1-6Acl's step is 1rule 0 deny source 192.168.0.1 0Configuring Advanced ACLAn advanced ACL can filter packets by their source and destination IP addresses, the protocols carriedby IP, and protocol-specific features such as TCP/UDP source and destination ports, ICMP messagetype and message code.An advanced ACL can be numbered from 3000 to 3999. Note that ACL 3998 and ACL 3999 cannot beconfigured because they are reserved for cluster management.Advanced ACLs support analysis and processing of three packet priority levels: type of service (ToS)priority, IP priority and differentiated services codepoint (DSCP) priority.Using advanced ACLs, you can define classification rules that are more accurate, more abundant, andmore flexible than those defined for basic ACLs.Configuration Prerequisitesz To configure a time range-based advanced ACL rule, you need to create the corresponding timeranges first. For information about of time range configuration, refer to section Configuring TimeRange.z The settings to be specified in the rule, such as source and destination IP addresses, the protocolscarried by IP, and protocol-specific features, are determined.Configuration ProcedureTable 1-3 Define an advanced ACL ruleOperation Command DescriptionEnter system view system-view —Create an advancedACL and enteradvanced ACL viewacl number acl-number[ match-order { auto | config } ]Requiredconfig by defaultDefine an ACL rule rule [ rule-id ] { permit | deny }protocol [ rule-string ]RequiredFor information about protocol andrule-string, refer to ACL Commands.Assign a descriptionstring to the ACL rule rule rule-id comment text OptionalNo description by defaultAssign a descriptionstring to the ACL description text OptionalNo description by defaultNote that:z With the config match order specified for the advanced ACL, you can modify any existent rule. Theunmodified part of the rule remains. With the auto match order specified for the ACL, you cannotmodify any existent rule; otherwise the system prompts error information.z If you do not specify the rule-id argument when creating an ACL rule, the rule will be numberedautomatically. If the ACL has no rules, the rule is numbered 0; otherwise, the number of the rule willbe the greatest rule number plus one. If the current greatest rule number is 65534, however, thesystem will display an error message and you need to specify a number for the rule.
