| 场景 | 接口流量精细过滤 |
|---|---|
| 适用 | Cisco IOS/IOS-XE |
| 命令族 | access-list 100-199 + ip access-group |
思科 IOS
思科 IOS
access-list 100 permit tcp any host 10.1.1.10 eq 443
access-list 100 deny ip 10.2.0.0 0.0.255.255 any
access-list 100 permit ip any any
show access-lists 100
show ip access-lists 100 | include matches华为 VRP
华为 VRP
acl number 3000
rule 5 permit tcp destination 10.1.1.10 0 destination-port eq 443
rule 10 deny ip source 10.2.0.0 0.0.255.255
rule 15 permit ipH3C Comware
H3C Comware
acl advanced 3000
rule 5 permit tcp destination 10.1.1.10 0 destination-port eq 443
rule 10 deny ip source 10.2.0.0 0.0.255.255
rule 15 permit ip差异：思科端口可写服务名（eq www、eq domain）；华为/H3C 也认部分服务名，但为兼容性统一写数字端口更稳。