rule (user ACL6 view)

rule-id

Specifies the ID of an ACL6 rule.

• If the specified rule ID has been created, the new rule is added to the rule with this ID, that is, the old rule is modified. If the specified rule ID does not exist, a rule is created using the ID and ordered based on the configured sequence.
• If the rule ID is not specified, the device allocates an ID to the new rule. By default, the increment of ACL6 is 5 and cannot be changed. Therefore, the device allocates IDs at an increment of 5 to ACL6 rules.

The value is an integer that ranges from 0 to 4294967294.

deny

Denies the packets that match the rule.

-

permit

Permits the packets that match the rule.

-

icmpv6

Indicates that the protocol type is ICMPv6. The value 58 indicates the ICMPv6 protocol.

-

tcp

Indicates that the protocol type is TCP. The value 6 indicates the TCP protocol.

-

udp

Indicates that the protocol type is UDP. The value 17 indicates the UDP protocol.

-

gre

Indicates that the protocol type is GRE. The value 47 indicates the GRE protocol.

-

ipv6

Indicates that the protocol type is IPv6.

-

ospf

Indicates that the protocol type is OSPF. The value 89 indicates the OSPF protocol.

-

protocol-number

Indicates the protocol type expressed by number.

The value is an integer that ranges from 1 to 255.

source { { source-ipv6-address prefix-length | source-ipv6-address/prefix-length | source-ipv6-address postfix postfix-length | source-ipv6-address wildcard | any } | { ucl-group { name source-ucl-group-name | source-ucl-group-index } } } ^*

• source-ipv6-address: The value is in colon hexadecimal notation.
• prefix-length: The value is an integer that ranges from 1 to 128.
• postfix-length: The value is an integer that ranges from 1 to 64.
• wildcard: The value is in colon hexadecimal notation. After the value is converted to a binary number, the value 0 indicates that the equivalent bit must match and the value 1 indicates that the equivalent bit does not matter. The values 1 and 0 can be discontinuous. For example, the IPv6 address FC00::1 and the wildcard mask 0::2 indicate that the address is FC00::00x1, where x can be any value from 0 to F in hexadecimal notation.
• source-ucl-group-name: The value must be the name of an existing UCL group.
• source-ucl-group-index: The value is an integer and must be the index of an existing UCL group. When the value is 0, the source address of packet matching the ACL rule is beyond the UCL group range.

destination { destination-ipv6-address prefix-length | destination-ipv6-address/prefix-length | destination-ipv6-address postfix postfix-length | destination-ipv6-address wildcard | any }

• destination-ipv6-address: The value is in colon hexadecimal notation.
• prefix-length: The value is an integer that ranges from 1 to 128.
• postfix-length: The value is an integer that ranges from 1 to 64.
• wildcard: The value is in colon hexadecimal notation. After the value is converted to a binary number, the value 0 indicates that the equivalent bit must match and the value 1 indicates that the equivalent bit does not matter. The values 1 and 0 can be discontinuous. For example, the IPv6 address FC00::1 and the wildcard mask 0::2 indicate that the address is FC00::00x1, where x can be any value from 0 to F in hexadecimal notation.

icmp6-type { icmp6-name | icmp6-type [ icmp6-code ] }

icmp6-type is an integer that ranges from 0 to 255.

icmp6-code is an integer that ranges from 0 to 255.

The value of cmp6-name and the corresponding ICMPv6 type and ICMPv6 code are as described in Table 1.

source-port { eq port | gt port | lt port | range port-start port-end }

The value of port can be a name or a number.

• When the value is expressed as a number, it ranges from 0 to 65535 in eq port
• When the value is expressed as a number, it ranges from 0 to 65534 in gt port
• When the value is expressed as a number, it ranges from 1 to 65535 in lt port

The value of port-start and port-end can be a name or an integer. When the value is expressed as an integer, it ranges from 0 to 65535.

destination-port { eq port | gt port | lt port | range port-start port-end }

The value of port can be a name or a number.

• When the value is expressed as a number, it ranges from 0 to 65535 in eq port
• When the value is expressed as a number, it ranges from 0 to 65534 in gt port
• When the value is expressed as a number, it ranges from 1 to 65535 in lt port

The value of port-start and port-end can be a name or an integer. When the value is expressed as an integer, it ranges from 0 to 65535.

tcp-flag

Indicates the SYN Flag in the TCP packet header.

-

ack

Indicates that the SYN Flag type in the TCP packet header is ack (010000).

-

established

Indicates that the SYN Flag type in the TCP packet header is ack (010000) or rst (000100).

-

fin

Indicates that the SYN Flag type in the TCP packet header is fin (000001).

-

psh

Indicates that the SYN Flag type in the TCP packet header is psh (001000).

-

rst

Indicates that the SYN Flag type in the TCP packet header is rst (000100).

-

syn

Indicates that the SYN Flag type in the TCP packet header is syn (000010).

-

urg

Indicates that the SYN Flag type in the TCP packet header is urg (100000).

-

time-range time-name

Specifies the name of a time range during which ACL6 rules take effect.

If this parameter is not specified, ACL6 rules take effect at any time.

The value is a string of 1 to 32 characters.

vpn-instance vpn-instance-name

Specifies the name of a VPN instance on the inbound interface.

The value must be an existing VPN instance name.

Echo

128

0

Echo-reply

129

0

err-Header-field

4

0

frag-time-exceeded

3

1

hop-limit-exceeded

3

0

host-admin-prohib

1

1

host-unreachable

1

3

neighbor-advertisement

136

0

neighbor-solicitation

135

0

network-unreachable

1

0

packet-too-big

2

0

port-unreachable

1

4

redirect

137

0

router-advertisement

134

0

router-solicitation

133

0

unknown-ipv6-opt

4

2

unknown-next-hdr

4

1