Several commands that H3C ACLs apply to interfaces

The use of access control lists is specified by the range of numbers, 1000~1999 is an interface-based access control list, 2000~2999-scoped access control lists are basic access control lists, and 3000~3999-scoped access control lists are advanced access control lists. There are two matching sequences: Configuration order, auto sort: ACL number Acl-number [match-order {config | auto}]

Several commands that the H3C ACL applies to an interface:

I. Packet-filter inbound Ip-group acl-number (version 3.10)

II. Firewall Packet-filter 3000 Inbound (for Secpach and version 5.20)

Third, the QoS method

1. # define ACLs

ACL number 3001

Rule deny IP source 1.1.1.1 0

ACL number 3002

Rule permit IP Source 1.0.0.0 0.255.255.255

2.# configuration rejects classes that receive source addresses of 1.1.1.1 Messages and is popular for

Traffic Classifier 1

If-match ACL 3001

Traffic Behavior 1

Filter Deny

# Configure classes that allow other source addresses and are popular for

Traffic Classifier 2

If-match ACL 3002

Traffic Behavior 2

Filter Permit

# Configure Policy

QoS Policy Test

Classifier 1 Behavior 1

Classifier 2 Behavior 2

# Apply Policy

Interface Ethernet 1/0/1

QoS Apply Policy Test inbound

3. Configuration key points:

1 The final matching action of the ACL is permit or deny, not determined by the action of rule in the ACL, but by the action of the behavior corresponding to the ACL.

2 for access control with both permit and deny requirements, two behavior, one for permit and one for deny, must be specified.

This article describes the H3C NAT configuration instance.

H3C NAT Configuration:

1. Configure static address translation: One-to-one static address translation: [System] nat static IP-ADDR1 IP-ADDR2

Static segment Address translation: [System] nat static Net-to-net inside-start-address inside-end-address Global global-address Mask

Apply to interface: [Interface]nat outbound static

2, multiple to multiple address conversion: [Interface]nat outbound Acl-number address-group group-number No-pat

3, configure Napt:[interface]nat outbound Acl-number [Address-group Group-number]

Two special napt:

Easy IP: [Interface]nat outbound Acl-number (Translate to interface address)

Lookback:[interface]nat Outbound Acl-number Interface loopback Interface-number (converted to loopback address)

4. Bidirectional address translation: [System]nat overlapaddress number overlappool-startaddress temppool-startaddress {pool-length Pool-length | Address-mask Mask} (need to combine outbound command)

5. Configure Internal server: [Interface]nat server

6. Address Translation Application Layer gateway: [System]nat ALG (specifically for NAT-sensitive protocols such as FTP)