H3C交换机典型(ACL)访问控制列表配置实例
H3C的ACL设置
用户的需求：内网部分主机在特定时间段不能上网，但可以在内网间互访1．创建时间段test创建时间段完成后状态如下：2创建ipv4 acl限制内网的主机ip（192.168.1.2）在上班时间段test 内不能上网（其他ip以此类推举，均在3009和3010中配置；不同点仅在于“高级配置”中的“规则ID”数字不同）：创建3009访问控制列表：点击应用后的状态点击“高级配置”配置3009的具体规则：点击“添加”完成3009的规则ID 0的配置（该规则用来允许用户内网间互访）创建3010访问控制列表：点击应用后的状态点击“高级配置”配置3010的具体规则：点击“添加”完成3010的规则ID 0的配置（该规则用来禁止用户上外网）3创建类引用刚才创建的acl：点击创建后的状态点击“设置”引用刚才创建的访问控制列表3009点击应用完成类(test)的设置，如点击应用后出现如下提示则代表设置成功，只需点击提示信息的“关闭”即可创建引用3010的规则的“类”：点击创建完成创建点击“设置”引用刚才创建的访问控制列表3010置成功，只需点击提示信息的“关闭”即可4．创建“流行为”指定对于上面的“类”的控制动作：点击创建完成“test”的创建。
选择“设置”设备对应“类（test）”的流行为为“permit”，即允许符合该类的用户通过“关闭即可”创建流行为“test1”点击创建完成“test1”的创建。
选择“设置”设备对应“类（test1）”的流行为为“Deny”，即拒绝符合该类的用户通过“关闭即可”5．创建“策略”关联已创建的“类”与“流行为”点击“创建”完成test创建点击“设置”关联已创建的“类”与“流行为”点击“应用”关联类（test）与流行为（test）6.设置“端口策略”应用之前创建的策略点击“应用”完成最终设置，出现如下提示点击“关闭”。
H3C 访问控制列表 acl配置文件
IPv4 ACL典型配置举例1.1.1 组网需求●公司企业网通过交换机Switch实现各部门之间的互连。
●要求正确配置IPv4 ACL，禁止研发部门和市场部门在上班时间（8:00至18:00）访问工资查询服务器（IP地址为192.168.4.1），而总裁办公室不受限制，可以随时访问。
1.1.2 组网图图1-1配置IPv4 ACL组网图总裁办公室192.168.1.0/24192.168.2.0/24192.168.3.0/241.1.3 配置步骤(1) 定义上班时间段# 定义8:00至18:00的周期时间段。
<Switch> system-view[Switch] time-range trname 8:00 to 18:00 working-day(2) 定义到工资查询服务器的IPv4 ACL# 定义研发部门到工资查询服务器的访问规则。
[Switch] acl number 3000[Switch-acl-adv-3000] rule deny ip source 192.168.2.0 0.0.0.255 destination 192.168.4.1 0.0.0.0 time-range trname[Switch-acl-adv-3000] quit# 定义市场部门到工资查询服务器的访问规则。
[Switch] acl number 3001[Switch-acl-adv-3001] rule deny ip source 192.168.3.0 0.0.0.255 destination 192.168.4.1 0.0.0.0 time-range trname[Switch-acl-adv-3001] quit(3) 应用IPv4 ACL# 定义类c_rd，对匹配IPv4 ACL 3000的报文进行分类。
[Switch] traffic classifier c_rd[Switch-classifier-c_rd] if-match acl 3000[Switch-classifier-c_rd] quit# 定义流行为b_rd，动作为拒绝报文通过。
H3C-QACL操作
目录第1章 ACL配置....................................................................................................................... 1-11.1 访问控制列表简介.............................................................................................................. 1-11.1.1 访问控制列表概述 ................................................................................................... 1-11.1.2 以太网交换机支持的访问控制列表.......................................................................... 1-21.2 ACL配置............................................................................................................................ 1-31.2.1 时间段配置 .............................................................................................................. 1-41.2.2 定义和应用流模板 ................................................................................................... 1-51.2.3 定义访问控制列表 ................................................................................................... 1-71.2.4 激活访问控制列表 ................................................................................................... 1-91.3 访问控制列表显示和调试 ................................................................................................. 1-101.4 访问控制列表典型配置案例.............................................................................................. 1-111.4.1 高级访问控制列表配置案例................................................................................... 1-111.4.2 基本访问控制列表配置案例................................................................................... 1-121.4.3 二层访问控制列表配置案例................................................................................... 1-13第2章 QoS配置 ...................................................................................................................... 2-12.1 QoS简介............................................................................................................................ 2-12.2 端口组下的QoS配置简介.................................................................................................. 2-52.2.1 端口组下的QoS配置过程....................................................................................... 2-52.2.2 端口组下的QoS配置举例....................................................................................... 2-72.3 QoS配置............................................................................................................................ 2-82.3.1 服务参数分配规则配置 ............................................................................................ 2-92.3.2 流量监管................................................................................................................ 2-102.3.3 流量整形................................................................................................................ 2-132.3.4 优先级标记配置..................................................................................................... 2-142.3.5 报文重定向配置..................................................................................................... 2-152.3.6 队列调度配置......................................................................................................... 2-172.3.7 拥塞避免配置......................................................................................................... 2-182.3.8 流镜像配置 ............................................................................................................ 2-192.3.9 端口镜像配置......................................................................................................... 2-202.3.10 流量统计配置....................................................................................................... 2-222.3.11 QoS的显示和调试............................................................................................... 2-222.4 QoS配置实例................................................................................................................... 2-242.4.1 流量整形配置实例 ................................................................................................. 2-242.4.2 端口镜像配置实例 ................................................................................................. 2-242.4.3 优先级标记配置实例.............................................................................................. 2-252.4.4 报文重定向配置实例.............................................................................................. 2-272.4.5 队列调度配置实例 ................................................................................................. 2-272.4.6 拥塞避免配置实例 ................................................................................................. 2-292.4.7 流量统计配置实例 ................................................................................................. 2-30第3章配置登录用户的ACL控制 ............................................................................................ 3-13.1 简介.................................................................................................................................... 3-13.2 配置对TELNET用户的ACL控制...................................................................................... 3-13.2.1 定义访问控制列表 ................................................................................................... 3-13.2.2 引用访问控制列表，对TELNET用户进行控制....................................................... 3-23.2.3 配置举例.................................................................................................................. 3-33.3 对通过SNMP访问交换机的用户的ACL控制 ................................................................... 3-33.3.1 定义访问控制列表 ................................................................................................... 3-43.3.2 引用访问控制列表，对通过SNMP访问交换机的用户进行控制 ............................. 3-43.3.3 配置举例.................................................................................................................. 3-5第1章 ACL配置1.1 访问控制列表简介1.1.1 访问控制列表概述为了过滤通过网络设备的数据包，需要配置一系列的匹配规则，以识别需要过滤的对象。
H3C配置命令24-acl命令
i
H3C S7500 系列以太网交换机 命令手册 ACL
第1章 ACL 命令
第 1 章 ACL 命令
1.1 ACL 命令
说明： A 型业务板指如下业务板：LS81FT48A、LS81FM24A、LS81FS24A、LS81GB8UA、 LS81GT8UA。
1.1.1 acl
【命令】 acl { number acl-number | name acl-name [ advanced | basic | link | user ] } [ match-order { config | auto } ] undo acl { number acl-number | name acl-name | all }
【命令】
display acl config { all | acl-number | acl-name }
【视图】
任意视图
【参数】
all：显示所有的 ACL（包括数字标识的和名字标识的）。 acl-number：ACL 序号，2000 到 5999 之间的一个数值。 acl-name：ACL 名字，最多 32 个字符，必须以英文字母（即[a-z,A-Z]）开始，而 且中间不能有空格和引号；不区分大小写，不允许使用关键字 all。
【命令】 acl order { auto | first-config-first-match | last-config-first-match }
【视图】 系统视图
【参数】 auto：指定下发的 ACL 规则按深度优先原则生效。 first-config-first-match：指定下发的 ACL 规则按下发顺序生效，先下发的先生效。 last-config-first-match：指定下发的 ACL 规则按下发顺序生效，后下发的先生效。
H3C-5120交换机ACL配置
H3C-5120交换机ACL配置1. 介绍ACL（Access Control List）是H3C-5120交换机中的一种允许或拒绝数据包通过的规则集。
它用于网络安全策略的实施，帮助管理员控制网络中各种流量的流向和处理。
本文档将引导您如何在H3C-5120交换机上配置ACL，以实现对网络流量的有效控制和保护。
2. 配置步骤以下是在H3C-5120交换机上配置ACL的步骤：步骤1：登录交换机使用SSH或Telnet等远程登录工具登录到H3C-5120交换机的管理控制台。
步骤2：进入ACL配置模式输入以下命令，进入ACL配置模式：[System-view][Sysname] acl number 2000[Sysname-acl-basic-2000]这将创建一个编号为2000的ACL，并进入ACL基本配置模式。
步骤3：配置ACL规则在ACL基本配置模式下，您可以配置允许或拒绝的规则。
例如，下面是一个简单的ACL配置示例，允许来自IP地址为192.168.1.0/24的流量通过：[Sysname-acl-basic-2000][Sysname-acl-basic-2000] rule permit source 192.168.1.0 0.0.0.255 您可以根据需要配置更多规则，用于控制不同类型的流量。
步骤4：应用ACL在ACL配置完成后，您需要将ACL应用到适当的接口上。
例如，如果您想将ACL应用到GigabitEthernet1/0/1接口上，可以使用以下命令：[Sysname] interface GigabitEthernet 1/0/1[Sysname-GigabitEthernet1/0/1] packet-filter 2000 inbound这将在接口的入方向（inbound）应用ACL编号为2000的规则。
步骤5：保存配置输入以下命令保存配置：[Sysname] save3. 总结ACL是H3C-5120交换机上实现网络安全策略的重要工具。
H3C交换机典型(ACL)访问控制列表配置实例
H3C交换机典型（A C L）访问控制列表配置实例一、组网需求：2．要求配置高级访问控制列表，禁止研发部门与技术支援部门之间互访，并限制研发部门在上班时间8:00至18:00访问工资查询服务器；3．通过二层访问控制列表，实现在每天8:00～18:00时间段内对源MAC为00e0-fc01-0101的报文进行过滤。
二、组网图：三、配置步骤：H3C360056005100系列交换机典型访问控制列表配置共用配置1．根据组网图，创建四个vlan，对应加入各个端口<H3C>system-view[H3C]vlan10[H3C-vlan10]portGigabitEthernet1/0/1[H3C-vlan10]vlan20[H3C-vlan20]portGigabitEthernet1/0/2[H3C-vlan20]vlan30[H3C-vlan30]portGigabitEthernet1/0/3[H3C-vlan30]vlan40[H3C-vlan40]portGigabitEthernet1/0/4[H3C-vlan40]quit2．配置各VLAN虚接口地址[H3C]interfacevlan10[H3C-Vlan-interface10]ipaddress24[H3C-Vlan-interface10]quit[H3C]interfacevlan20[H3C-Vlan-interface20]ipaddress24[H3C-Vlan-interface20]quit[H3C]interfacevlan30[H3C-Vlan-interface30]ipaddress24[H3C-Vlan-interface30]quit[H3C]interfacevlan40[H3C-Vlan-interface40]ipaddress24[H3C-Vlan-interface40]quit3．定义时间段[H3C]time-rangehuawei8:00to18:00working-day需求1配置（基本ACL配置）1．进入2000号的基本访问控制列表视图[H3C-GigabitEthernet1/0/1]aclnumber2000[H3C-acl-basic-2000]rule1denysource0time-rangeHuawei3．在接口上应用2000号ACL[H3C-acl-basic-2000]interfaceGigabitEthernet1/0/1[H3C-GigabitEthernet1/0/1]packet-filterinboundip-group2000[H3C-GigabitEthernet1/0/1]quit需求2配置（高级ACL配置）1．进入3000号的高级访问控制列表视图[H3C]aclnumber30002．定义访问规则禁止研发部门与技术支援部门之间互访[H3C-acl-adv-3000]rule1denyipsourcedestination3．定义访问规则禁止研发部门在上班时间8:00至18:00访问工资查询服务器[H3C-acl-adv-3000]rule2denyipsourceanydestinationtime-rangeHuawei[H3C-acl-adv-3000]quit4．在接口上用3000号ACL[H3C-acl-adv-3000]interfaceGigabitEthernet1/0/2[H3C-GigabitEthernet1/0/2]packet-filterinboundip-group3000需求3配置（二层ACL配置）1．进入4000号的二层访问控制列表视图[H3C]aclnumber40002．定义访问规则过滤源MAC为00e0-fc01-0101的报文[H3C-acl-ethernetframe-4000]rule1denysource00e0-fc01-0101ffff-ffff-fffftime-rangeH uawei3．在接口上应用4000号ACL[H3C-acl-ethernetframe-4000]interfaceGigabitEthernet1/0/4[H3C-GigabitEthernet1/0/4]packet-filterinboundlink-group40002H3C5500-SI36105510系列交换机典型访问控制列表配置需求2配置1．进入3000号的高级访问控制列表视图[H3C]aclnumber30002．定义访问规则禁止研发部门与技术支援部门之间互访[H3C-acl-adv-3000]rule1denyipsourcedestination3．定义访问规则禁止研发部门在上班时间8:00至18:00访问工资查询服务器[H3C-acl-adv-3000]rule2denyipsourceanydestinationtime-rangeHuawei[H3C-acl-adv-3000]quit4．定义流分类[H3C]trafficclassifierabc[H3C-classifier-abc]if-matchacl3000[H3C-classifier-abc]quit5．定义流行为，确定禁止符合流分类的报文[H3C]trafficbehaviorabc[H3C-behavior-abc]filterdeny[H3C-behavior-abc]quit6．定义Qos策略，将流分类和流行为进行关联[H3C]qospolicyabc[H3C-qospolicy-abc]classifierabcbehaviorabc[H3C-qospolicy-abc]quit7．在端口下发Qospolicy[H3C]interfaceg1/1/2[H3C-GigabitEthernet1/1/2]qosapplypolicyabcinbound8．补充说明：lacl只是用来区分数据流，permit与deny由filter确定；l如果一个端口同时有permit和deny的数据流，需要分别定义流分类和流行为，并在同一QoS策略中进行关联；lQoS策略会按照配置顺序将报文和classifier相匹配，当报文和某一个classifier匹配后，执行该classifier所对应的behavior，然后策略执行就结束了，不会再匹配剩下的classif ier；l将QoS策略应用到端口后，系统不允许对应修改义流分类、流行为以及QoS策略，直至取消下发。
h3c ACL配置手册
二层 ACL 的编号和名称以及用户自定义 ACL 的编号和名称全局唯一；IPv4 基本和高级 ACL 的编 号和名称只在 IPv4 中唯一；IPv6 基本和高级 ACL 的编号和名称也只在 IPv6 中唯一。
1.1.3 ACL的匹配顺序
一个 ACL 由一条或多条描述报文匹配选项的判断语句组成，这样的判断语句就称为“规则”。由 于每条规则中的报文匹配选项不同，从而使这些规则之间可能存在重复甚至矛盾的地方，因此在 将一个报文与 ACL 的各条规则进行匹配时，就需要有明确的匹配顺序来确定规则执行的优先级。 ACL 的规则匹配顺序有以下两种： • 配置顺序：按照用户配置规则的先后顺序进行匹配，但由于本质上系统是按照规则编号由小
表12各类型acl的深度优先排序法则acl类型深度优先排序法则ipv4基本acl1先看规则中是否携带有vpn实例携带vpn实例者优先2如果vpn实例的携带情况相同再比较源ipv4地址范围范围较小者优先3如果源ip地址范围也相同再比较配置顺序配置在前者优先ipv4高级acl1先看规则中是否携带有vpn实例携带vpn实例者优先2如果vpn实例的携带情况相同再比较协议范围指定有ipv4承载的协议类型者优先3如果协议范围也相同再比较源ipv4地址范围较小者优先
目录
1 ACL配置 ············································································································································ 1-1 1.1 ACL简介 ············································································································································1-1 1.1.1 ACL的分类······························································································································1-1 1.1.2 ACL的编号和名称 ···················································································································1-1 1.1.3 ACL的匹配顺序·······················································································································1-2 1.1.4 ACL的步长······························································································································1-3 1.1.5 ACL的生效时间段 ···················································································································1-3 1.1.6 ACL对IPv4 分片报文的处理····································································································1-3 1.1.7 流模板·····································································································································1-4 1.1.8 ACL的应用······························································································································1-4 1.2 ACL配置任务简介······························································································································1-6 1.3 配置ACL ············································································································································1-6 1.3.1 配置ACL的生效时间段············································································································1-6 1.3.2 配置基本ACL ··························································································································1-6 1.3.3 配置高级ACL ··························································································································1-8 1.3.4 配置二层ACL ························································································································1-10 1.3.5 配置用户自定义ACL ·············································································································1-11 1.3.6 复制ACL ·······························································································································1-12 1.3.7 配置流模板····························································································································1-13 1.3.8 ACL key的长度模式配置·······································································································1-13 1.4 ACL显示和维护 ·······························································································································1-14 1.5 ACL典型配置举例····························································································································1-14 1.5.1 IPv4 ACL典型配置举例·········································································································1-14 1.5.2 IPv6 ACL配置举例 ················································································································1-16 1.5.3 流模板配置举例 ····················································································································1-17 1.5.4 ACL key长度模式的配置举例 ·······························································································1-18
H3C交换机典型(ACL)访问控制列表配置实例
H3C交换机典型（ACL）访问控制列表配置实例一、组网需求：1．通过配置基本访问控制列表，实现在每天8:00～18:00时间段内对源IP为10.1.1.2主机发出报文的过滤；2．要求配置高级访问控制列表，禁止研发部门与技术支援部门之间互访，并限制研发部门在上班时间8:00至18:00访问工资查询服务器；3．通过二层访问控制列表，实现在每天8:00～18:00时间段内对源MAC为00e0-fc01-0101的报文进行过滤。
二、组网图：三、配置步骤：H3C 3600 5600 5100系列交换机典型访问控制列表配置共用配置1．根据组网图，创建四个vlan，对应加入各个端口<H3C>system-view[H3C]vlan 10[H3C-vlan10]port GigabitEthernet 1/0/1[H3C-vlan10]vlan 20[H3C-vlan20]port GigabitEthernet 1/0/2[H3C-vlan20]vlan 30[H3C-vlan30]port GigabitEthernet 1/0/3[H3C-vlan30]vlan 40[H3C-vlan40]port GigabitEthernet 1/0/4[H3C-vlan40]quit2．配置各VLAN虚接口地址[H3C]interface vlan 10[H3C-Vlan-interface10]ip address 10.1.1.1 24 [H3C-Vlan-interface10]quit[H3C]interface vlan 20[H3C-Vlan-interface20]ip address 10.1.2.1 24 [H3C-Vlan-interface20]quit[H3C]interface vlan 30[H3C-Vlan-interface30]ip address 10.1.3.1 24 [H3C-Vlan-interface30]quit[H3C]interface vlan 40[H3C-Vlan-interface40]ip address 10.1.4.1 24 [H3C-Vlan-interface40]quit3．定义时间段[H3C] time-range huawei 8:00 to 18:00 working-day需求1配置（基本ACL配置）1．进入2000号的基本访问控制列表视图[H3C-GigabitEthernet1/0/1] acl number 20002．定义访问规则过滤10.1.1.2主机发出的报文[H3C-acl-basic-2000] rule 1 deny source 10.1.1.2 0 time-range Huawei3．在接口上应用2000号ACL[H3C-acl-basic-2000] interface GigabitEthernet1/0/1[H3C-GigabitEthernet1/0/1] packet-filter inbound ip-group 2000[H3C-GigabitEthernet1/0/1] quit需求2配置（高级ACL配置）1．进入3000号的高级访问控制列表视图[H3C] acl number 30002．定义访问规则禁止研发部门与技术支援部门之间互访[H3C-acl-adv-3000]rule 1 deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.2553．定义访问规则禁止研发部门在上班时间8:00至18:00访问工资查询服务器[H3C-acl-adv-3000] rule 2 deny ip source any destination 129.110.1.2 0.0.0.0 time -range Huawei[H3C-acl-adv-3000] quit4．在接口上用3000号ACL[H3C-acl-adv-3000] interface GigabitEthernet1/0/2[H3C-GigabitEthernet1/0/2] packet-filter inbound ip-group 3000需求3配置（二层ACL配置）1．进入4000号的二层访问控制列表视图[H3C] acl number 40002．定义访问规则过滤源MAC为00e0-fc01-0101的报文[H3C-acl-ethernetframe-4000] rule 1 deny source 00e0-fc01-0101 ffff-ffff-ffff time-r ange Huawei3．在接口上应用4000号ACL[H3C-acl-ethernetframe-4000] interface GigabitEthernet1/0/4[H3C-GigabitEthernet1/0/4] packet-filter inbound link-group 40002 H3C 5500-SI 3610 5510系列交换机典型访问控制列表配置需求2配置1．进入3000号的高级访问控制列表视图[H3C] acl number 30002．定义访问规则禁止研发部门与技术支援部门之间互访[H3C-acl-adv-3000]rule 1 deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.2553．定义访问规则禁止研发部门在上班时间8:00至18:00访问工资查询服务器[H3C-acl-adv-3000] rule 2 deny ip source any destination 129.110.1.2 0.0.0.0 time -range Huawei[H3C-acl-adv-3000] quit4．定义流分类[H3C] traffic classifier abc[H3C-classifier-abc]if-match acl 3000[H3C-classifier-abc]quit5．定义流行为，确定禁止符合流分类的报文[H3C] traffic behavior abc[H3C-behavior-abc] filter deny[H3C-behavior-abc] quit6．定义Qos策略，将流分类和流行为进行关联[H3C]qos policy abc[H3C-qospolicy-abc] classifier abc behavior abc[H3C-qospolicy-abc] quit7．在端口下发Qos policy[H3C] interface g1/1/2[H3C-GigabitEthernet1/1/2] qos apply policy abc inbound8．补充说明：l acl只是用来区分数据流，permit与deny由filter确定；l 如果一个端口同时有permit和deny的数据流，需要分别定义流分类和流行为，并在同一QoS策略中进行关联；l QoS策略会按照配置顺序将报文和classifier相匹配，当报文和某一个classifier匹配后，执行该classifier所对应的behavior，然后策略执行就结束了，不会再匹配剩下的classif ier；l 将QoS策略应用到端口后，系统不允许对应修改义流分类、流行为以及QoS策略，直至取消下发。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
H3C交换机典型（ACL）访问控制列表配置实例
一、组网需求：
2．要求配置高级访问控制列表，禁止研发部门与技术支援部门之间互访，并限制研发部门在上班时间8:00至18:00访问工资查询服务器；
三、配置步骤：
H3C 3600 5600 5100系列交换机典型访问控制列表配置
共用配置
1．根据组网图，创建四个vlan，对应加入各个端口
<H3C>system-view
[H3C]vlan 10
[H3C-vlan10]port GigabitEthernet 1/0/1
[H3C-vlan10]vlan 20
[H3C-vlan20]port GigabitEthernet 1/0/2
[H3C-vlan20]vlan 30
2
[H3C-Vlan-interface30]quit
[H3C]interface vlan 40
[H3C-Vlan-interface40]quit
3．定义时间段
[H3C] time-range huawei 8:00 to 18:00 working-day
需求1配置（基本ACL配置）
1．进入2000号的基本访问控制列表视图
[H3C-GigabitEthernet1/0/1] acl number 2000
3．在接口上应用2000号ACL
需求2
1．进入
[H3C]
2
3
4
[H3C-GigabitEthernet1/0/2] packet-filter inbound ip-group 3000
需求3配置（二层ACL配置）
1．进入4000号的二层访问控制列表视图
[H3C] acl number 4000
2．定义访问规则过滤源MAC为00e0-fc01-0101的报文
[H3C-acl-ethernetframe-4000] rule 1 deny source 00e0-fc01-0101 ffff-ffff-ffff time-range Huawei
3．在接口上应用4000号ACL
[H3C-acl-ethernetframe-4000] interface GigabitEthernet1/0/4 [H3C-GigabitEthernet1/0/4] packet-filter inbound link-group 4000 2 H3C 5500-SI 3610 5510系列交换机典型访问控制列表配置
需求2配置
1．进入3000号的高级访问控制列表视图
[H3C]
2
3
4
[H3C]
5
[H3C]
[H3C-behavior-abc] quit
6．定义Qos策略，将流分类和流行为进行关联
[H3C]qos policy abc
[H3C-qospolicy-abc] classifier abc behavior abc
[H3C-qospolicy-abc] quit
7．在端口下发Qos policy
[H3C] interface g1/1/2
[H3C-GigabitEthernet1/1/2] qos apply policy abc inbound
8．补充说明：
l acl只是用来区分数据流，permit与deny由filter确定；
l 如果一个端口同时有permit和deny的数据流，需要分别定义流分类和流行为，并在同一QoS策略中进行关联；
l QoS所对应的
l 将QoS
1．
2source 和
3．。