H3c3100，version 3.10，端口不支持 packet-filter，如何设置访问控制ACL？

qos方式：

1. Device A上的配置

# 创建VLAN 20和VLAN 30。

<DeviceA> system-view

[DeviceA] vlan 20

[DeviceA-vlan20] quit

[DeviceA] vlan 30

[DeviceA-vlan30] quit

# 创建批量接口组myport，并将GigabitEthernet1/0/1～GigabitEthernet1/0/4加入批量接口组。

[DeviceA] interface range name myport interface gigabitethernet 1/0/1 to gigabitethernet 1/0/4

# 将GigabitEthernet1/0/1～GigabitEthernet1/0/4的接口类型为trunk，并允许VLAN 20和VLAN 30通过。

[DeviceA-if-range-myport] port link-type trunk

[DeviceA-if-range-myport] port trunk permit vlan 20 30

[DeviceA-if-range-myport] undo port trunk permit vlan 1

[DeviceA-if-range-myport] quit

# 创建IPv4高级ACL 3000，对源IP地址为192.168.4.0/24网段的报文进行分类。

[DeviceA] acl advanced 3000

[DeviceA-acl-ipv4-adv-3000] rule deny tcp source 192.168.4.0 0.0.0.255 source-port eq 80

[DeviceA-acl-ipv4-adv-3000] quit

# 创建流分类vlan20_http，匹配ACL 3000。

[DeviceA] traffic classifier vlan20_http

[DeviceA-classifier-vlan20_http] if-match acl 3000

[DeviceA-classifier-vlan20_http] quit

# 创建流行为vlan20_http，动作为流量过滤（deny），拒绝数据包通过。

[DeviceA] traffic behavior vlan20_http

[DeviceA-behavior-vlan20_http] filter deny

[DeviceA-behavior-vlan20_http] quit

# 创建QoS策略，命名为vlan20_http，将流分类vlan20_http和流行为vlan20_http进行关联。

[DeviceA] qos policy vlan20_http

[DeviceA-qospolicy-vlan20_http] classifier vlan20_http behavior vlan20_http

[DeviceA-qospolicy-vlan20_http] quit

# 将QoS策略vlan20_http应用到VLAN 20和VLAN 30。

[DeviceA] qos vlan-policy vlan20_http vlan 20 30 inbound

2. Device B上的配置

# 创建IPv4基本ACL 2000，并配置允许来自Host A和Host B的报文通过的规则。

[DeviceB] acl basic 2000

[DeviceB-acl-ipv4-basic-2000] rule permit source 192.168.4.10 0

[DeviceB-acl-ipv4-basic-2000] rule permit source 192.168.4.15 0

[DeviceB-acl-ipv4-basic-2000] quit

# 配置报文过滤的缺省动作为Deny，即禁止未匹配上ACL规则的报文通过。

[DeviceB] packet-filter default deny

# 在GigabitEthernet1/0/1接口出方向上应用ACL 2000进行报文过滤。

[DeviceB] interface gigabitethernet 1/0/1

[DeviceB-GigabitEthernet1/0/1] packet-filter 2000 outbound

4.4  验证配置

# 通过display qos vlan-policy命令显示Device A上基于VLAN应用的QoS策略，查看策略是否应用成功。

[DeviceA] display qos vlan-policy vlan inbound

Vlan 20

  Direction: Inbound

  Policy: vlan20_http

   Classifier: vlan20_http

     Operator: AND

     Rule(s) :

      If-match acl 3000

     Behavior: vlan20_http

      Filter enable: Deny

Vlan 30

  Direction: Inbound

  Policy: vlan20_http

   Classifier: vlan20_http

     Operator: AND

     Rule(s) :

      If-match acl 3000

     Behavior: vlan20_http

      Filter enable: Deny

# 通过display packet-filter verbose命令显示Device B上的报文过滤情况。

[DeviceB] display packet-filter verbose interface gigabitethernet 1/0/1 outbound

Interface: GigabitEthernet1/0/1

 Outbound policy:

  IPv4 ACL 2000

   rule 0 permit source 192.168.4.10 0

  IPv4 default action: Deny