如何使用带时间的访问控制ACL

# 创建名为work的时间段，其时间范围为每周工作日的8点到18点。

<DeviceA> system-view

[DeviceA] time-range work 09:00 to 18:00 working-day

# 创建IPv4高级ACL 3000，并制订如下规则：允许总裁办在任意时间、财务部在工作时间访问财务数据库服务器，禁止其它部门在任何时间、财务部在非工作时间访问该服务器。

[DeviceA] acl number 3010

[DeviceA-acl-adv-3010] rule deny ip source host 1.1.1.1 destination host 10.3.3.1

[DeviceA-acl-adv-3010] rule permit any

[DeviceA-acl-adv-3010] quit

# 应用IPv4高级ACL 3010对接口Ten-GigabitEthernet1/0/11出方向上的报文进行过滤。

[DeviceA] interface ten-gigabitethernet 1/0/11

[DeviceA-Ten-GigabitEthernet1/0/11] packet-filter 3010 outbound

[DeviceA-Ten-GigabitEthernet1/0/11] quit

time-range time2020 09:00 to 18:00 working-day
acl advanced 3010
rule 5 deny ip source 1.1.1.1 0 destination 10.3.3.1 0 time-range time2020
int g 1/0/11
packet-filter 3010 outbound

怎么还能通？
<SW1>ping -a 1.1.1.1 10.3.3.1
Ping 10.3.3.1 (10.3.3.1) from 1.1.1.1: 56 data bytes, press CTRL_C to break
56 bytes from 10.3.3.1: icmp_seq=0 ttl=127 time=1.000 ms
56 bytes from 10.3.3.1: icmp_seq=1 ttl=127 time=1.000 ms

您好，请知：

可以参考如下时间ACL的配置脚本及案例，有详细的配置过程及测试效果：

[SW1]time-range time1 10:45 to 10:55 Fri

[SW1]acl advanced 3000

[SW1-acl-ipv4-adv-3000]rule 0 permit ip source 172.16.10.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 time-range time1

[SW1-acl-ipv4-adv-3000]rule 1 permit ip source 172.16.20.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 time-range time1

[SW1-acl-ipv4-adv-3000]rule 3 deny ip source 172.16.10.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 time-range time1

[SW1-acl-ipv4-adv-3000]rule 4 deny ip source 172.16.20.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 time-range time1

[SW1-acl-ipv4-adv-3000]quit

[SW1]int gi 1/0/1

[SW1-GigabitEthernet1/0/1]packet-filter 3000 outbound

[SW1-GigabitEthernet1/0/1]quit

https://zhiliao.h3c.com/theme/details/102390