rule (advanced ACL6 view)

rule-id

Specifies the ID of an ACL6 rule.

• If the specified rule ID has been created, the new rule is added to the rule with this ID, that is, the old rule is modified. If the specified rule ID does not exist, a rule is created using the ID and ordered based on the configured sequence.
• If the rule ID is not specified, the device allocates an ID to the new rule. By default, the increment of ACL6 is 5 and cannot be changed. Therefore, the device allocates IDs at an increment of 5 to ACL6 rules.

The value is an integer that ranges from 0 to 4294967294.

deny

Denies the packets that match the rule.

-

permit

Permits the packets that match the rule.

-

tcp

Indicates that the protocol type is TCP.

-

udp

Indicates that the protocol type is UDP.

-

icmpv6

Indicates that the protocol type is ICMPv6.

-

protocol-number

Specifies the protocol type that is expressed as a name or a number.

The value ranges from 1 to 255. The protocol type expressed as a name can be GRE, ICMPv6, IPv6, OSPF, TCP, and UDP.

destination { destination-ipv6-address prefix-length | destination-ipv6-address/prefix-length | any }

Indicates the destination address and prefix of a packet.

destination-ipv6-address is expressed in colon hexadecimal notation. The value of prefix-length is an integer that ranges from 1 to 128. You can also use any to represent any destination address.

destination destination-ipv6-address postfix postfix-length

Indicates the destination address and the length of destination address postfix.

destination-ipv6-address indicates the destination address and is expressed in colon hexadecimal notation. postfix-length is an integer that ranges from 1 to 64.

destination destination-ipv6-address wildcard

Indicates the destination address and wildcard mask.

destination-ipv6-address indicates the destination address and is expressed in colon hexadecimal notation. wildcard is expressed in colon hexadecimal notation. After the value is converted to a binary number, the value 0 indicates that the equivalent bit must match and the value 1 indicates that the equivalent bit does not matter. The values 1 and 0 can be discontinuous. For example, the IPv6 address FC00::1 and the wildcard mask 0::2 indicate that the address is FC00::00x1, where x can be any value from 0 to F in hexadecimal notation.

dscp dscp

Specifies the Differentiated Services Code Point (DSCP) value.

The value of dscp can be an integer or a name. When the value is an integer, the value ranges from 0 to 63. When the value is a name, the value can be af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, cs1, cs2, cs3, cs4, cs5, cs6, cs7, default, or ef.

routing [ routing-type routing-type ]

Specifies the IPv6 header in ACL6. The routing-type parameter specifies the routing-type field in the IPv6 header.

The value of routing-type is an integer that ranges from 0 to 255.

fragment

Indicates that the rule is valid only for non-first fragments.

-

first-fragment

Indicates that the rule is valid only for first fragments.

-

logging

Logs IP information of packets that match the rule.

-

precedence precedence

Indicates that the packets are filtered according to the precedence field.

precedence can be expressed as a name or a number. The value ranges from 0 to 7.

source { source-ipv6-address prefix-length | source-ipv6-address/prefix-length | any }

Indicates the source address and prefix of a packet.

source-ipv6-address indicates the source address and is expressed in colon hexadecimal notation. prefix-length is an integer that ranges from 1 to 128. You can also use any to represent any source address.

source source-ipv6-address postfix postfix-length

Indicates the source address and the length of source address postfix.

source-ipv6-address indicates the source address and is expressed in colon hexadecimal notation. postfix-length is an integer that ranges from 1 to 64.

source source-ipv6-address wildcard

Indicates the source address and wildcard mask.

source-ipv6-address indicates the source address and is expressed in colon hexadecimal notation. wildcard is expressed in colon hexadecimal notation. After the value is converted to a binary number, the value 0 indicates that the equivalent bit must match and the value 1 indicates that the equivalent bit does not matter. The values 1 and 0 can be discontinuous. For example, the IPv6 address FC00::1 and the wildcard mask 0::2 indicate that the address is FC00::00x1, where x can be any value from 0 to F in hexadecimal notation.

destination-port { eq port | gt port | lt port | range port-start port-end }

The value of port can be a name or a number.

• When the value is expressed as a number, it ranges from 0 to 65535 in eq port
• When the value is expressed as a number, it ranges from 0 to 65534 in gt port
• When the value is expressed as a number, it ranges from 1 to 65535 in lt port

The value of port-start and port-end can be a name or a number. When the value is expressed as a number, it ranges from 0 to 65535.

Table 4 and Table 3 list the mapping between the well-known source or destination port numbers of UDP or TCP and values of port.

source-port { eq port | gt port | lt port | range port-start port-end }

The value of port can be a name or a number.

• When the value is expressed as a number, it ranges from 0 to 65535 in eq port
• When the value is expressed as a number, it ranges from 0 to 65534 in gt port
• When the value is expressed as a number, it ranges from 1 to 65535 in lt port

The value of port-start and port-end can be a name or a number. When the value is expressed as a number, it ranges from 0 to 65535.

Table 4 and Table 3 list the mapping between the well-known source or destination port numbers of UDP or TCP and values of port.

icmp6-type { icmp6-name | icmp6-type [ icmp6-code ] }

icmp6-type is an integer that ranges from 0 to 255.

icmp6-code is an integer that ranges from 0 to 255.

The value of cmp6-name and the corresponding ICMPv6 type and ICMPv6 code are as described in Table 2.

tcp-flag

Indicates the SYN Flag in the TCP packet header.

-

ack

Indicates that the type of the SYN Flag in the TCP packet header is ack (010000).

-

established

Indicates that the type of the SYN Flag in the TCP packet header is ack (010000) or rst (000100).

-

fin

Indicates that the type of the SYN Flag in the TCP packet header is fin (000001).

-

psh

Indicates that the type of the SYN Flag in the TCP packet header is psh (001000).

-

rst

Indicates that the type of the SYN Flag in the TCP packet header is rst (000100).

-

syn

Indicates that the type of the SYN Flag in the TCP packet header is syn (000010).

-

urg

Indicates that the type of the SYN Flag in the TCP packet header is urg (100000).

-

time-range time-name

Indicates that the configured ACL6 rule is effective only in the specified time range. time-name indicates the name of the time range during which the ACL6 rule takes effect.

The value of time-name is a string of 1 to 32 characters.

tos tos

Indicates that packets are filtered according to the Type of Service (ToS).

vpn-instance vpn-instance-name | public

• vpn-instance vpn-instance-name: Specifies the name of a VPN instance, indicating that the ACL6 rule matches private network packets.
• public: Indicates that the ACL6 rule matches public network packets.

-

Redirect

137

0

Echo

128

0

Echo-reply

129

0

Err-Header-field

4

0

Frag-time-exceeded

3

1

Hop-limit-exceeded

3

0

Host-admin-prohib

1

1

Host-unreachable

1

3

Neighbor-advertisement

136

0

Neighbor-solicitation

135

0

Network-unreachable

1

0

Packet-too-big

2

0

Port-unreachable

1

4

Router-advertisement

134

0

Router-solicitation

133

0

Unknown-ipv6-opt

4

2

Unknown-next-hdr

4

1

7

echo

Echo

Port for the Echo service.

9

discard

Discard

Port for the null service, which is used for connectivity test.

13

daytime

Daytime

Port used to send the date and time to the requesting host.

19

CHARgen

Character generator

Port for the Character Generator Protocol.

20

ftp-data

FTP data connections

FTP data port.

21

ftp

File Transfer Protocol (FTP)

FTP port.

23

telnet

Telnet

Port for the Telnet service.

25

smtp

Simple Mail Transport Protocol (SMTP)

SMTP port.

37

time

Time

Port for the time protocol.

43

whois

Nicname (WHOIS)

Port for the directory service.

49

tacacs

TAC Access Control System (TACACS)

Port for the access control system based on TCP/IP authentication (TACACS login host protocol).

53

domain

Domain Name Service (DNS)

DNS port.

70

gopher

Gopher

Port for the information index protocol (document searching and indexing on the Internet).

79

finger

Finger

Port for the Finger service, which is used to query information, such as online users of remote hosts.

80

www

World Wide Web (HTTP)

HTTP port for the WWW service, which is used to browse web pages.

101

hostname

NIC hostname server

Host name service port on the NIC machine.

109

pop2

Post Office Protocol v2

Port for the email protocol version 2.

110

pop3

Post Office Protocol v3

Port for the email protocol version 3.

111

sunrpc

Sun Remote Procedure Call (RPC)

Port for the RPC protocol of SUN. It is used to remotely execute commands and used by the network file system (NFS).

119

nntp

Network News Transport Protocol (NNTP)

NNTP port, which carries USENET.

179

bgp

Border Gateway Protocol (BGP)

BGP port.

194

irc

Internet Relay Chat (IRC)

Port for the IRC protocol.

512

exec

Exec (rsh)

Port used to authenticate remote processes.

513

login

Login (rlogin)

Port for remote login.

514

cmd

Remote commands

Port used to execute non-interactive commands on a remote system (rshell, rcp).

515

lpd

Printer service

Port for the Line Printer Daemon protocol.

517

talk

Talk

Port used to remotely talk with servers and clients.

540

uucp

Unix-to-Unix Copy Program

Port for the Unix-to-Unix copy protocol.

543

klogin

Kerberos login

Port for Kerberos remote login protocol version 5.

544

kshell

Kerberos shell

Port for Kerberos remote shell protocol version 5.

7

echo

Echo

Port for the Echo service.

9

discard

Discard

Port for the null service, which is used for connectivity test.

37

time

Time

Port for the time protocol.

42

nameserver

Host Name Server

Port for the host name service.

53

dns

Domain Name Service (DNS)

DNS port.

65

tacacs-ds

TACACS-Database Service

Port for the TACACS database service.

67

bootps

Bootstrap Protocol (BOOTP) Server

Port for the BOOTP server, which is also used by DHCP servers.

68

bootpc

Bootstrap Protocol (BOOTP) Client

Port for the BOOTP client, which is also used by DHCP clients.

69

tftp

Trivial File Transfer Protocol (TFTP)

TFTP port.

90

dnsix

DNSIX Security Attribute Token Map

Port for DoD Network Security for Information Exchange (DNSIX) Security Attribute Token Map.

111

sunrpc

SUN Remote Procedure Call (SUN RPC)

Port for the RPC protocol of SUN. It is used to remotely execute commands and used by the NFS.

123

ntp

Network Time Protocol (NTP)

NTP port, which may be utilized by worm virus.

137

netbios-ns

NETBIOS Name Service

Port for the NetBIOS name service.

138

netbios-dgm

NETBIOS Datagram Service

Port for the NetBIOS datagram service.

139

netbios-ssn

NETBIOS Session Service

Port for the NetBIOS session service.

161

snmp

SNMP

Port for the Simple Network Management Protocol (SNMP).

162

snmptrap

SNMPTRAP

Port for SNMP trap.

177

xdmcp

X Display Manager Control Protocol (XDMCP)

XDMCP port.

434

mobilip-ag

MobileIP-Agent

Port for the mobile IP agent.

435

mobilip-mn

MobileIP-MN

Port for mobile IP management.

512

biff

Mail notify

Port used to notify user of received emails.

513

who

Who

Port for the login user list.

514

syslog

Syslog

Port for the UNIX system log service.

517

talk

Talk

Port used to remotely talk with servers and clients.

520

rip

Routing Information Protocol

RIP port.