1-9To do... Use the command... RemarksCreate a Layer 2 ACL andenter layer 2 ACL view acl number acl-number RequiredDefine an ACL rule rule [ rule-id ] { permit |deny } rule-stringRequiredFor information aboutrule-string, refer to ACLCommands.Assign a description stringto the ACL rule rule rule-id comment text OptionalNo description by defaultAssign a description stringto the ACL description text OptionalNo description by defaultNote that:z You can modify any existent rule of the Layer2 ACL and the unmodified part of the ACLremains.z If you do not specify the rule-id argument when creating an ACL rule, the rule will benumbered automatically. If the ACL has no rules, the rule is numbered 0; otherwise, thenumber of the rule will be the greatest rule number plus one. If the current greatest rulenumber is 65534, however, the system will display an error message and you need tospecify a number for the rule.z The content of a modified or created rule cannot be identical with the content of anyexisting rules; otherwise the rule modification or creation will fail, and the systemprompts that the rule already exists.Configuration example# Configure ACL 4000 to deny packets sourced from the MAC address 000d-88f5-97ed,destined for the MAC address 0011-4301-991e, and with their 802.1p priority being 3. system-view[Sysname] acl number 4000[Sysname-acl-ethernetframe-4000] rule deny cos 3 source 000d-88f5-97edffff-ffff-ffff dest 0011-4301-991e ffff-ffff-ffff# Display the configuration information of ACL 4000.[Sysname-acl-ethernetframe-4000] display acl 4000Ethernet frame ACL 4000, 1 ruleAcl's step is 1rule 0 deny cos excellent-effort source 000d-88f5-97ed ffff-ffff-ffff dest0011-4301-991e ffff-ffff-ffffConfiguring User-defined ACLA user-defined ACL filters packets by comparing specific bytes in packet headers withspecified string.
