| 场景 | 精细化包过滤 |
|---|---|
| 适用 | H3C Comware 交换机/路由器 |
| 命令族 | acl advanced + rule + packet-filter |
H3C Comware
H3C Comware
acl advanced 3000
rule 5 permit tcp source 192.168.10.0 0.0.0.255 destination-port eq 22
rule 10 deny ip source 10.2.0.0 0.0.255.255 logging
rule 15 permit ip
display acl 3000华为 VRP
华为 VRP
acl number 3000
rule 5 permit tcp source 192.168.10.0 0.0.0.255 destination-port eq 22
rule 10 deny ip source 10.2.0.0 0.0.255.255 logging
rule 15 permit ip思科 IOS
思科 IOS
access-list 100 permit tcp 192.168.10.0 0.0.0.255 any eq 22
access-list 100 deny ip 10.2.0.0 0.0.255.255 any log
access-list 100 permit ip any any差异：华为与 H3C 的规则命中日志关键字都是 logging，思科是 log（或 log-input 记录入接口）；开启后高频命中会刷日志，只对关键规则开。