Example for Allowing Certain Users to Access the Internet in the Specified Time Range

Procedure

1. Configure VLANs and IP addresses for interfaces.

   # Create VLAN 10 and VLAN 20.

   <HUAWEI> system-view
   [HUAWEI] sysname Switch
   [Switch] vlan batch 10 20
   

   # Configure GE1/0/1 and GE1/0/2 of the Switch as trunk interfaces and add them to VLAN 10 and VLAN 20 respectively. Configure GE2/0/1 of the Switch as a trunk interface and add it to both VLAN 10 and VLAN 20.

   [Switch] interface gigabitethernet 1/0/1
   [Switch-GigabitEthernet1/0/1] port link-type trunk
   [Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10
   [Switch-GigabitEthernet1/0/1] quit
   [Switch] interface gigabitethernet 1/0/2
   [Switch-GigabitEthernet1/0/2] port link-type trunk
   [Switch-GigabitEthernet1/0/2] port trunk allow-pass vlan 20
   [Switch-GigabitEthernet1/0/2] quit
   [Switch] interface gigabitethernet 2/0/1
   [Switch-GigabitEthernet2/0/1] port link-type trunk
   [Switch-GigabitEthernet2/0/1] port trunk allow-pass vlan 10 20
   [Switch-GigabitEthernet2/0/1] quit

   # Create VLANIF 10 and VLANIF 20 and assign IP addresses to them.

   [Switch] interface vlanif 10
   [Switch-Vlanif10] ip address 10.1.1.1 24
   [Switch-Vlanif10] quit
   [Switch] interface vlanif 20
   [Switch-Vlanif20] ip address 10.1.2.1 24
   [Switch-Vlanif20] quit
   

2. Configure a time range.

   # Configure the periodic time range from Saturday to Sunday.

   [Switch] time-range rest-time 0:00 to 23:59 off-day  //Configure a periodic time range for an ACL.

3. Configure an ACL.

   # Create basic ACL 2001 and configure rules to allow the R&D and marketing managers (10.1.1.11 and 10.1.2.12) to access the Internet anytime and prevent other employees from accessing the Internet on Saturday and Sunday. That is, only the managers of R&D and marketing departments can access the Internet on Saturday and Sunday.

   [Switch] acl 2001
   [Switch-acl-basic-2001] rule permit source 10.1.1.11 0  //Allow the manager of the R&D department to access the Internet anytime.
   [Switch-acl-basic-2001] rule permit source 10.1.2.12 0  //Allow the manager of the marketing department to access the Internet anytime.
   [Switch-acl-basic-2001] rule deny time-range rest-time  //Prevent other users from accessing the Internet On Saturday and Sunday.
   [Switch-acl-basic-2001] quit

4. Configure the basic ACL-based traffic classifier.

   # Configure the traffic classifier tc1 to classify packets that match ACL 2001.

   [Switch] traffic classifier tc1  //Create a traffic classifier.
   [Switch-classifier-tc1] if-match acl 2001  //Associate an ACL with the traffic classifier.
   [Switch-classifier-tc1] quit

5. Configure traffic behaviors.

   # Configure the traffic behavior tb1 and set the action to permit (default value).

   

   Packets matching the ACL are discarded as long as a deny action exists in an ACL rule or traffic behavior.

   [Switch] traffic behavior tb1  //Create a traffic behavior.
   [Switch-behavior-tb1] quit

6. Configure the traffic policy.

   # Define the traffic policy and associate the traffic classifier and traffic behavior with the traffic policy.

   [Switch] traffic policy tp1  //Create a traffic policy.
   [Switch-trafficpolicy-tp1] classifier tc1 behavior tb1  //Associate the traffic classifier tc1 with the traffic behavior tb1.
   [Switch-trafficpolicy-tp1] quit

7. Apply the traffic policy to an interface.

   # Packets from internal hosts are forwarded to the Internet through GE2/0/1; therefore, apply the traffic policy tp1 to the outbound direction of GE2/0/1.

   [Switch] interface gigabitethernet 2/0/1
   [Switch-GigabitEthernet2/0/1] traffic-policy tp1 outbound  //Apply the traffic policy to the outbound direction of an interface.
   [Switch-GigabitEthernet2/0/1] quit
   

8. Verify the configuration.

   # Check the configuration of ACL rules.

   [Switch] display acl 2001
   Basic ACL 2001, 3 rules                                                         
   Acl's step is 5                                                                 
    rule 5 permit source 10.1.1.11 0 (match-counter 0)                             
    rule 10 permit source 10.1.2.12 0 (match-counter 0)                            
    rule 15 deny time-range rest-time(match-counter 0) (Inactive)  

   # Check the configuration of the traffic classifier.

   [Switch] display traffic classifier user-defined
     User Defined Classifier Information:
      Classifier: tc1
       Precedence: 5
       Operator: OR
       Rule(s) : if-match acl 2001                                                 
   
   Total classifier number is 1   

   # Check the configuration of the traffic policy.

   [Switch] display traffic policy user-defined tp1
     User Defined Traffic Policy Information:                                      
     Policy: tp1                                                                   
      Classifier: tc1                                                              
       Operator: OR                                                                
        Behavior: tb1                                                              
         Permit  
   Total policy number is 1

   # All employees can access the Internet on work days. Only the managers (10.1.1.11 and 10.1.2.12) of R&D and marketing departments can access the Internet on weekends.