SlideShare a Scribd company logo
1 of 2
Dear Jonathan, 
As per our recent conversation o the fone, find below the huawei ACL command which deny all 
Ip that TTL is under 16. 
For any support, feel free to contact me 
step1. delete the default flow-template and apply a new one on the slot. 
dis flow-template user-defined #you will see default flow-template applied on every slot. 
undo flow-template user-defined slot 4 #delete the default one 
flow-template user-defined slot 4 ip-protocol tcp-flag sport dport sip 0.0.0.0 dip 0.0.0.0 ttl 
#define a new one contains ttl. 
int g4/1/1 
flow-template user-defined # apply this template on the interface. 
step2. define an ACL which has the same function as cisco. 
# 
acl name deny-low-ttl advanced 
rule 1 deny ip ttl 1 
rule 2 deny ip ttl 2 
rule 3 deny ip ttl 3 
rule 4 deny ip ttl 4 
rule 5 deny ip ttl 5 
rule 6 deny ip ttl 6 
rule 7 deny ip ttl 7 
rule 8 deny ip ttl 8 
rule 9 deny ip ttl 9 
rule 10 deny ip ttl 10 
rule 11 deny ip ttl 11 
rule 12 deny ip ttl 12 
rule 13 deny ip ttl 13 
rule 14 deny ip ttl 14 
rule 15 deny ip ttl 15 
rule 16 permit ip
step3. apply the ACL on the interface. 
int g4/1/1 
packet-filter inbound ip-group deny-low-ttl 
PS: 
deny low ttl will drop the routing protocol multicast packets , you'd better define rules to make 
sure the routing protocol running normal. I think you can define the rule with dscp or tos.

More Related Content

Similar to ttl expired acl

Iptables fundamentals
Iptables fundamentalsIptables fundamentals
Iptables fundamentals
ram_b17
 
Linux internet server security and configuration tutorial
Linux internet server security and configuration tutorialLinux internet server security and configuration tutorial
Linux internet server security and configuration tutorial
annik147
 
80 c51 family programmer’s guide
80 c51 family programmer’s guide80 c51 family programmer’s guide
80 c51 family programmer’s guide
Pratheesh Pala
 
Router security-configuration-guide-executive-summary
Router security-configuration-guide-executive-summaryRouter security-configuration-guide-executive-summary
Router security-configuration-guide-executive-summary
moonmanik
 
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
Uccn1003  -may09_-_lect09_-_access_control_list_acl_Uccn1003  -may09_-_lect09_-_access_control_list_acl_
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
Shu Shin
 
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
Uccn1003  -may09_-_lect09_-_access_control_list_acl_Uccn1003  -may09_-_lect09_-_access_control_list_acl_
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
Shu Shin
 

Similar to ttl expired acl (20)

TekTape Manual
TekTape ManualTekTape Manual
TekTape Manual
 
OSPF_Exercises.pdf
OSPF_Exercises.pdfOSPF_Exercises.pdf
OSPF_Exercises.pdf
 
Krzysztof Mazepa - Netflow/cflow - ulubionym narzędziem operatorów SP
Krzysztof Mazepa - Netflow/cflow - ulubionym narzędziem operatorów SPKrzysztof Mazepa - Netflow/cflow - ulubionym narzędziem operatorów SP
Krzysztof Mazepa - Netflow/cflow - ulubionym narzędziem operatorów SP
 
Iptables fundamentals
Iptables fundamentalsIptables fundamentals
Iptables fundamentals
 
Linux internet server security and configuration tutorial
Linux internet server security and configuration tutorialLinux internet server security and configuration tutorial
Linux internet server security and configuration tutorial
 
80 c51 family programmer’s guide
80 c51 family programmer’s guide80 c51 family programmer’s guide
80 c51 family programmer’s guide
 
03 linuxfirewall1
03 linuxfirewall103 linuxfirewall1
03 linuxfirewall1
 
Router security-configuration-guide-executive-summary
Router security-configuration-guide-executive-summaryRouter security-configuration-guide-executive-summary
Router security-configuration-guide-executive-summary
 
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
Uccn1003  -may09_-_lect09_-_access_control_list_acl_Uccn1003  -may09_-_lect09_-_access_control_list_acl_
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
 
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
Uccn1003  -may09_-_lect09_-_access_control_list_acl_Uccn1003  -may09_-_lect09_-_access_control_list_acl_
Uccn1003 -may09_-_lect09_-_access_control_list_acl_
 
lab1
lab1lab1
lab1
 
Ccnp3 lab 3_1_en (hacer)
Ccnp3 lab 3_1_en (hacer)Ccnp3 lab 3_1_en (hacer)
Ccnp3 lab 3_1_en (hacer)
 
DCC 3.0(cctk)support for newly added bios tokens
DCC 3.0(cctk)support for newly added bios tokensDCC 3.0(cctk)support for newly added bios tokens
DCC 3.0(cctk)support for newly added bios tokens
 
Important cisco-chow-commands
Important cisco-chow-commandsImportant cisco-chow-commands
Important cisco-chow-commands
 
PROYECTO VLANS
PROYECTO VLANSPROYECTO VLANS
PROYECTO VLANS
 
09 - ROP countermeasures, can we fix this?
09 - ROP countermeasures, can we fix this?09 - ROP countermeasures, can we fix this?
09 - ROP countermeasures, can we fix this?
 
Arm architecture
Arm architectureArm architecture
Arm architecture
 
8051
80518051
8051
 
Nxll22 role based cli
Nxll22 role based cliNxll22 role based cli
Nxll22 role based cli
 
Nortel manual
Nortel manual Nortel manual
Nortel manual
 

Recently uploaded

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 

Recently uploaded (20)

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024AXA XL - Insurer Innovation Award Americas 2024
AXA XL - Insurer Innovation Award Americas 2024
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
A Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source MilvusA Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source Milvus
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu SubbuApidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
 

ttl expired acl

  • 1. Dear Jonathan, As per our recent conversation o the fone, find below the huawei ACL command which deny all Ip that TTL is under 16. For any support, feel free to contact me step1. delete the default flow-template and apply a new one on the slot. dis flow-template user-defined #you will see default flow-template applied on every slot. undo flow-template user-defined slot 4 #delete the default one flow-template user-defined slot 4 ip-protocol tcp-flag sport dport sip 0.0.0.0 dip 0.0.0.0 ttl #define a new one contains ttl. int g4/1/1 flow-template user-defined # apply this template on the interface. step2. define an ACL which has the same function as cisco. # acl name deny-low-ttl advanced rule 1 deny ip ttl 1 rule 2 deny ip ttl 2 rule 3 deny ip ttl 3 rule 4 deny ip ttl 4 rule 5 deny ip ttl 5 rule 6 deny ip ttl 6 rule 7 deny ip ttl 7 rule 8 deny ip ttl 8 rule 9 deny ip ttl 9 rule 10 deny ip ttl 10 rule 11 deny ip ttl 11 rule 12 deny ip ttl 12 rule 13 deny ip ttl 13 rule 14 deny ip ttl 14 rule 15 deny ip ttl 15 rule 16 permit ip
  • 2. step3. apply the ACL on the interface. int g4/1/1 packet-filter inbound ip-group deny-low-ttl PS: deny low ttl will drop the routing protocol multicast packets , you'd better define rules to make sure the routing protocol running normal. I think you can define the rule with dscp or tos.