rule-deny skip-action

Function

The rule-deny skip-action command creates an action for making the deny action in an ACL or ACL6 ineffective in a traffic behavior.

The undo rule-deny skip-action command cancels the configuration.

By default, no action for making the deny action in an ACL or ACL6 ineffective is created in a traffic behavior.

Format

rule-deny skip-action

undo rule-deny skip-action

Parameters

None

Views

Traffic behavior view

Default Level

2: Configuration level

Usage Guidelines

Usage Scenario

If a traffic classifier contains an ACL or ACL6 rule that defines the deny action, traffic matching the deny action is discarded.

To prevent such traffic from being discarded, run the rule-deny skip-action command in the traffic behavior view. The switch does not take other actions (except traffic statistics collection) defined in the traffic behavior for traffic matching the deny action.

Precautions

If both the rule-deny skip-action and statistic enable commands are configured in a traffic behavior, traffic matching the deny action in the ACL or ACL6 is forwarded based on the original forwarding path and statistics on the traffic are collected.

If the rule-deny skip-action command is configured in a traffic behavior and logging is specified in the ACL or ACL6 rule that defines the deny action, the following situations may occur:

When the traffic policy is applied to the inbound direction on the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-S, S6730-S, S6730S-S, S5731S-H, S5732-H, S6720-EI, S6730-H, S6730S-H, S6720-HI, or S6720S-EI, traffic matching the deny action in the ACL or ACL6 rule is forwarded based on the original forwarding path, and IP addresses of packets matching the rule are logged. On the other models, traffic matching the deny action in an ACL or ACL6 is discarded, and IP addresses of packets matching the rule are logged.
When the traffic policy is applied to the outbound direction, traffic matching the deny action in the ACL or ACL6 is forwarded based on the original forwarding path, but IP addresses of packets matching the rule are not logged.

Example

# Create an action for making the deny action in an ACL ineffective in traffic behavior b1.

<HUAWEI> system-view
[HUAWEI] acl 3000
[HUAWEI-acl-adv-3000] rule deny ip source 192.168.10.1 0
[HUAWEI-acl-adv-3000] quit
[HUAWEI] traffic classifier c1
[HUAWEI-classifier-c1] if-match acl 3000
[HUAWEI-classifier-c1] quit
[HUAWEI] traffic behavior b1
[HUAWEI-behavior-b1] rule-deny skip-action