rule (IPv6 advanced ACL view)

source { source-address source-prefix | source-address/source-prefix | any }

Specifies a source IPv6 address.

The source-address and source-prefix arguments represent an IPv6 source address, and prefix length in the range of 1 to 128.

The any keyword represents any IPv6 source address.

destination { dest-address dest-prefix | dest-address/dest-prefix | any }

Specifies a destination IPv6 address.

The dest-address and dest-prefix arguments represent a destination IPv6 address, and prefix length in the range of 1 to 128.

The any keyword specifies any IPv6 destination address.

counting

Counts the number of times the IPv6 advanced ACL rule has been matched.

The counting keyword enables match counting specific to rules, and the hardware-count keyword in the packet-filter ipv6 command enables match counting for all rules in an ACL. If the counting keyword is not specified, matches for the rule are not counted.

dscp dscp

Specifies a DSCP preference.

The dscp argument can be a number in the range of 0 to 63, or in words: af11 (10), af12 (12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42 (36), af43 (38), cs1 (8), cs2 (16), cs3 (24), cs4 (32), cs5 (40), cs6 (48), cs7 (56), default (0), or ef (46).

flow-label flow-label-value

Specifies a flow label value in an IPv6 packet header.

The flow-label-value argument is in the range of 0 to 1048575.

fragment

Applies the rule to only fragments.

Without this keyword, the rule applies to all fragments and non-fragments.

logging

Logs matching packets.

This function requires that the module (for example, packet filtering) that uses the ACL supports logging.

routing [ type routing-type ]

Specifies routing header types.

routing-type: Value of the routing header type, in the range of 0 to 255.

If you specify the type routing-type option, the rule applies to the specified type of routing header. Otherwise, the rule applies to any type of routing header.

hop-by-hop [ type hop-type ]

Specifies a Hop-by-Hop Options header type in IPv6 extension headers.

hop-type: Value of the Hop-by-Hop Options header type, in the range of 0 to 255.

If you specify the type hop-type option, the rule applies to the specified type of Hop-by-Hop Options header. Otherwise, the rule applies to any type of Hop-by-Hop Options header in IPv6 extension headers.

time-range time-range-name

Specifies a time range for the rule.

The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the timer range.

For more information about time range, see ACL and QoS Configuration Guide.

vpn-instance vpn-instance-name

Applies the rule to a VPN instance.

The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters.

If no VPN instance is specified, the rule applies to all packets.

This parameter is not supported in the current software version. The option is reserved for future support.

source-port operator port1 [ port2 ]

Specifies one or more UDP or TCP source ports.

The operator argument can be lt (lower than), gt (greater than), eq (equal to), neq (not equal to), or range (inclusive range).

The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. port2 is needed only when the operator argument is range.

TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp (119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), and www (80).

UDP port numbers can be represented as: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds (65), talk (517), tftp (69), time (37), who (513), and xdmcp (177).

destination-port operator port1 [ port2 ]

Specifies one or more UDP or TCP destination ports.

{ ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } *

Specifies one or more TCP flags, including ACK, FIN, PSH, RST, SYN, and URG.

Parameters specific to TCP.

The value for each argument can be 0 (flag bit not set) or 1 (flag bit set).

The TCP flags in a rule are ANDed. A rule configured with ack 0 psh 1 matches packets that have the ACK flag bit not set and the PSH flag bit set.

The parameters are not supported in the current software version. They are reserved for future support.

established

Specifies the flags for indicating the established status of a TCP connection.

Parameter specific to TCP.

The rule matches TCP connection packets with the ACK or RST flag bit set.

icmp6-type { icmp6-type icmp6-code | icmp6-message }

Specifies the ICMPv6 message type and code.

The icmp6-type argument is in the range of 0 to 255.

The icmp6-code argument is in the range of 0 to 255.

The icmp6-message argument specifies a message name. Supported ICMP message names and their corresponding type and code values are listed in Table 15.

echo-reply

129

0

echo-request

128

0

err-Header-field

4

0

frag-time-exceeded

3

1

hop-limit-exceeded

3

0

host-admin-prohib

1

1

host-unreachable

1

3

neighbor-advertisement

136

0

neighbor-solicitation

135

0

network-unreachable

1

0

packet-too-big

2

0

port-unreachable

1

4

redirect

137

0

router-advertisement

134

0

router-solicitation

133

0

unknown-ipv6-opt

4

2

unknown-next-hdr

4

1