H3C WA Series WLAN Access Points. ACL and QoS Configuration Guide. Hangzhou H3C Technologies Co., Ltd.

Transcription

1 H3C WA Series WLAN Access Points ACL and QoS Configuration Guide Hangzhou H3C Technologies Co., Ltd. Document Version: 6W

2 Copyright 2010, Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners. Notice The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.

3 Preface The H3C WA documentation set includes 10 configuration guides, which describe the software features for the H3C WA series WLAN access points and guide you through the software configuration procedures. These configuration guides also provide configuration examples to help you apply the software features to different network scenarios. The ACL and QoS Configuration Guide describes ACL and QoS configurations. This preface includes: Audience Conventions About the H3C WA Documentation Set Obtaining Documentation Documentation Feedback Audience This documentation is intended for: Network planners Field technical support and servicing engineers Network administrators working with the WA series Conventions This section describes the conventions used in this documentation set. Command conventions Convention Boldface italic [ ] { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Description Bold text represents commands and keywords that you enter literally as shown. Italic text represents arguments that you replace with actual values. Square brackets enclose syntax choices (keywords or arguments) that are optional. Braces enclose a set of required syntax choices separated by vertical bars, from which you select one. Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none. Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one. Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you may select multiple choices or none. The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.

4 Convention Description # A line that starts with a pound (#) sign is comments. GUI conventions Boldface > Convention Description Window names, button names, field names, and menu items are in Boldface. For example, the New User window appears; click OK. Multi-level menus are separated by angle brackets. For example, File > Create > Folder. Symbols Convention Description Means reader be extremely careful. Improper operation may cause bodily injury. Means reader be careful. Improper operation may cause data loss or damage to equipment. Means an action or information that needs special attention to ensure successful configuration or good performance. Means a complementary description. Means techniques helpful for you to make configuration with ease. About the H3C WA Documentation Set The H3C WA documentation set includes: Category Documents Purposes Product description and specifications Hardware specifications and installation Software configuration Marketing brochures Technology white papers Compliance and safety manual Quick start Installation guide Getting started guide Configuration guides Command references Describe product specifications and benefits. Provide an in-depth description of software features and technologies. Provides regulatory information and the safety instructions that must be followed during installation. Guides you through initial installation and setup procedures to help you quickly set up and use your AP with the minimum configuration. Guides you through hardware specifications and installation methods to help you install your AP. Guides you through the main functions of your AP, and describes how to install and log in to your AP, perform basic configurations, maintain software, and troubleshoot your AP. Describe software features and configuration procedures. Provide a quick reference to all available commands.

5 Category Documents Purposes Operations and maintenance User FAQ Release notes Provides answers to some of the most frequently asked questions on how to troubleshoot your AP. Provide information about the product release, including the version history, hardware and software compatibility matrix, version upgrade information, technical support information, and software upgrading. Obtaining Documentation You can access the most up-to-date H3C product documentation on the World Wide Web at Click the links on the top navigation bar to obtain different categories of product documentation: [Technical Support & Documents > Technical Documents] Provides hardware installation, software upgrading, getting started, and software feature configuration and maintenance documentation. [Products & Solutions] Provides information about products and technologies, as well as solutions. [Technical Support & Documents > Software Download] Provides the documentation released with the software version. Documentation Feedback You can your comments about product documentation to We appreciate your comments.

6 Table of Contents 1 Applicable Models and Software Versions Feature Matrix Command/Parameter Matrix ACL Configuration 4-1 ACL Overview 4-1 ACL Categories 4-2 ACL Numbering and Naming 4-2 Match Order 4-2 ACL Rule Numbering 4-4 Implementing Time-Based ACL Rules 4-4 IPv4 Fragments Filtering with ACLs 4-4 ACL Configuration Task List 4-4 Configuring an ACL 4-5 Creating a Time Range 4-5 Configuring a WLAN ACL 4-5 Configuring a Basic ACL 4-6 Configuring an Advanced ACL 4-7 Configuring an Ethernet Frame Header ACL 4-9 Copying an ACL 4-10 Displaying and Maintaining ACLs 4-10 ACL Configuration Examples 4-10 IPv4 ACL Configuration Example 4-10 IPv6 ACL Configuration Example QoS Overview 5-1 Introduction to QoS 5-1 Introduction to QoS Service Models 5-1 Best-Effort Service Model 5-1 IntServ Service Model 5-2 DiffServ Service Model 5-2 QoS Techniques Overview 5-2 Applying QoS Techniques in a Network 5-3 QoS Processing Flow in an AP QoS Policy Configuration 6-1 QoS Configuration Approach Overview 6-1 Non-Policy Approach 6-1 Policy Approach 6-1 Configuring a QoS Policy 6-1 Defining a Class 6-2 Defining a Traffic Behavior 6-2 i

7 Defining a QoS Policy and Applying the QoS Policy to an Interface 6-3 Displaying and Maintaining QoS Policies Priority Mapping Configuration 7-1 Introduction to Packet Precedences 7-1 IP Precedence and DSCP Values p Priority e Priority 7-3 Priority Mapping Overview 7-3 Introduction to Priority Mapping 7-3 Introduction to Priority Mapping Tables 7-4 Priority Mapping Configuration Task List 7-5 Configuring Priority Mapping 7-6 Configuring a Priority Mapping Table 7-6 Configuring a Port to Trust Packet Priority for Priority Mapping 7-6 Changing the Port Priority of an Interface 7-7 Displaying and Maintaining Priority Mapping 7-7 Priority Mapping Configuration Example Index 8-1 ii

8 The models listed in this document are not applicable to all regions. Please consult your local sales office for the models applicable to your region. Read this chapter before using an H3C WA series WLAN access point. 1 Applicable Models and Software Versions H3C WA series WLAN access points include the WA2200 series and WA2600 series. Table 1-1 shows the applicable models and software versions. Table 1-1 Applicable models and software versions Series Model Software version WA2200 series WA2200 series access points (indoors) WA2200 series access points (outdoors) WA2210-AG WA2220-AG WA2210X-G WA2220X-AG R 1115 WA2600 series WA2600 series access points (indoors) WA2610-AGN WA2612-AGN WA2620-AGN R 1106 WA2600 series access points (enhanced) WA2610E-AGN WA2620E-AGN R

9 2 Feature Matrix Support of the H3C WA series WLAN access points for features, commands and parameters may vary by device model. See this document for more information. For information about feature support, see Table 2-1. For information about command and parameter support, see Table 3-1. The term AP in this document refers to common APs, wireless bridges, or mesh APs. Table 2-1 Feature matrix Document Feature WA2200 series WA2600 series Fundamentals Configuration Guide WLAN Configuration Guide Layer 2 LAN Switching Configuration Guide Layer 3 IP Services Configuration Guide IP Multicast Configuration Guide Security Configuration Guide HTTPS Not supported Supported n radio mode Not supported Supported n bandwidth mode Not supported Supported n rate configuration Not supported Supported Optical Ethernet interface Supported on WA2210X-G/WA2220X- AG only Not supported GE interface Not supported Supported DHCP server configuration Not supported Supported DHCPv6 configuration Not supported Supported IGMP snooping configuration Not supported Supported MLD snooping configuration Not supported Supported SSH2.0 Not supported Supported 2-1

10 3 Command/Parameter Matrix Table 3-1 Command/Parameter matrix Document Module Command/Parameter WA2200 series WA2600 series display ip https Not supported Supported Fundamentals Command Reference HTTP commands ip https acl Not supported Supported ip https certificate access-control-policy Not supported Supported ip https enable Not supported Supported a-mpdu enable Not supported Supported a-msdu enable Not supported Supported channel band-width Not supported Supported client dot11n-only Not supported Supported WLAN service commands preamble { long short } Only APs that support the b/g radio mode support this command. Only APs that support the b/g radio mode support this command. WLAN Command Reference radio-type Keywords dot11an and dot11gn not supported Supported short-gi enable Not supported Supported dot11a { disabled-rate mandatory-rate supported-rate } rate-value Only APs that support a radio mode support this command. Only APs that support a radio mode support this command. WLAN RRM commands dot11n mandatory maximum-mcs dot11n support maximum-mcs Not supported Not supported Supported Supported power-constraint power-constraint Only APs that support the a radio mode support this command. Only APs that support the a radio mode support this command. 3-1

11 Document Module Command/Parameter WA2200 series WA2600 series The maximum number of broadcast packets that can be forwarded on an Ethernet interface per second broadcast-suppression { ratio pps max-pps } pps max-pps ranges from 1 to pps max-pps ranges from 1 to Layer 2 LAN Switching Command Reference The maximum number of multicast packets allowed on an Ethernet interface per second multicast-suppression { ratio pps max-pps } pps max-pps ranges from 1 to pps max-pps ranges from 1 to The maximum number of unknown unicast packets allowed on an Ethernet interface per second unicast-suppression { ratio pps max-pps } pps max-pps ranges from 1 to pps max-pps ranges from 1 to DHCP commands DHCP server configuration commands Not supported Supported display ipv6 dhcp client [ interface interface-type interface-number ] Not supported Supported Layer 3 - IP Services Command Reference DHCPv6 commands display ipv6 dhcp client statistics [ interface interface-type interface-number ] Not supported Supported display ipv6 dhcp duid Not supported Supported reset ipv6 dhcp client statistics [ interface interface-type interface-number ] Not supported Supported 3-2

12 The models listed in this document are not applicable to all regions. Please consult your local sales office for the models applicable to your region. Support of the H3C WA series WLAN access points (APs) for features may vary by AP model. For more information, see Feature Matrix. The interface types and the number of interfaces vary by AP model. The term AP in this document refers to common APs, wireless bridges, and mesh APs. 4 ACL Configuration This chapter includes these sections: ACL Overview ACL Configuration Task List Configuring an ACL Creating a Time Range Configuring a WLAN ACL Configuring a Basic ACL Configuring an Advanced ACL Configuring an Ethernet Frame Header ACL Copying an ACL Displaying and Maintaining ACLs ACL Configuration Examples Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document. ACL Overview An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based on criteria such as source IP address, destination IP address, and port number. ACLs are essentially used for packet filtering. A packet filter drops packets that match a deny rule and permits packets that match a permit rule. ACLs are also widely used by many modules, for example, QoS and IP routing, for traffic identification. This section covers these topics: 4-1

13 ACL Categories ACL Numbering and Naming Match Order ACL Rule Numbering Implementing Time-Based ACL Rules IPv4 Fragments Filtering with ACLs ACL Categories ACLs fall into four categories, as shown in Table 4-1. Table 4-1 ACL categories Category ACL number IP version Match criteria WLAN ACLs 100 to 199 IPv4 Wireless client SSID Basic ACLs 2000 to 2999 Advanced ACLs 3000 to 3999 IPv4 IPv6 IPv4 IPv6 Source IPv4 address Source IPv6 address Source/destination IPv4 address, protocols over IPv4, and other Layer 3 and Layer 4 header fields Source/destination IPv6 address, protocols over IPv6, and other Layer 3 and Layer 4 header fields Ethernet frame header ACLs 4000 to 4999 IPv4 Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority, and link layer protocol type ACL Numbering and Naming Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a number for identification, and in addition, you can also assign the ACL a name for the ease of identification. After creating an ACL with a name, you can neither rename it nor delete its name. You cannot assign a name for a WLAN ACL. For a WLAN and Ethernet frame header, the ACL number and name must be globally unique. For an IPv4 basic or advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and for an IPv6 basic or advanced ACL, among all IPv6 ACLs. You can assign an IPv4 ACL the same number and name as an IPv6 ACL. Match Order The rules in an ACL are sorted in certain order. When a packet matches a rule, the device stops the match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the matching result and action to take depend on the rule order. Two ACL match orders are available: config Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule with a higher ID. If you use this approach, check rule content and order carefully. 4-2

14 auto Sorts ACL rules in depth-first order. Depth-first ordering ensures that any subset of a rule is always matched before the rule. Table 4-2 lists the sequence of tie breakers that depth-first ordering uses to sort rules for each type of ACL. The match order of WLAN ACLs can only be config. Table 4-2 Sort ACL rules in depth-first order ACL category IPv4 basic ACL IPv4 advanced ACL IPv6 basic ACL IPv6 advanced ACL Ethernet frame header ACL Sequence of tie breaker 1) VPN instance 2) More 0s in the source IP address wildcard (more 0s means a narrower IP address range) 3) Smaller rule ID 1) VPN instance 2) Specific protocol type rather than IP (IP represents any protocol over IP) 3) More 0s in the source IP address wildcard mask 4) More 0s in the destination IP address wildcard 5) Narrower TCP/UDP service port number range 6) Smaller ID 1) Longer prefix for the source IP address (a longer prefix means a narrower IP address range) 2) Smaller ID 1) Specific protocol type rather than IP (IP represents any protocol over IPv6) 2) Longer prefix for the source IPv6 address 3) Longer prefix for the destination IPv6 address 4) Narrower TCP/UDP service port number range 5) Smaller ID 1) More 1s in the source MAC address mask (more 1s means a smaller MAC address) 2) More 1s in the destination MAC address mask 3) Smaller ID The AP does not support ACL rules with the VPN instance attribute. A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent 'do care' bits, while the 1 bits represent 'don t care bits'. If the 'do care' bits in an IP address identical to the 'do care' bits in an IP address criterion, the IP address matches the criterion. All 'don t care' bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, is a valid wildcard mask. 4-3

15 ACL Rule Numbering What is the ACL rule numbering step If you do not assign an ID for the rule you are creating, the system automatically assigns it a rule ID. The rule numbering step sets the increment by which the system automatically numbers rules. For example, the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert between two rules. By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are matched in ascending order of rule ID. Automatic rule numbering and re-numbering The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the current highest rule ID, starting with 0. For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10, and 12, the newly defined rule will be numbered 15. If the ACL does not contain any rule, the first rule will be numbered 0. Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4, 6 and 8. Implementing Time-Based ACL Rules You can implement ACL rules based on the time of day by applying a time range to them. A time-based ACL rule takes effect only in any time periods specified by the time range. Two basic types of time range are available: Periodic time range, which recurs periodically on a day or days of the week. Absolute time range, which represents only a period of time and does not recur. You may apply a time range to ACL rules before or after you create it. However, the rules using the time range can take effect only after you define the time range. IPv4 Fragments Filtering with ACLs Traditional packet filtering matches only first fragments of IPv4 packets, and allows all subsequent non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks. To avoids the risks, the H3C ACL implementation: Filters all fragments by default, including non-first fragments. Provides standard and exact match modes for matching ACLs that contain advanced attributes such as TCP/UDP port number and ICMP type. Standard match is the default mode. It considers only Layer 3 attributes. Exact match considers all header attributes defined in IPv4 ACL rules. ACL Configuration Task List IPv4 configuration task list Complete the following tasks to configure an IPv4 ACL: 4-4

16 Task Remarks Creating a Time Range Configuring a WLAN ACL Configuring an IPv4 basic ACL Configuring an IPv4 advanced ACL Configure at least one task. Configuring an Ethernet Frame Header ACL Copying an IPv4 ACL IPv6 ACL configuration task list Complete the following tasks to configure an IPv6 ACL: Task Remarks Creating a Time Range Configuring an IPv6 basic ACL Configuring an IPv6 Advanced ACL Copying an IPv6 ACL Configure at least one task. Configuring an ACL Creating a Time Range Follow these steps to create a time range: To do Use the command Remarks Enter system view system-view Create a time range time-range time-range-name { start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] from time1 date1 [ to time2 date2 ] to time2 date2 } By default, no time range exists. You may create time ranges identified with the same name. They are regarded as one time range whose active period is the result of ORing periodic ones, ORing absolute ones, and ANDing periodic and absolute ones. You may create a maximum of 256 uniquely named time ranges, each with 32 periodic time ranges at most and 12 absolute time ranges at most. Configuring a WLAN ACL WLAN ACLs match packets based on SSIDs of wireless clients. Follow these steps to configure a WLAN ACL: To do Use the command Remarks Enter system view system-view 4-5

17 To do Use the command Remarks Create a WLAN ACL and enter its view Configure a description for the WLAN ACL Set the rule numbering step Create or edit a rule Configure or edit a rule description acl number acl-number description text step step-value rule [ rule-id ] { permit deny } [ ssid ssid-name ] rule rule-id comment text By default, no ACL exists. WLAN ACLs are numbered in the range 100 to 199. By default, a WLAN ACL has no ACL description. 5 by default. By default, a WLAN ACL does not contain any rule. To create or edit multiple rules, repeat this step. By default, a WLAN ACL rule has no description. Configuring a Basic ACL Configuring an IPv4 basic ACL IPv4 basic ACLs match packets based on only source IP address. Follow these steps to configure an IPv4 basic ACL: To do Use the command Remarks Enter system view system-view Create an IPv4 basic ACL and enter its view Configure a description for the IPv4 basic ACL Set the rule numbering step Create or edit a rule Configure or edit a rule description acl number acl-number [ name acl-name ] [ match-order { auto config } ] description text step step-value rule [ rule-id ] { deny permit } [ fragment logging source { sour-addr sour-wildcard any } time-range time-range-name ] * rule rule-id comment text By default, no ACL exists. IPv4 basic ACLs are numbered in the range 2000 to You can use the acl name acl-name command to enter the view of an existing named IPv4 ACL. By default, an IPv4 basic ACL has no ACL description. 5 by default. By default, an IPv4 basic ACL does not contain any rule. To create or edit multiple rules, repeat this step. The logging keyword takes effect only when the module that uses the ACL supports logging. By default, an IPv4 ACL rule has no rule description. Configuring an IPv6 basic ACL Follow these steps to configure an IPv6 basic ACL: 4-6

18 To do Use the command Remarks Enter system view system-view Create an IPv6 basic ACL view and enter its view Configure a description for the IPv6 basic ACL Set the rule numbering step Create or edit a rule Configure or edit a rule description acl ipv6 number acl6-number [ name acl6-name ] [ match-order { auto config } ] description text step step-value rule [ rule-id ] { deny permit } [ fragment logging source { ipv6-address prefix-length ipv6-address/prefix-length any } time-range time-range-name ] * rule rule-id comment text By default, no ACL exists. IPv6 basic ACLs are numbered in the range 2000 to You can use the acl ipv6 name acl6-name command to enter the view of an existing named IPv6 ACL. By default, an IPv6 basic ACL has no ACL description. 5 by default By default, an IPv6 basic ACL does not contain any rule. To create or edit multiple rules, repeat this step. The logging keyword takes effect only when the module using the ACL supports logging. By default, an IPv6 basic ACL rule has no rule description. Configuring an Advanced ACL Configuring an IPv4 advanced ACL IPv4 advanced ACLs match packets based on source and destination IP addresses, protocols over IP, and other protocol header information, such as TCP/UDP source and destination port numbers, TCP flags, ICMP message types, and ICMP message codes. IPv4 advanced ACLs also allow you to filter packets based on three priority criteria: type of service (ToS), IP precedence, and differentiated services codepoint (DSCP) priority. Compared with IPv4 basic ACLs, IPv4 advanced ACLs allow of more flexible and accurate filtering. Follow these steps to configure an IPv4 advanced ACL: To do Use the command Remarks Enter system view system-view Create an IPv4 advanced ACL and enter its view Configure a description for the IPv4 advanced ACL acl number acl-number [ name acl-name ] [ match-order { auto config } ] description text By default, no ACL exists. IPv4 advanced ACLs are numbered in the range 3000 to You can use the acl name acl-name command to enter the view of an existing named IPv4 ACL. By default, an IPv4 advanced ACL has no ACL description. 4-7

19 To do Use the command Remarks Set the rule numbering step Create or edit a rule Configure or edit a rule description step step-value rule [ rule-id ] { deny permit } protocol [ { { ack ack-value fin fin-value psh psh-value rst rst-value syn syn-value urg urg-value } * established } destination { dest-addr dest-wildcard any } destination-port operator port1 [ port2 ] dscp dscp fragment icmp-type { icmp-type icmp-code icmp-message } logging precedence precedence reflective source { sour-addr sour-wildcard any } source-port operator port1 [ port2 ] time-range time-range-name tos tos ] * rule rule-id comment text 5 by default. By default, an IPv4 advanced ACL does not contain any rule. To create or edit multiple rules, repeat this step. The logging keyword takes effect only when the module using the ACL supports logging. By default, an IPv4 advanced ACL rule has no rule description. Configuring an IPv6 Advanced ACL IPv6 advanced ACLs match packets based on the source IPv6 address, destination IPv6 address, protocol carried over IPv6, and other protocol header fields such as the TCP/UDP source port number, TCP/UDP destination port number, ICMP message type, and ICMP message code. Compared with IPv6 basic ACLs, they allow of more flexible and accurate filtering. Follow these steps to configure an IPv6 advanced ACL: To do Use the command Remarks Enter system view system-view Create an IPv6 advanced ACL and enter its view Configure a description for the IPv6 advanced ACL Set the rule numbering step acl ipv6 number acl6-number [ name acl6-name ] [ match-order { auto config } ] description text step step-value By default, no ACL exists. IPv6 advanced ACLs are numbered in the range 3000 to You can use the acl ipv6 name acl6-name command to enter the view of an existing named IPv6 ACL. By default, an IPv6 advanced ACL has no ACL description. 5 by default. 4-8

20 To do Use the command Remarks Create or edit a rule Configure or edit a rule description rule [ rule-id ] { deny permit } protocol [ { { ack ack-value fin fin-value psh psh-value rst rst-value syn syn-value urg urg-value } * established } destination { dest dest-prefix dest/dest-prefix any } destination-port operator port1 [ port2 ] dscp dscp fragment icmp6-type { icmp6-type icmp6-code icmp6-message } logging source { source source-prefix source/source-prefix any } source-port operator port1 [ port2 ] time-range time-range-name ] * rule rule-id comment text By default IPv6 advanced ACL does not contain any rule. To create or edit multiple rules, repeat this step. The logging keyword takes effect only when the module using the ACL supports logging. By default, an IPv6 advanced ACL rule has no rule description. Configuring an Ethernet Frame Header ACL Ethernet frame header ACLs, also called Layer 2 ACLs, match packets based on Layer 2 protocol header fields such as source MAC address, destination MAC address, 802.1p priority (VLAN priority), and link layer protocol type. Follow these steps to configure an Ethernet frame header ACL: To do Use the command Remarks Enter system view system-view Create an Ethernet frame header ACL and enter its view Configure a description for the Ethernet frame header ACL Set the rule numbering step Create or edit a rule Configure or edit a rule description acl number acl-number [ name acl-name ] [ match-order { auto config } ] description text step step-value rule [ rule-id ] { deny permit } [ cos vlan-pri dest-mac dest-addr dest-mask { lsap lsap-type lsap-type-mask type protocol-type protocol-type-mask } source-mac sour-addr source-mask time-range time-range-name ] * rule rule-id comment text By default, no ACL exists. Ethernet frame header ACLs are numbered in the range 4000 to You can use the acl name acl-name command to enter the view of an existing named Ethernet frame header ACL. By default, an Ethernet frame header ACL has no ACL description. 5 by default. By default, an Ethernet frame header ACL does not contain any rule. To create or edit multiple rules, repeat this step. By default, an Ethernet frame header ACL rule has no rule description. 4-9

21 Copying an ACL You can create an ACL by copying an existing ACL. The new ACL has the same properties and content as the source ACL except the ACL number and name. To successfully copy an ACL, ensure that: The destination ACL number is from the same category as the source ACL number. The source ACL already exists but the destination ACL does not. Copying an IPv4 ACL Follow these steps to copy an IPv4 ACL: To do Use the command Remarks Enter system view system-view Copy an existing IPv4 ACL to create a new IPv4 ACL acl copy { source-acl-number name source-acl-name } to { dest-acl-number name dest-acl-name } The name keyword is not available for WLAN ACLs Copying an IPv6 ACL Follow these steps to copy an IPv6 ACL: To do Use the command Remarks Enter system view system-view Copy an existing IPv6 ACL to generate a new one of the same category acl ipv6 copy { source-acl6-number name source-acl6-name } to { dest-acl6-number name dest-acl6-name } Displaying and Maintaining ACLs To do... Use the command Remarks Display configuration and match statistics for one or all IPv4 ACLs Display configuration and match statistics for one or all IPv6 ACLs Display the configuration and status of one or all time ranges Clear statistics for one or all IPv4 ACLs Clear statistics for one or all IPv6 basic and advanced ACLs display acl { acl-number all name acl-name } display acl ipv6 { acl6-number all name acl6-name } display time-range { time-range-name all } reset acl counter { acl-number all name acl-name } reset acl ipv6 counter { acl6-number all name acl6-name } Available in any view Available in any view Available in any view Available in user view Available in user view ACL Configuration Examples IPv4 ACL Configuration Example Network Requirements A company interconnects its departments through the wireless AP. Configure an ACL to: 4-10

22 Permits access from the President s office at any time to the salary server of the Financial department. Deny access from any other department to the salary server during working hours (from 8:00 to 18:00) on working days. Figure 4-1 Network diagram for ACL configuration Configuration Procedure 1) Create a time range for office hours # Create a periodic time range from 8:00 to 18:00 in working days. <AP> system-view [AP] time-range trname 8:00 to 18:00 working-day 2) Define an ACL to control access to the salary server # Create an advanced IPv4 ACL numbered 3000 and enter its view. [AP] acl number 3000 # Create a rule to allow access from the President s office to the salary server. [AP-acl-adv-3000] rule 1 permit ip source destination [AP-acl-adv-3000] quit # Create an advanced IPv4 ACL numbered 3001 and enter its view. [AP] acl number 3001 # Create a rule to deny access from any other department to the salary server during working hours. [AP-acl-adv-3001] rule 1 deny ip source any destination time-range trname [AP-acl-adv-3001] quit 3) Apply the ACLs # Apply IPv4 ACL 3000 and ACL [AP] traffic classifier access1 [AP-classifier-access1] if-match acl 3000 [AP-classifier-access1] quit [AP] traffic behavior access1 [AP-behavior-access1] filter permit [AP] traffic classifier access2 [AP-classifier-access2] if-match acl 3001 [AP-classifier-access2] quit [AP] traffic behavior access2 4-11

23 [AP-behavior-access2] filter deny [AP-behavior-access2] qos policy access [AP-qospolicy-access] classifier access1 behavior access1 [AP-qospolicy-access] classifier access2 behavior access2 [AP-qospolicy-access] interface wlan-bss1 [AP-WLAN-BSS1] qos apply policy access inbound IPv6 ACL Configuration Example Network Requirements Perform packet filtering in the inbound direction of interface WLAN-BSS 1 to deny all IPv6 packets but those with source addresses in the range 4050::9000 to 4050::90FF. Configuration Procedure 1) Create an ACL that is to be applied to interface WLAN-BSS 1. # Create a basic IPv6 ACL numbered 2000, and enter its view. <AP> system-view [AP] acl ipv6 number 2000 # Create a rule to allow access from IPv6 address 4050::9000 to 4050::90FF. [AP-acl6-basic-2000] rule 1 permit source 4050::9000/120 [AP-acl6-basic-2000] quit # Create a basic IPv6 ACL numbered 2001, and enter its view. [AP] acl ipv6 number 2001 # Create a rule to deny access from other IPv6 addresses. [AP-acl6-basic-2001] rule 1 deny source any [AP-acl6-basic-2001] quit 2) Apply the ACLs # Apply ACL 2000 and ACL [AP] traffic classifier access1 [AP-classifier-access1] if-match acl ipv [AP-classifier-access1] quit [AP] traffic behavior access1 [AP-behavior-access1] filter permit [AP] traffic classifier access2 [AP-classifier-access2] if-match acl ipv [AP-classifier-access2] quit [AP] traffic behavior access2 [AP-behavior-access2] filter deny [AP-behavior-access2] qos policy access [AP-qospolicy-access] classifier access1 behavior access1 [AP-qospolicy-access] classifier access2 behavior access2 [AP-qospolicy-access] interface wlan-bss1 [AP-WLAN-BSS1] qos apply policy access inbound 4-12

24 The models listed in this document are not applicable to all regions. Please consult your local sales office for the models applicable to your region. Support of the H3C WA series WLAN access points (APs) for features may vary by AP model. For more information, see Feature Matrix. The interface types and the number of interfaces vary by AP model. The term AP in this document refers to common APs, wireless bridges, and mesh APs. 5 QoS Overview This chapter includes these sections: Introduction to QoS Introduction to QoS Service Models QoS Techniques Overview Introduction to QoS In data communications, Quality of Service (QoS) is the ability of a network to provide differentiated service guarantees for diversified traffic in terms of bandwidth, delay, jitter, and drop rate. Network resources are always scarce. The contention for resources demands that QoS prioritize important traffic flows over trivial traffic flows. When making a QoS scheme, a network administrator must consider the characteristics of various applications to balance the interests of diversified users and fully utilize network resources. The subsequent section describes some typical QoS service models and widely-used mature QoS techniques. By appropriately using these techniques, you can improve QoS effectively. Introduction to QoS Service Models This section covers three typical QoS service models: Best-Effort Service Model IntServ Service Model DiffServ Service Model Best-Effort Service Model Best effort is a single service model and also the simplest service model. In the best effort service model, the network does its best to deliver packets but does not guarantee delay or reliability. The best-effort service model is the default model in the Internet and applies to most network applications. It uses the first in first out (FIFO) queuing mechanism. 5-1

25 IntServ Service Model The integrated service (IntServ) model is a multiple-service model that can accommodate diverse QoS requirements. It provides the most granularly differentiated QoS by identifying and guaranteeing definite QoS for each data flow. In the IntServ model, an application must request service from the network before it sends data. IntServ signals the service request with the Resource Reservation Protocol (RSVP). All nodes that receive the request reserve resources as requested and maintain state information for the application flow. The IntServ model demands high storage and processing capabilities, because it requires that all nodes along the transmission path maintain resource state information for each flow. The model is suitable for small-sized or edge networks, but not large-sized networks, for example, the core layer of the Internet, where billions of flows are present. For more information about RSVP, see MPLS TE in the MPLS Configuration Guide. DiffServ Service Model The differentiated service (DiffServ) model is a multiple-service model that can satisfy diverse QoS requirements. Unlike IntServ, DiffServ does not require an application to signal the network to reserve resources before sending data. DiffServ is easy to implement and extend. All QoS techniques in this document are based on the Diff-Serv model. QoS Techniques Overview The QoS techniques fall into traffic classification, traffic policing, traffic shaping, line rate, congestion management, and congestion avoidance. The following part briefly introduces these QoS techniques. 5-2

26 Applying QoS Techniques in a Network Figure 5-1 Positions of the QoS techniques in a network As shown in Figure 5-1, traffic classification, traffic shaping, traffic policing, congestion management, and congestion avoidance mainly implement the following functions: Traffic classification uses certain match criteria to assign packets with the same characteristics to a class. Based on classes, you can provide differentiated services. Traffic policing polices flows entering or leaving an AP, and imposes penalties on traffic flows that exceed the pre-set threshold to prevent aggressive use of network resources. You can apply traffic policing to both incoming and outgoing traffic of a port. Traffic shaping proactively adapts the output rate of traffic to the network resources available on the downstream AP to eliminate packet drops. Traffic shaping usually applies to the outgoing traffic of a port. Congestion management provides a resource scheduling policy to determine the packet forwarding sequence when congestion occurs. Congestion management usually applies to the outgoing traffic of a port. Congestion avoidance monitors the network resource usage and is usually applied to the outgoing traffic of a port. When congestion worsens, congestion avoidance actively reduces the queue length by dropping packets. 5-3

27 QoS Processing Flow in an AP Figure 5-2 QoS processing flow... Figure 5-2 briefly describes how the QoS module processes traffic: 1) Traffic classifier identifies and classifies traffic for subsequent QoS actions. 2) The QoS module takes various QoS actions on classified traffic as configured, depending on the traffic processing phase and network status. For example, you may configure the QoS module to perform traffic policing for incoming traffic, traffic shaping for outgoing traffic, congestion avoidance before congestion occurs, and congestion management when congestion occurs. 5-4

28 6 QoS Policy Configuration This chapter includes these sections: QoS Configuration Approach Overview Configuring a QoS Policy Displaying and Maintaining QoS Policies QoS Configuration Approach Overview Two approaches are available for configuring QoS: Non-Policy Approach and Policy Approach. Some features support both approaches, but some support only one. Non-Policy Approach In non-policy approach, you configure QoS service parameters directly without using a QoS policy. For example, you can use the line rate feature to set a rate limit on an interface without using a QoS policy. Policy Approach In policy approach, you configure QoS service parameters by using QoS policies. A QoS policy defines the shaping, policing, or other QoS actions to take on different classes of traffic. It is a set of class-behavior associations. A class is a set of match criteria for identifying traffic. It uses the AND or OR operator: If the operator is AND, a packet must match all the criteria to match the class. If the operator is OR, a packet matches the class if it matches any of the criteria in the class. A traffic behavior defines a set of QoS actions to take on packets, such as priority marking and redirect. By associating a traffic behavior with a class in a QoS policy, you apply the specific set of QoS actions to the class of traffic. Configuring a QoS Policy Figure 6-1 shows how to configure a QoS policy. 6-1

29 Figure 6-1 QoS policy configuration procedure Define a class Define a traffic behavior Define a policy Apply the policy to an interface Defining a Class To define a class, specify its name and then configure the match criteria in class view. Follow these steps to define a class: To do... Use the command... Remarks Enter system view system-view Create a class and enter class view Configure match criteria traffic classifier tcl-name [ operator { and or } ] if-match match-criteria By default, the operator of a class is AND. The operator of a class can be AND or OR. AND: A packet is considered belonging to a class only when the packet matches all the criteria in the class. OR: A packet is considered belonging to a class if it matches any of the criteria in the class. For more information, see the if-match command in QoS in the ACL and QoS Command Reference. Defining a Traffic Behavior A traffic behavior is a set of QoS actions (such as traffic filtering, traffic policing, and priority mapping) to take on a class of traffic. To define a traffic behavior, first create it and then configure QoS actions (such as priority mapping and traffic policing) in traffic behavior view. Follow these steps to define a traffic behavior: To do... Use the command... Remarks Enter system view system-view Create a traffic behavior and enter traffic behavior view Configure a CAR action traffic behavior behavior-name car cir committed-information-rate [ cbs committed-burst-size [ ebs excess-burst-size ] ] [ pir peak-information-rate ] [ red action ] 6-2

30 To do... Use the command... Remarks Drop or send packets filter { deny permit } To drop matching packets, select the deny keyword. To permit matching packets to pass through, select the permit keyword. Set the local precedence for packets Set the 802.1p priority for packets Display traffic behavior configuration information remark local-precedence local-precedence remark dot1p 8021p display traffic behavior user-defined [ behavior-name ] Available in any view Defining a QoS Policy and Applying the QoS Policy to an Interface A policy applied to an interface takes effect on the traffic sent or received by the interface. A policy can be applied to multiple interfaces, but only one policy can be applied in one direction (inbound or outbound) of an interface. Follow these steps to apply the QoS policy to an interface: To do... Use the command... Remarks Enter system view system-view Define a QoS policy and enter QoS policy view Associate a class with a behavior in the QoS policy Enter interface view Apply the policy to the interface qos policy policy-name classifier tcl-name behavior behavior-name interface interface-type interface-number qos apply policy policy-name { inbound outbound } Repeat this step to create more class-behavior associations. The QoS policy applied to the outgoing traffic of an interface does not regulate local packets. Local packets refer to the critical protocol packets sent by the local system for maintaining the normal operation of the AP. To avoid drop of local packets, QoS does not process them. Commonly used local packets are link maintenance packets and so on. Displaying and Maintaining QoS Policies To do... Use the command... Remarks Display traffic class information display traffic classifier user-defined [ tcl-name ] Available in any view 6-3

31 To do... Use the command... Remarks Display traffic behavior configuration information Display the configuration of one or all classes in one or all QoS policies and the associated behaviors of the classes Display QoS policy configuration on the specified or all interfaces display traffic behavior user-defined [ behavior-name ] display qos policy user-defined [ policy-name [ classifier tcl-name ] ] display qos policy interface [ interface-type interface-number ] [ inbound outbound ] Available in any view Available in any view Available in any view 6-4

32 7 Priority Mapping Configuration This chapter includes these sections: Introduction to Packet Precedences Priority Mapping Overview Priority Mapping Configuration Task List Configuring Priority Mapping Displaying and Maintaining Priority Mapping Priority Mapping Configuration Example Introduction to Packet Precedences IP Precedence and DSCP Values Figure 7-1 ToS and DS fields As shown in Figure 7-1, the ToS field of the IP header contains eight bits, and the first three bits (0 to 2) represent IP precedence from 0 to 7. According to RFC 2474, the ToS field of the IP header is redefined as the differentiated services (DS) field, where a DSCP value is represented by the first six bits (0 to 5) and is in the range 0 to 63. The remaining two bits (6 and 7) are reserved. Table 7-1 Description on IP precedence IP precedence (decimal) IP precedence (binary) Description Routine priority immediate flash flash-override critical internet network 7-1

33 Table 7-2 Description on DSCP values DSCP value (decimal) DSCP value (binary) Description ef af af af af af af af af af af af af cs cs cs cs cs cs cs be (default) 802.1p Priority 802.1p priority lies in the Layer 2 header and is applicable to occasions where Layer 3 header analysis is not needed and QoS must be assured at Layer 2. Figure 7-2 An Ethernet frame with an 802.1Q tag header As shown in Figure 7-2, the 4-byte 802.1Q tag header consists of the tag protocol identifier (TPID, two bytes in length), whose value is 0x8100, and the tag control information (TCI, two bytes in length). Figure 7-3 presents the format of the 802.1Q tag header. The Priority field in the 802.1Q tag header is 7-2

34 called the 802.1p priority, because its use is defined in IEEE 802.1p. Table 7-3 presents the values for 802.1p priority. Figure Q tag header Byte 1 Byte 2 Byte 3 Byte 4 TPID (Tag protocol identifier) TCI (Tag control information) CFI Priority VLAN ID Table 7-3 Description on 802.1p priority 802.1p priority (decimal) 802.1p priority (binary) Description best-effort background spare excellent-effort controlled-load video voice network-management e Priority To provide QoS services on WLAN, the e standard was developed. IEEE e is a MAC-layer enhancement to IEEE IEEE e adds a 2-byte QoS Control field to the e MAC frame header. Three bits of the QoS control field represents the e priority, which ranges from 0 to 7. Figure e frame structure Priority Mapping Overview Introduction to Priority Mapping When a packet enters an AP, the AP assigns a set of QoS priority parameters to the packet based on a certain priority field carried in the packet and sometimes may modify its priority, according to certain 7-3

35 rules depending on AP status. This process is called priority mapping. The set of QoS priority parameters decides the scheduling priority and forwarding priority of the packet. Priority mapping is implemented with priority mapping tables and involves priorities such as e priority and 802.1p priority. Introduction to Priority Mapping Tables The AP provides various types of priority mapping table, as listed below. dot11e-lp: e-to-local priority mapping table. dot1p-lp: 802.1p-to-local priority mapping table. dscp-lp: DSCP-to-local priority mapping table, which applies to only IP packets. lp-dot11e: Local-to e priority mapping table. lp-dot1p: Local-to-802.1p priority mapping table. lp-dscp: Local-to-DSCP priority mapping table. Table 7-4 through Table 7-7 list the default priority mapping tables. Table 7-4 The default dot1p-lp mapping 802.1p priority Local precedence Table 7-5 The default dscp-lp mapping DSCP Local precedence 0 to to to to to to to to

36 Table 7-6 The default lp-dot1p and lp-dscp mappings Local precedence 802.1p priority DSCP Table 7-7 The default port priority-local precedence mapping Port priority Local precedence For the default dot11e-lp and lp-dot11e mappings, an input value yields a target value that is equal to it. Priority Mapping Configuration Task List You can configure priority mapping in two approaches: Configuring priority trust mode. In this approach, you can configure a port to look up the priority mapping tables based on a certain priority such as 802.1p carried in incoming packets. If no packet priority is trusted, the port priority of the incoming port is used. Changing port priority. By default, all ports are assigned the port priority of zero. By changing the port priority of a port, you can change the priority of the incoming packets on the port. It is recommended that you plan QoS throughout the network before making QoS configuration. Complete the following task to configure priority mapping: 7-5