华为firewall是没有默认条目的，需自己定义

firewall enable

firewall default deny

一、定义标准ACL

     acl 1-99

    rule normal {permit/deny} source source-ip source-wildcard

eg: acl 1

     rule normal permit source 192.168.2.0 0.0.0.255   允许192.168.2.0网段的流量

 

二、定义扩展ACL

    acl 100-199

     rule 1 {permit/deny} protocol source source-ip source-wildcard  [source-port port ]dest-ip dest-wildcard [dest-port port ]

eg:acl 123

    rule 1 permit ip source 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255允许192.168.2.0这个网段访问10.10.1.0网段

 

三、基于时间的ACL

    time-range name time1 to time2 daily/weekday/weekend

   acl 100

   rule 1permit ip source 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255 time-range name