch-GigabitEthernet1/0/2] quit

# Create VLANIF 10 and VLANIF 20 and assign IP addresses to them.

[Switch] interface vlanif 10
[Switch-Vlanif10] ip address 10.1.1.1 24
[Switch-Vlanif10] quit
[Switch] interface vlanif 20
[Switch-Vlanif20] ip address 10.1.2.1 24
[Switch-Vlanif20] quit

Configure ACLs.
# Create the advanced ACL 3001, and block packets from one department to another department. In this example, configure rules for the ACL to block the packets from the R&D department to the marketing department.
```
[Switch] acl 3001
[Switch-acl-adv-3001] rule deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255  //Prevent the R&D department from accessing the marketing department.
[Switch-acl-adv-3001] quit
```

Configure the advanced ACL-based traffic classifier.

# Configure the traffic classifier tc1 to classify packets that match ACL 3001.

[Switch] traffic classifier tc1  //Create a traffic classifier.
[Switch-classifier-tc1] if-match acl 3001  //Associate an ACL with the traffic classifier.
[Switch-classifier-tc1] quit

Configure the traffic behavior.

# Configure the traffic behavior tb1 to reject packets.

[Switch] traffic behavior tb1  //Create a traffic behavior.
[Switch-behavior-tb1] deny  //Set the action of the traffic behavior to deny.
[Switch-behavior-tb1] quit

Configure the traffic policy.

# Define the traffic policy and associate the traffic classifier and traffic behavior with the traffic policy.

[Switch] traffic policy tp1  //Create a traffic policy.
[Switch-trafficpolicy-tp1] classifier tc1 behavior tb1  //Associate the traffic classifier tc1 with the traffic behavior tb1.
[Switch-trafficpolicy-tp1] quit

Apply the traffic policy to an interface.

# Packets from the R&D department are received by GE1/0/1. Therefore, apply the traffic policy to the inbound direction of GE1/0/1.

[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] traffic-policy tp1 inbound  //Apply the traffic policy to the inbound direction of an interface.
[Switch-GigabitEthernet1/0/1] quit

Verify the configuration.

# Check the configuration of ACL rules.

[Switch] display acl 3001
Advanced ACL 3001, 1 rule                                                       
Acl's step is 5                                                                 
 rule 5 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 (match-counter 0)

# Check the configuration of the traffic classifier.

[Switch] display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: tc1
    Precedence: 5
    Operator: OR
    Rule(s) : if-match acl 3001                                                 

Total classifier number is 1

# Check the configuration of the traffic policy.

[Switch] display traffic policy user-defined tp1
  User Defined Traffic Policy Information:                                      
  Policy: tp1                                                                   
   Classifier: tc1                                                              
    Operator: OR                                                                
     Behavior: tb1                                                              
      Deny

# The network segments where the R&D and marketing departments reside cannot access each other, but they can access the network segments of other departments.

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
vlan batch 10 20 
#
acl number 3001                                                                 
 rule 5 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255        
#
traffic classifier tc1 operator or precedence 5  
 if-match acl 3001                                                                
#
traffic behavior tb1
 deny
#
traffic policy tp1 match-order config
 classifier tc1 behavior tb1
#
interface Vlanif10
 ip address 10.1.1.1 255.255.255.0
#
interface Vlanif20
 ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 10 
 traffic-policy tp1 inbound
#
interface GigabitEthernet1/0/2
 port link-type trunk                                                           
 port trunk allow-pass vlan 20 
#
return

Example for Using an ACL to Prevent Internal Hosts from Accessing the Internet

ACL Overview

In this example, a basic ACL is applied to the traffic policy module so that the device can filter the packets from internal hosts to the Internet and thus prevent internal hosts from accessing the Internet.

Configuration Notes

This example applies to all versions and models.

The following commands and output information are obtained from S7712 running V200R007C00.

Networking Requirements

As shown in Figure 3-243, the departments of an enterprise are connected through the Switch. The Switch needs to prevent some hosts of the R&D and marketing departments from accessing the Internet to protect information security of the enterprise.

Figure 3-243 Using an ACL to prevent internal hosts from accessing the Internet

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

Configure a basic ACL and ACL-based traffic classifier to filter packets from the specified hosts of the R&D and marketing departments.
Configure a traffic behavior to discard the packets matching the ACL.
Configure and apply a traffic policy to make the ACL and traffic behavior take effect.

Procedure

Configure VLANs and IP addresses for interfaces.

# Create VLAN 10 and VLAN 20.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 10 20

[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] port link-type trunk
[Switch-GigabitEthernet1/0/2] port trunk allow-pass vlan 20
[Switch-GigabitEthernet1/0/2] quit
[Switch] interface gigabitethernet 2/0/1
[Switch-GigabitEthernet2/0/1] port link-type trunk
[Switch-GigabitEthernet2/0/1] port trunk allow-pass vlan 10 20
[Switch-GigabitEthernet2/0/1] quit

# Create VLANIF 10 and VLANIF 20 and assign IP addresses to them.

[Switch] interface vlanif 10
[Switch-Vlanif10] ip address 10.1.1.1 24
[Switch-Vlanif10] quit
[Switch] interface vlanif 20
[Switch-Vlanif20] ip address 10.1.2.1 24
[Switch-Vlanif20] quit

Configure an ACL.

# Create basic ACL 2001 and configure rules to reject the packets from hosts 10.1.1.11 and 10.1.2.12.

[Switch] acl 2001
[Switch-acl-basic-2001] rule deny source 10.1.1.11 0  //Prevent the host with IP address 10.1.1.11 from accessing the Internet.
[Switch-acl-basic-2001] rule deny source 10.1.2.12 0  //Prevent the host with IP address 10.1.2.12 from accessing the Internet.
[Switch-acl-basic-2001] quit

Configure the basic ACL-based traffic classifier.

# Configure the traffic classifier tc1 to classify packets that match ACL 2001.

[Switch] traffic classifier tc1  //Create a traffic classifier.
[Switch-classifier-tc1] if-match acl 2001  //Associate an ACL with the traffic classifier.
[Switch-classifier-tc1] quit

Configure the traffic behavior.

# Configure the traffic behavior tb1 to reject packets.

[Switch] traffic behavior tb1  //Create a traffic behavior.
[Switch-behavior-tb1] deny  //Set the action of the traffic behavior to deny.
[Switch-behavior-tb1] quit

Configure the traffic policy.

# Define the traffic policy and associate the traffic classifier and traffic behavior with the traffic policy.

[Switch] traffic policy tp1  //Create a traffic policy.
[Switch-trafficpolicy-tp1] classifier tc1 behavior tb1  //Associate the traffic classifier tc1 with the traffic behavior tb1.
[Switch-trafficpolicy-tp1] quit

Apply the traffic policy to an interface.

# Packets from internal hosts are forwarded to the Internet through GE2/0/1; therefore, apply the traffic policy to the outbound direction of GE2/0/1.

[Switch] interface gigabitethernet 2/0/1
[Switch-GigabitEthernet2/0/1] traffic-policy tp1 outbound  //Apply the traffic policy to the outbound direction of an interface.
[Switch-GigabitEthernet2/0/1] quit

Verify the configuration.

# Check the configuration of ACL rules.

[Switch] display acl 2001
Basic ACL 2001, 2 rules                                                         
Acl's step is 5                                                                 
 rule 5 deny source 10.1.1.11 0 (match-counter 0)                               
 rule 10 deny source 10.1.2.12 0 (match-counter 0)

# Check the configuration of the traffic classifier.

[Switch] display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: tc1
    Precedence: 5
    Operator: OR
    Rule(s) : if-match acl 2001                                                 

Total classifier number is 1

# Check the configuration of the traffic policy.

[Switch] display traffic policy user-defined tp1
  User Defined Traffic Policy Information:                                      
  Policy: tp1                                                                   
   Classifier: tc1                                                              
    Operator: OR                                                                
     Behavior: tb1                                                              
      Deny

# The hosts at 10.1.1.11 and 10.1.2.12 cannot access the Internet, and other hosts can access the Internet.

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
vlan batch 10 20 
#
acl number 2001                                                                 
 rule 5 deny source 10.1.1.11 0                                                 
 rule 10 deny source 10.1.2.12 0  
#
traffic classifier tc1 operator or precedence 5  
 if-match acl 2001                                                              
#
traffic behavior tb1
 deny
#
traffic policy tp1 match-order config
 classifier tc1 behavior tb1
#
interface Vlanif10
 ip address 10.1.1.1 255.255.255.0
#
interface Vlanif20
 ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 10 
#
interface GigabitEthernet1/0/2
 port link-type trunk                                                           
 port trunk allow-pass vlan 20 
#
interface GigabitEthernet2/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 10 20 
 traffic-policy tp1 outbound
#
return

Example for Using an ACL to Prevent External Hosts from Accessing Internal Servers

ACL Overview

In this example, an advanced ACL is applied to the traffic policy module so that the device can filter the packets sent from external hosts to internal servers and thus restrict access of external hosts to internal servers.

Configuration Notes

This example applies to all versions of all S series switches.

The following commands and output information are obtained from S7712 running V200R007C00.

Networking Requirements

As shown in Figure 3-244, the departments of an enterprise are connected through the Switch. The enterprise allows only internal hosts to access the finance server, preventing external hosts from accessing the server.

Figure 3-244 Using an ACL to prevent external hosts from accessing internal servers

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

Configure an advanced ACL and ACL-based traffic classifier to filter the packets from external hosts to the finance server and thus prevent external hosts from accessing this server.
Configure a traffic behavior to permit the packets that match the ACL permit rule.
Configure and apply a traffic policy to make the ACL and traffic behavior take effect.

Procedure

Add interfaces to VLANs and assign IP addresses to the VLANIF interfaces.
# Add GE 1/0/1 through GE1/0/3 to VLANs 10, 20, and 30 respectively, add GE2/0/1 to VLAN 100, and assign IP addresses to VLANIF interfaces. The configurations on GE 1/0/1 and VLANIF 10 are used as an example here. The configurations on GE1/0/2, GE1/0/3, and GE2/0/1 are similar to the configurations on GE 1/0/1, and the configurations on VLANIF 20, VLANIF 30, and VLANIF 100 are similar to the configurations on VLANIF 10.
```
<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 10 20 30 100
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface vlanif 10
[Switch-Vlanif10] ip address 10.164.1.1 255.255.255.0
[Switch-Vlanif10] quit
```

Configure an ACL.

# Create advanced ACL 3002 and configure rules to allow the packets from the president's office, R&D department, and marketing department to reach the finance server and block the packets sent from external hosts to the finance server.

[Switch] acl 3002
[Switch-acl-adv-3002] rule permit ip source 10.164.1.0 0.0.0.255 destination 10.164.4.4 0.0.0.0  //Allow the president's office to access the finance server.
[Switch-acl-adv-3002] rule permit ip source 10.164.2.0 0.0.0.255 destination 10.164.4.4 0.0.0.0  //Allow the marketing department to access the finance server.
[Switch-acl-adv-3002] rule permit ip source 10.164.3.0 0.0.0.255 destination 10.164.4.4 0.0.0.0  //Allow the R&D department to access the finance server.
[Switch-acl-adv-3002] rule deny ip destination 10.164.4.4 0.0.0.0  //Prevent other users from accessing the finance server.
[Switch-acl-adv-3002] quit

Configure an ACL-based traffic classifier.

# Configure the traffic classifier c_network to classify the packets that match ACL 3002.

[Switch] traffic classifier c_network  //Create a traffic classifier.
[Switch-classifier-c_network] if-match acl 3002  //Associate an ACL with the traffic classifier.
[Switch-classifier-c_network] quit

Configure a traffic behavior.
# Configure the traffic behavior b_network and keep the action set to permit (default value).

Packets matching the ACL are discarded as long as a deny action exists in an ACL rule or traffic behavior.
```
[Switch] traffic behavior b_network  //Create a traffic behavior.
[Switch-behavior-b_network] quit
```

Configure the traffic policy.

# Configure the traffic policy p_network and associate the traffic classifier c_network and the traffic behavior b_network with the traffic policy.

[Switch] traffic policy p_network  //Create a traffic policy.
[Switch-trafficpolicy-p_network] classifier c_network behavior b_network  //Associate the traffic classifier c_network with the traffic behavior b_network.
[Switch-trafficpolicy-p_network] quit

Apply the traffic policy.

# Packets from internal and external hosts are forwarded to the finance server through GE2/0/1; therefore, apply the traffic policy p_network to the outbound direction of GE2/0/1.

[Switch] interface gigabitethernet 2/0/1
[Switch-GigabitEthernet2/0/1] traffic-policy p_network outbound  //Apply the traffic policy to the outbound direction of an interface.
[Switch-GigabitEthernet2/0/1] quit

Verify the configuration.

# Check the configuration of ACL rules.

[Switch] display acl 3002
Advanced ACL 3002, 4 rules                                                      
Acl's step is 5                                                                 
 rule 5 permit ip source 10.164.1.0 0.0.0.255 destination 10.164.4.4 0 (match-counter 0)         
 rule 10 permit ip source 10.164.2.0 0.0.0.255 destination 10.164.4.4 0 (match-counter 0)        
 rule 15 permit ip source 10.164.3.0 0.0.0.255 destination 10.164.4.4 0 (match-counter 0)      
 rule 20 deny ip destination 10.164.4.4 0 (match-counter 0)

# Check the configuration of the traffic classifier.

[Switch] display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: c_network
    Precedence: 5
    Operator: OR
    Rule(s) : if-match acl 3002

Total classifier number is 1

# Check the configuration of the traffic policy.

[Switch] display traffic policy user-defined
  User Defined Traffic Policy Information:                                      
  Policy: p_network                                                              
   Classifier: c_network                                                         
    Operator: OR                                                                
     Behavior: b_network                                                         
      Permit                                                                      

Total policy number is 1

# Check the traffic policy application records.

[Switch] display traffic-policy applied-record
#                                                                                                                                   
-------------------------------------------------                                                                                   
  Policy Name:   p_network                                                                                                           
  Policy Index:  0                                                                                                                  
     Classifier:c_network     Behavior:b_network                                                                                      
-------------------------------------------------                                                                                   
 *interface GigabitEthernet2/0/1                          
    traffic-policy p_network outbound                                                                                                 
      slot 2    :  success                                                                                                          
-------------------------------------------------                                                                                   
  Policy total applied times: 1.                                                                                                    
#

# The president's office, marketing department, and R&D department can access the finance server, but external hosts cannot.

Configuration Files

Configuration file of the Switch

#
sysname Switch
#
vlan batch 10 20 30 100 
#
acl number 3002                                                                 
 rule 5 permit ip source 10.164.1.0 0.0.0.255 destination 10.164.4.4 0          
 rule 10 permit ip source 10.164.2.0 0.0.0.255 destination 10.164.4.4 0         
 rule 15 permit ip source 10.164.3.0 0.0.0.255 destination 10.164.4.4 0         
 rule 20 deny ip destination 10.164.4.4 0  
#
traffic classifier c_network operator or precedence 5
 if-match acl 3002
#
traffic behavior b_network
 permit
#
traffic policy p_network match-order config
 classifier c_network behavior b_network
#
interface Vlanif10
 ip address 10.164.1.1 255.255.255.0
#
interface Vlanif20
 ip address 10.164.2.1 255.255.255.0
#
interface Vlanif30
 ip address 10.164.3.1 255.255.255.0
#
interface Vlanif100
 ip address 10.164.4.1 255.255.255.0  
#
interface GigabitEthernet1/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 10 
#
interface GigabitEthernet1/0/2
 port link-type trunk                                                           
 port trunk allow-pass vlan 20 
#
interface GigabitEthernet1/0/3
 port link-type trunk                                                           
 port trunk allow-pass vlan 30 
#
interface GigabitEthernet2/0/1
 port link-type trunk                                                           
 port trunk allow-pass vlan 100 
 traffic-policy p_network outbound
#
return

Example for Applying ACLs to SNMP to Filter NMSs

ACL Overview

In this example, a basic ACL is applied to the SNMP module so that only the specified NMS can access the switch. This improves switch security.

Configuration Notes

This example applies to all versions of all S series switches.

The following commands and output information are obtained from S7712 running V200R007C00.

Networking Requirements

As shown in Figure 3-245, a new switch on the same network segment as the NMS is added to an enterprise's network, and uses SNMPv1 to communicate with the NMS. To improve switch security, the switch can only be managed by the existing NMS on the network.

Figure 3-245 Applying basic ACLs to SNMP to filter NMSs

Configuration Roadmap

The configuration roadmap is as follows:

Configure SNMPv1 on the switch so that the NMS running SNMPv1 can manage the switch.
Configure access control so that only the NMS with the specified IP address can perform read/write operations on the specified MIB objects of the switch.
Configure a community name based on which the switch permits access of the NMS.
Configure a trap host and enable the switch to automatically send traps to the NMS.
Add the switch to the NMS. The community name configured on the switch must be the same as that used by the NMS; otherwise, the NMS cannot manage the switch.

Procedure

Configure SNMPv1 on the switch so that the NMS running SNMPv1 can manage the switch.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] snmp-agent sys-info version v1   //By default, SNMPv3 is supported.

Configure the interface on the switch to receive and respond to NMS request packets. This step must be performed in V200R020 and later versions. Otherwise, the switch cannot connect to the NMS.
```
[Switch] snmp-agent protocol source-interface vlanif 10
```

Configure access control so that only the NMS with the specified IP address can perform read/write operations on the specified MIB objects of the switch.

# Configure an ACL to permit only the NMS 10.1.1.1 to access the switch.

[Switch] acl 2001
[Switch-acl-basic-2001] rule permit source 10.1.1.1 0
[Switch-acl-basic-2001] rule deny
[Switch-acl-basic-2001] quit

# Configure the MIB view to specify the MIB objects that can be accessed by the NMS.

[Switch] snmp-agent mib-view included isoview01 system   //Configure the MIB view isoview01 to access the system subtree.
[Switch] snmp-agent mib-view included isoview02 interfaces   //Configure the MIB view isoview02 to access the interfaces subtree.

Configure a community name based on which the switch permits access of the NMS, apply the ACL to make the access control function take effect.

[Switch] snmp-agent community read adminnms01 mib-view isoview01 acl 2001   //Grant adminnms01 the read-only permission on the system subtree.
[Switch] snmp-agent community write adminnms02 mib-view isoview02 acl 2001   //Grant adminnms02 the read-write permission on the interface subtree.

Configure a trap host and enable the switch to automatically send traps to the NMS.

[Switch] snmp-agent trap enable
Warning: All switches of SNMP trap/notification will be open. Continue? [Y/N]:y   //Enable all trap functions on the switch. By default, only some trap functions are enabled. You can run the display snmp-agent trap all command to check trap status.
[Switch] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname adminnms01 v1

Add the switch to the NMS.
# Log in to eSight and choose Resource > Add Resource > Add Resource. Set SNMP parameters based on Table 3-161 and click OK. A switch is added to and can be managed by eSight. The switch will proactively send trap messages to eSight.

Table 3-161 SNMP parameters
Parameter

Setting

Select discovery protocol

SNMP

IP address

10.1.1.2

SNMP

Edit SNMP parameters

Version

V1

Read community

adminnms01

Write community

adminnms02

Port

161

The parameter settings on the NMS and switch must be the same; otherwise, the switch cannot be added to the NMS.

If authentication is required for remote logins to the switch, Telnet parameters need to be set so that the NMS can manage the switch. In this example, administrators can remotely log in to the switch using Telnet, password authentication is used, and the password is Example@123.

Parameter	Setting
Select discovery protocol	SNMP
IP address	10.1.1.2
SNMP	Edit SNMP parameters
Version	V1
Read community	adminnms01
Write community	adminnms02
Port	161

Configuration Files

Configuration file of the switch

#
sysname Switch
#
acl number 2001
 rule 5 permit source 10.1.1.1 0
 rule 10 deny
#
snmp-agent
snmp-agent local-engineid 800007DB03360102101100
snmp-agent community read cipher %^%#Pqp'RXi))/y\KgEtwP9A3x2z5_FgxG1v'D/8>=G,D9<yMC^RAM_YB:F0BZlF="bHXg%lH*L"Jq'lea`S%^%# mib-view isoview01 acl 2001
snmp-agent community write cipher %^%#.T|&Whvyf$<Gd"I,wXi5SP_6~Nakk6<<+3H:N-h@aJ6d,l0md%HCeAY8~>X=>xV\JKNAL=124r839v<*%^%# mib-view isoview02 acl 2001
snmp-agent sys-info version v1 v3
snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname cipher %^%#uq/!YZfvW4*vf[~C|.:Cl}UqS(vXd#wwqR~5M(rU%%^%#
snmp-agent mib-view included isoview01 system
snmp-agent mib-view included isoview02 interfaces
snmp-agent trap enable
snmp-agent protocol source-interface Vlanif100
#
return

Example for Using an ACL to Restrict FTP Access Rights
Example for Using ACLs to Control Access to the Specified Server in the Specified Time Range
Example for Using an ACL to Block Network Access of the Specified Users
Example for Using Reflective ACL to Implement Unidirectional Access Control
Example for Allowing Certain Users to Access the Internet in the Specified Time Range
Example for Using ACLs to Restrict Mutual Access Between Network Segments
Example for Using an ACL to Prevent Internal Hosts from Accessing the Internet
Example for Using an ACL to Prevent External Hosts from Accessing Internal Servers
Example for Applying ACLs to SNMP to Filter NMSs

Translation

Español 日本語 Русский 简体中文

Download

Updated: 2022-06-28

Document ID: EDOC1000069520

Downloads: 38194

Average rating:

This Document Applies to these Products

Related Version

Digital Signature File

Digital Signature Authentication Mode

Example for Using an ACL to Restrict FTP Access Rights

ACL Overview

Configuration Notes

Networking Requirements

Procedure

Configuration Files

Example for Using ACLs to Control Access to the Specified Server in the Specified Time Range

ACL Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Related Information

Example for Using an ACL to Block Network Access of the Specified Users

ACL Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Example for Using Reflective ACL to Implement Unidirectional Access Control

Reflective ACL Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Example for Allowing Certain Users to Access the Internet in the Specified Time Range

ACL Time Range Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Example for Using ACLs to Restrict Mutual Access Between Network Segments

ACL Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Related Content

Example for Using an ACL to Prevent Internal Hosts from Accessing the Internet

ACL Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Example for Using an ACL to Prevent External Hosts from Accessing Internal Servers

ACL Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Example for Applying ACLs to SNMP to Filter NMSs

ACL Overview

Configuration Notes

Networking Requirements

Configuration Roadmap

Procedure

Configuration Files

Related Version

Related Documents

Digital Signature File