H3C S9500E Series Routing Switches

Transcription

1 H3C S9500E Series Routing Switches ACL and QoS Configuration Guide Hangzhou H3C Technologies Co., Ltd. Software version: S9500E-CMW520-R1728 Document version: 6W

2 Copyright 2012, Hangzhou H3C Technologies Co., Ltd. and its licensors All rights reserved Trademarks No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. Notice All other trademarks that may be mentioned in this manual are the property of their respective owners The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.

3 Preface The H3C S9500E documentation set includes 14 configuration guides, which describe the software features for the H3C S9500E Series Routing Switches and guide you through the software configuration procedures. These configuration guides also provide configuration examples to help you apply software features to different network scenarios. The ACL and QoS Configuration Guide describes ACL, QoS, and FR QoS fundamentals and configuration. It describes how to use ACL or other match criteria to classify traffic into multiple classes and implement per-class traffic control. ACL and QoS help you allocate limited network resources reasonably and improve the network usage. This preface includes: Audience Conventions About the H3C S9500E documentation set Obtaining documentation Technical support Documentation feedback Audience This documentation is intended for: Network planners Field technical support and servicing engineers Network administrators working with the S9500E series Conventions This section describes the conventions used in this documentation set. Command conventions Convention Boldface Italic Description Bold text represents commands and keywords that you enter literally as shown. Italic text represents arguments that you replace with actual values. [ ] Square brackets enclose syntax choices (keywords or arguments) that are optional. { x y... } [ x y... ] { x y... } * Braces enclose a set of required syntax choices separated by vertical bars, from which you select one. Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none. Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.

4 Convention [ x y... ] * &<1-n> Description Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none. The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times. # A line that starts with a pound (#) sign is comments. GUI conventions Convention Boldface Description Window names, button names, field names, and menu items are in Boldface. For example, the New User window appears; click OK. > Multi-level menus are separated by angle brackets. For example, File > Create > Folder. Symbols Convention WARNING CAUTION IMPORTANT NOTE TIP Description An alert that calls attention to important information that if not understood or followed can result in personal injury. An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software. An alert that calls attention to essential information. An alert that contains additional or supplementary information. An alert that provides helpful information. Network topology icons Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features. Port numbering in examples The port numbers in this document are for illustration only and might be unavailable on your switch. About the H3C S9500E documentation set The H3C S9500E documentation set includes: Category Documents Purposes Product description and specifications Marketing brochures Technology white papers Describe product specifications and benefits. Provide an in-depth description of software features

5 Category Documents Purposes and technologies. Hardware specifications and installation Software configuration Operations and maintenance Card datasheets Regulatory compliance and safety information Installation guide H3C Pluggable SFP [SFP+][XFP] Transceiver Modules Installation Guide H3C High-End Network Products Hot-Swappable Module Manual Configuration guides Command references System log messages Trap messages MIB Companion Release notes Describe card specifications, features, and standards. Provides regulatory information and the safety instructions that must be followed during installation. Provides a complete guide to hardware installation and hardware specifications. Guides you through installing SFP/SFP+/XFP transceiver modules. Describes the hot-swappable modules available for the H3C high-end network products, their external views, and specifications. Describe software features and configuration procedures. Provide a quick reference to all available commands. Explains the system log messages. Explains the trap messages. Describes the MIBs for the software release. Provide information about the product release, including the version history, hardware and software compatibility matrix, version upgrade information, technical support information, and software upgrading. Obtaining documentation You can access the most up-to-date H3C product documentation on the World Wide Web at Click the links on the top navigation bar to obtain different categories of product documentation: [Technical Support & Documents > Technical Documents] Provides hardware installation, software upgrading, and software feature configuration and maintenance documentation. [Products & Solutions] Provides information about products and technologies, as well as solutions. [Technical Support & Documents > Software Download] Provides the documentation released with the software version. Technical support service@h3c.com

6 Documentation feedback You can your comments about product documentation to We appreciate your comments.

7 Contents Configuring ACL 1 ACL overview 1 ACL categories 1 ACL numbering and naming 1 Match order 2 Rule comments and rule range remarks 3 ACL rule numbering 3 ACL configuration task list 3 Configuring an ACL 4 Configuring a time range 4 Configuring a basic ACL 4 Configuring an advanced ACL 7 Configuring an Ethernet frame header ACL 9 Configuring a user-defined ACL 10 Copying an ACL 12 Configuring a user-defined flow template 12 Configuring packet filtering with ACLs 13 Displaying and maintaining ACLs 16 ACL configuration examples 18 IPv4 ACL configuration example 18 IPv6 ACL configuration example 19 IPv4 packet filtering configuration example 20 Flow template configuration example 21 QoS overview 23 Introduction to QoS 23 QoS service models 23 Best-effort service model 23 IntServ model 23 DiffServ model 24 QoS techniques overview 24 Deploying QoS in a network 24 QoS processing flow in a device 25 QoS configuration approaches 26 QoS configuration approach overview 26 MQC approach 26 Non-MQC approach 26 Configuring a QoS policy 26 Defining a class 27 Defining a traffic behavior 27 Defining a policy 28 Applying the QoS policy 28 Displaying and maintaining QoS policies 31 Configuring priority mapping 33 Priority mapping overview 33 Introduction to priority mapping 33 Introduction to priorities 33 Priority mapping tables 33 i

8 Priority mapping configuration tasks 34 Configuring priority mapping 34 Configuring a priority mapping table 34 Configuring a port to trust packet priority for priority mapping 36 Changing the port priority of an interface 37 Configuring primap 37 Displaying and maintaining priority mapping 39 Priority mapping configuration example 39 Configuring traffic policing and traffic shaping 41 Traffic policing and traffic shaping overview 41 Traffic evaluation and token buckets 41 Traffic policing 42 Traffic shaping 43 Configuring traffic policing 44 Configuring GTS 44 Displaying and maintaining traffic policing and GTS 45 Configuring congestion management 46 Congestion management overview 46 Causes, impacts, and countermeasures of congestion 46 Congestion management policies 46 Congestion management technique comparison 49 Configuring WFQ 51 Configuration procedure 51 WFQ configuration example 52 Configuring CBQ 52 Defining a class 52 Defining a traffic behavior 52 Defining a QoS policy 54 Applying the QoS policy 54 Displaying and maintaining CBQ 55 CBQ configuration example 55 Configuring hardware congestion management 59 Hardware congestion management overview 59 Causes, impacts, and countermeasures 59 Congestion management techniques 59 Hardware congestion management configuration approaches 62 Configuring WFQ queuing 63 Configuring hardware congestion management with queue scheduling profiles 64 Introduction to queue scheduling profile 64 Configuring a queue scheduling profile 65 Displaying and maintaining queue scheduling profiles 65 Queue scheduling profile configuration example 66 Configuring CBQ 67 CBQ configuration task list 67 Defining a class 67 Defining a traffic behavior 67 Defining a QoS policy 69 Applying the QoS policy 69 Displaying and maintaining CBQ 70 CBQ configuration example 70 Configuring congestion avoidance 74 Congestion avoidance overview 74 ii

9 Introduction to WRED configuration 75 WRED configuration approaches 75 Introduction to WRED parameters 75 Configuring WRED on an interface 76 Configuration procedure 76 Configuration example 76 Applying a WRED table on an interface 77 Displaying and maintaining WRED 77 WRED configuration example 78 Configuring traffic filtering 79 Traffic filtering overview 79 Configuring traffic filtering 79 Traffic filtering configuration restrictions 80 Traffic filtering configuration example 80 Configuring protocol packet rate limiting 82 Overview 82 Configuring protocol packet rate limiting 82 Protocol packet rate limiting configuration example 83 Configuring priority marking 85 Priority marking overview 85 Configuring priority marking 85 Priority marking configuration example 86 Configuring traffic redirecting 89 Traffic redirecting overview 89 Configuring traffic redirecting 89 Traffic redirecting configuration example 90 Configuring global CAR 93 Global CAR overview 93 Configuring aggregate CAR 93 Configuring class-based accounting 94 Class-based accounting overview 94 Configuring class-based accounting 94 Displaying and maintaining traffic accounting 94 Class-based accounting configuration example 95 Configuring traffic accounting 97 Traffic accounting overview 97 Configuring traffic accounting 97 Displaying and maintaining traffic accounting 97 Configuring the QoS pipe mode 99 Overview 99 Configuring the QoS pipe mode 99 Appendix 100 Appendix A Acronym 100 Appendix B Default priority mapping tables 101 Introduction to priority mapping tables 101 Introduction to colored priority mapping tables 102 Appendix C Introduction to packet precedences 106 IP precedence and DSCP values p priority 107 iii

10 EXP values 108 Configuring FR QoS 109 Overview 109 Why FRTS 109 How FRTS works 109 Configuring FR QoS 110 FR QoS configuration task list 110 Creating and configuring an FR class 110 Configuring FRTS 111 Displaying and maintaining FR QoS 112 FR QoS configuration example 112 Index 114 iv

11 Configuring ACL NOTE: The switch operates in either IRF or standalone (the default) mode. For more information about the IRF mode, see IRF Configuration Guide. For more information about the subcards mentioned in this document, see the installation guide for the product. Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document. ACL overview An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based on criteria such as source IP address, destination IP address, and port number. ACLs are primarily used for packet filtering. Configuring packet filtering with ACLs provides an example. You can use ACLs in QoS, firewall, routing, and other feature modules for identifying traffic. The packet drop or forwarding decisions varies with the modules that use ACLs. ACL categories Category ACL number IP version Match criteria Basic ACLs 2000 to 2999 Advanced ACLs 3000 to 3999 IPv4 IPv6 IPv4 IPv6 Source IPv4 address Source IPv6 address Source IPv4 address, destination IPv4 address, packet priority, protocols over IPv4, and other Layer 3 and Layer 4 header fields Source IPv6 address, destination IPv6 address, packet priority, protocols over IPv6, and other Layer 3 and Layer 4 header fields Ethernet frame header ACLs 4000 to 4999 IPv4 and IPv6 Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority, and link layer protocol type User-defined ACLs 5000 to 5999 IPv4 and IPv6 User specified matching patterns in protocol headers ACL numbering and naming Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a number. In addition, you can assign the ACL a name for the ease of identification. After creating an ACL with a name, you cannot rename it or delete its name. 1

12 For an Ethernet frame header, or user-defined ACL, the ACL number and name must be globally unique. For an IPv4 basic or advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and for an IPv6 basic or advanced ACL, among all IPv6 ACLs. You can assign an IPv4 ACL the same number and name as an IPv6 ACL. Match order The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the matching result and action to take depend on the rule order. The following ACL match orders are available: config Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule with a higher ID. If you use this approach, carefully check the rule content and order. auto Sorts ACL rules in depth-first order. Depth-first ordering ensures that any subset of a rule is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first ordering uses to sort rules for each type of ACL. NOTE: The match order of user-defined ACLs can only be config. Table 1 Sort ACL rules in depth-first order ACL category IPv4 basic ACL IPv4 advanced ACL IPv6 basic ACL IPv6 advanced ACL Ethernet frame header ACL Sequence of tie breakers 1. VPN instance 2. More 0s in the source IP address wildcard (more 0s means a narrower IP address range) 3. Smaller rule ID 1. VPN instance 2. Specific protocol type rather than IP (IP represents any protocol over IP) 3. More 0s in the source IP address wildcard mask 4. More 0s in the destination IP address wildcard 5. Narrower TCP/UDP service port number range 6. Smaller rule ID 1. Longer prefix for the source IP address (a longer prefix means a narrower IP address range) 2. Smaller rule ID 1. Specific protocol type rather than IP (IP represents any protocol over IPv6) 2. Longer prefix for the source IPv6 address 3. Longer prefix for the destination IPv6 address 4. Narrower TCP/UDP service port number range 5. Smaller rule ID 1. More 1s in the source MAC address mask (more 1s means a smaller MAC address) 2. More 1s in the destination MAC address mask 3. Smaller rule ID 2

13 NOTE: A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent do care bits, and the 1 bits represent don t care bits. If the 'do care' bits in an IP address are identical to the do care bits in an IP address criterion, the IP address matches the criterion. All don t care bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, is a valid wildcard mask. Rule comments and rule range remarks Add a comment about an ACL rule to make it easy to understand. The rule comment appears below the rule statement. In addition, add a rule range remark to indicate the start or end of a range of rules created for the same purpose. ACL rule numbering What is the ACL rule numbering step If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID. The rule numbering step sets the increment by which the system automatically numbers rules. For example, the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert between two rules. By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are matched in ascending order of rule ID. Automatic rule numbering and renumbering The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the current highest rule ID, starting with 0. For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10, and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule is numbered 0. Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4, 6 and 8. ACL configuration task list Complete the following tasks to configure an ACL: Task Configuring a time range Configuring a basic ACL Configuring an advanced ACL Remarks Optional Applicable to IPv4 and IPv6 ACLs. Required Configure at least one task. 3

14 Task Configuring an Ethernet frame header ACL Remarks Applicable to IPv4 and IPv6. Configuring a user-defined ACL Copying an ACL Configuring a user-defined flow template Configuring packet filtering with ACLs Optional Applicable to IPv4 and IPv6. Optional Applicable to IPv4 and IPv6 ACLs. Optional Applicable to IPv4 and IPv6. Configuring an ACL Configuring a time range You can implement ACL rules based on the time of day by applying a time range to them. A time-based ACL rule takes effect only in any time periods specified by the time range. The following basic types of time range are available: Periodic time range Recurs periodically on a day or days of the week. Absolute time range Represents only a period of time and does not recur. You can create a maximum of 256 time ranges, each with a maximum of 32 periodic statements and 12 absolute statements. The active period of a time range is calculated as follows: 1. Combining all periodic statements 2. Combining all absolute statements 3. Taking the intersection of the two statement sets as the active period of the time range To configure a time range: Step Command Remarks 1. Enter system view. system-view N/A 2. Configure a time range. time-range time-range-name { start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] from time1 date1 [ to time2 date2 ] to time2 date2 } By default, no time range exists. Repeat this command with the same time range name to create multiple statements for a time range. Configuring a basic ACL Configuring an IPv4 basic ACL IPv4 basic ACLs match packets based only on source IP addresses. To configure an IPv4 basic ACL: 4

15 Step Command Remarks 1. Enter system view. system-view N/A 2. Create an IPv4 basic ACL and enter its view. 3. Configure a description for the IPv4 basic ACL. acl number acl-number [ name acl-name ] [ match-order { auto config } ] description text By default, no ACL exists. IPv4 basic ACLs are numbered in the range 2000 to You can use the acl name acl-name command to enter the view of a named IPv4 ACL. Optional. By default, an IPv4 basic ACL has no ACL description. 4. Set the rule numbering step. step step-value Optional. The default setting is Create or edit a rule. rule [ rule-id ] { deny permit } [ counting fragment logging source { sour-addr sour-wildcard any } time-range time-range-name vpn-instance vpn-instance-name ] * By default, an IPv4 basic ACL does not contain any rule. The logging keyword supports only the packet filter function. 6. Add or edit a rule comment. rule rule-id comment text Optional. By default, an IPv4 ACL rule has no rule description. 7. Add or edit a rule range remark. 8. Enable rule match counting for the IPv4 basic ACL. rule [ rule-id ] remark text hardware-count enable Optional. By default, no rule range remarks are configured. Optional. By default, rule match counting is disabled. Configuring an IPv6 basic ACL To configure an IPv6 basic ACL: Step Command Remarks 1. Enter system view. system-view N/A 5

16 Step Command Remarks 2. Enable the 80-byte ACL rule length mode. 3. Create an IPv6 basic ACL view and enter its view. 4. Configure a description for the IPv6 basic ACL. acl ipv6 enable acl ipv6 number acl6-number [ name acl6-name ] [ match-order { auto config } ] description text The default setting is 40 bytes on an EC or EF card, for example, LSR1GP48LEC1 or LSR1GP48LEF1. This command is valid only for an EC or EF card. To support user-defined, IPv6 basic, and IPv6 advanced ACLs on an EC or EF card, you must configure this command first. The other cards support user-defined and IPv6 ACLs by default. For more information about EC and EF cards, see Fundamentals Configuration Guide. By default, no ACL exists. IPv6 basic ACLs are numbered in the range 2000 to You can use the acl ipv6 name acl6-name command to enter the view of a named IPv6 ACL. Optional. By default, an IPv6 basic ACL has no ACL description. 5. Set the rule numbering step. step step-value Optional. The default setting is Create or edit a rule. rule [ rule-id ] { deny permit } [ counting fragment logging routing [ type routing-type ] source { ipv6-address prefix-length ipv6-address/prefix-length any } time-range time-range-name vpn-instance vpn-instance-name ] * By default, an IPv6 basic ACL does not contain any rule. The logging keyword supports only the packet filter function. The vpn-instance keyword is not supported. 7. Add or edit a rule comment. rule rule-id comment text Optional. By default, an IPv6 basic ACL rule has no rule description. 8. Add or edit a rule range remark. 9. Enable rule match counting for the IPv6 basic ACL. rule [ rule-id ] remark text hardware-count enable Optional. By default, no rule range remarks are configured. Optional. By default, rule matching counting is disabled. 6

17 Configuring an advanced ACL Configuring an IPv4 advanced ACL IPv4 advanced ACLs match packets based on source IP addresses, destination IP addresses, packet priorities, protocols over IP, and other protocol header information, such as TCP/UDP source and destination port numbers, TCP flags, ICMP message types, and ICMP message codes. Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering. To configure an IPv4 advanced ACL: Step Command Remarks 1. Enter system view. system-view N/A 2. Create an IPv4 advanced ACL and enter its view. 3. Configure a description for the IPv4 advanced ACL. acl number acl-number [ name acl-name ] [ match-order { auto config } ] description text By default, no ACL exists. IPv4 advanced ACLs are numbered in the range 3000 to You can use the acl name acl-name command to enter the view of a named IPv4 ACL. Optional. By default, an IPv4 advanced ACL has no ACL description. 4. Set the rule numbering step. step step-value Optional. The default setting is Create or edit a rule. rule [ rule-id ] { deny permit } protocol [ { { ack ack-value fin fin-value psh psh-value rst rst-value syn syn-value urg urg-value } * established } counting destination { dest-addr dest-wildcard any } destination-port operator port1 [ port2 ] dscp dscp fragment icmp-type { icmp-type [ icmp-code ] icmp-message } logging precedence precedence reflective source { sour-addr sour-wildcard any } source-port operator port1 [ port2 ] time-range time-range-name tos tos vpn-instance vpn-instance-name ] * By default, an IPv4 advanced ACL does not contain any rule. The logging keyword supports only the packet filter function. 6. Add or edit a rule comment. rule rule-id comment text Optional. By default, an IPv4 advanced ACL rule has no rule description. 7. Add or edit a rule range remark. rule [ rule-id ] remark text Optional. By default, no rule range remarks are configured. 7

18 Step Command Remarks 8. Enable rule match counting for the IPv4 advanced ACL. hardware-count enable Optional. By default, rule matching counting is disabled. Configuring an IPv6 advanced ACL IPv6 advanced ACLs match packets based on the source IPv6 addresses, destination IPv6 addresses, packet priorities, protocols carried over IPv6, and other protocol header fields such as the TCP/UDP source port number, TCP/UDP destination port number, ICMPv6 message type, and ICMPv6 message code. Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering. To configure an IPv6 advanced ACL: Step Command Remarks 1. Enter system view. system-view N/A 2. Enable the 80-byte ACL rule length mode. 3. Create an IPv6 advanced ACL and enter its view. 4. Configure a description for the IPv6 advanced ACL. acl ipv6 enable acl ipv6 number acl6-number [ name acl6-name ] [ match-order { auto config } ] description text The default setting is 40 bytes on an EC or EF card, for example, LSR1GP48LEC1 or LSR1GP48LEF1. This command is valid only for an EC or EF card. To support user-defined, IPv6 basic, and IPv6 advanced ACLs on an EC or EF card, you must configure this command first. The other cards support user-defined and IPv6 ACLs by default. For more information about EC and EF cards, see Fundamentals Configuration Guide. By default, no ACL exists. IPv6 advanced ACLs are numbered in the range 3000 to You can use the acl ipv6 name acl6-name command to enter the view of a named IPv6 ACL. Optional. By default, an IPv6 advanced ACL has no ACL description. 5. Set the rule numbering step. step step-value Optional. The default setting is 5. 8

19 Step Command Remarks 6. Create or edit a rule. rule [ rule-id ] { deny permit } protocol [ { { ack ack-value fin fin-value psh psh-value rst rst-value syn syn-value urg urg-value } * established } counting destination { dest dest-prefix dest/dest-prefix any } destination-port operator port1 [ port2 ] dscp dscp flow-label flow-label-value fragment icmp6-type { icmp6-type icmp6-code icmp6-message } logging routing [ type routing-type ] source { source source-prefix source/source-prefix any } source-port operator port1 [ port2 ] time-range time-range-name vpn-instance vpn-instance-name ] * By default IPv6 advanced ACL does not contain any rule. The logging keyword supports only the packet filter function. The vpn-instance keyword is not supported. 7. Add or edit a rule comment. rule rule-id comment text Optional. By default, an IPv6 advanced ACL rule has no rule description. 8. Add or edit a rule range remark. 9. Enable rule match counting for the IPv6 advanced ACL. rule [ rule-id ] remark text hardware-count enable Optional. By default, no rule range remarks are configured. Optional. By default, rule matching counting is disabled. Configuring an Ethernet frame header ACL Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol header fields such as source MAC address, destination MAC address, 802.1p priority (VLAN priority), and link layer protocol type. To configure an Ethernet frame header ACL: Step Command Remarks 1. Enter system view. system-view N/A 2. Create an Ethernet frame header ACL and enter its view. acl number acl-number [ name acl-name ] [ match-order { auto config } ] By default, no ACL exists. Ethernet frame header ACLs are numbered in the range 4000 to You can use the acl name acl-name command to enter the view of a named Ethernet frame header ACL. 9

20 Step Command Remarks 3. Configure a description for the Ethernet frame header ACL. description text Optional. By default, an Ethernet frame header ACL has no ACL description. 4. Set the rule numbering step. step step-value Optional. The default setting is Create or edit a rule. rule [ rule-id ] { deny permit } [ cos vlan-pri counting dest-mac dest-addr dest-mask { lsap lsap-type lsap-type-mask type protocol-type protocol-type-mask } source-mac sour-addr source-mask time-range time-range-name ] * By default, an Ethernet frame header ACL does not contain any rule. The lsap keyword is not supported. 6. Add or edit a rule comment. rule rule-id comment text Optional. By default, an Ethernet frame header ACL rule has no rule description. 7. Add or edit a rule range remark. 8. Enable rule match counting for the Ethernet frame header ACL. rule [ rule-id ] remark text hardware-count enable Optional. By default, no rule range remarks are configured. Optional. By default, rule matching counting is disabled. Configuring a user-defined ACL User-defined ACLs allow you to customize rules based on information in protocol headers. You can define a user-defined ACL to match packets in which a specific number of bytes after the specified offset (relative to the specified header), matches the specified match pattern after being ANDed with a match pattern mask. To configure a user-defined ACL: Step Command Remarks 1. Enter system view. system-view N/A 10

21 Step Command Remarks 2. Enable the 80-byte ACL rule length mode. 3. Create a user-defined ACL and enter its view. 4. Configure a description for the user-defined ACL. 5. Create or edit a rule. acl ipv6 enable acl number acl-number [ name acl-name ] description text rule [ rule-id ] { deny permit } [ { { ipv4 ipv6 l2 l4 } rule-string rule-mask offset }&<1-8> ] [ time-range time-range-name ] [ counting ] The default setting is 40 bytes on an EC or EF card, for example, LSR1GP48LEC1 or LSR1GP48LEF1. This command is valid only for an EC or EF card. To support user-defined, IPv6 basic, and IPv6 advanced ACLs on an EC or EF card, you must configure this command first. The other cards support user-defined and IPv6 ACLs by default. For more information about EC and EF cards, see Fundamentals Configuration Guide. By default, no ACL exists. The rule order of a user-defined ACL is config. User-defined ACLs are numbered in the range 5000 to You can use the acl name acl-name command to enter the view of a user-defined ACL. Optional. By default, a user-defined ACL has no ACL description. By default, a user-defined ACL does not contain any rule. 6. Add or edit a rule comment. rule rule-id comment text Optional. By default, a user-defined ACL rule has no rule description. 7. Add or edit a rule range remark. 8. Enable rule match counting for the user-defined ACL. rule [ rule-id ] remark text hardware-count enable Optional. By default, no rule range remarks are configured. Optional. By default, rule matching counting is disabled. Two member switches of an IRF fabric must work in the same rule match mode; therefore, you must configure the acl ipv6 enable command on both switches, or the acl ipv6 disable command on both switches. For information about IRF, see IRF Configuration Guide. 11

22 Copying an ACL You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL) has the same properties and content as the source ACL, but not the same ACL number and name. To successfully copy an ACL, make sure that: The destination ACL number is from the same category as the source ACL number. The source ACL already exists but the destination ACL does not. Copying an IPv4 ACL To copy an IPv4 ACL: Step Command 1. Enter system view. system-view 2. Copy an existing IPv4 ACL to create a new IPv4 ACL. acl copy { source-acl-number name source-acl-name } to { dest-acl-number name dest-acl-name } Copying an IPv6 ACL To copy an IPv6 ACL: Step Command 1. Enter system view. system-view 2. Copy an existing IPv6 ACL to generate a new one of the same category. acl ipv6 copy { source-acl6-number name source-acl6-name } to { dest-acl6-number name dest-acl6-name } Configuring a user-defined flow template NOTE: Flow templates are supported only on POS subcards. Ethernet interface cards do not support flow templates. Flow templates are sets of criteria based on header fields such as source IP address, destination IP address, source TCP port, and destination TCP port. Flow templates apply only to hardware-based ACLs. You use a flow template to limit the match criteria that can be applied to an interface. ACL rules that contain any criterion beyond the flow template on an interface cannot be assigned to hardware. There are default flow templates and basic user-defined templates. By default, an interface uses the default flow template. To create a flow template and apply it to an interface: Step Command Remarks 1. Enter system view. system-view N/A 12

23 Step Command Remarks 2. Create a basic user-defined flow template. flow-template flow-template-name basic { customer-vlan-id dip dmac dport dscp ethernet-protocol fragments icmp-code icmp-type ip-precedence ip-protocol mpls-exp service-cos sip smac sport tcp-flag tos } * By default, no user-defined flow template exists. 3. Enter interface view or port group view. Enter interface view: interface interface-type interface-number Enter port group view: port-group manual port-group-name Use either command. To apply the flow template to one interface, enter interface view. To apply the flow template to a group of interfaces, enter port group view. 4. Apply the flow template to the interface or port group. flow-template flow-template-name The default flow template applies by default. NOTE: The user-defined flow template you are applying to an interface must already exist. You can apply only one user-defined flow template on an interface. The default flow template contains these criteria: sip, dip, ip-protocol, sport, dport, icmp-code, icmp-type, tos, dscp, ip-precedence, mpls-exp, tcp-flag, and fragment. User-defined flow template you apply to a POS interfaces does not support smac, dmac, or customer-vlan-id. Configuring packet filtering with ACLs You can use an ACL to filter incoming or outgoing IPv4 or IPv6 packets. With a basic or advanced ACL, you can log filtering events by specifying the logging keyword in the ACL rules and enabling the counting function. To enable counting for rule matches performed in hardware, configure the hardware-count enable command for the ACL or specify the counting keyword in the ACL rules. You can set the packet filter to periodically send packet filtering logs to the information center as informational messages. The interval for generating and outputting packet filtering logs is configurable. The log information includes the number of matching packets and the ACL rules used in an interval. For more information about the information center, see Network Management and Monitoring Configuration Guide. NOTE: ACLs on VLAN interfaces filter only packets forwarded at Layer 3. Applying an IPv4 ACL for packet filtering 1. Configuration guidelines 13

24 When you use the packet-filter forwarding-layer route outbound command or its undo form to specify the outbound packet filter on a VLAN interface to filter only Layer 3 unicast packets or all packets, follow these guidelines: The packet-filter forwarding-layer route outbound command is available only for Ethernet interface cards. The packet-filter forwarding-layer route outbound or its undo form must be configured before the packet-filter { acl-number name acl-name } outbound command. If you have configured the packet-filter { acl-number name acl-name } outbound command on a VLAN interface, you must remove the packet filter setting, configure the packet-filter forwarding-layer route outbound or its undo form, and then re-configure the packet-filter { acl-number name acl-name } outbound command on the VLAN interface. The packet-filter forwarding-layer route outbound command can cause the switch to discard BFD packets. To avoid this problem, configure an advanced ACL rule by using the rule [ rule-id ] permit udp destination-port range command to permit BFD packets. In IRF mode, the packet-filter forwarding-layer route outbound command can cause the switch to discard sflow packets. To avoid this problem, configure an advanced ACL rule by using the rule [ rule-id ] permit udp destination-port range eq udp-port command to permit sflow packets. The udp-port is the port number of the sflow collector and defaults to For information about sflow, see Network Management and Monitoring Configuration Guide. 2. Configuration procedure To apply an IPv4 ACL for packet filtering: Step Command Remarks 1. Enter system view. system-view N/A 2. Set the outbound packet filters on VLAN interfaces to filter only Layer 3 (routed) unicast packets. 3. Enter interface view. packet-filter forwarding-layer route outbound interface interface-type interface-number Optional. By default, an outbound IPv4 packet filter filters all packets, including Layer 2 (switched) packets, on a VLAN interface. N/A 14

25 Step Command Remarks By default, no ACL is applied to any interface. 4. Apply an IPv4 basic, IPv4 advanced, Ethernet frame header, or user-defined ACL to the interface to filter packets. packet-filter { acl-number name acl-name } { inbound outbound } On a VLAN interface: The inbound packet filter handles only Layer 3 unicast packets. If the packet-filter forwarding-layer route outbound command is configured, the outbound packet filter handles only Layer 3 unicast packets; if not, the outbound packet filter handles all packets. On an Ethernet interface, the packet filter handles all packets. Avoid the case that multiple users configure the packet-filter command at the same time. Otherwise, the configuration may fail. 5. Exit to system view. quit N/A 6. Set the interval for generating and outputting IPv4 packet filtering logs. acl logging frequence frequence By default, the interval is 0. No IPv4 packet filtering logs are generated. The rule you add to an ACL that has been used by a packet filter cannot take effect if hardware resources are insufficient or the packet filter does not support the rule. Such rules are marked as uncompleted in the output of the display acl { acl-number all name acl-name } slot slot-number command. To successfully apply the rule, you must delete the rule and reconfigure it when hardware resources are sufficient. Follow these guidelines when you configure a packet filter on a VLAN interface: Use the undo packet-filter command to remove the packet filter from the VLAN interface if the ACL application fails on an interface card, for example, because of hardware resource insufficiency. The switch applies the packet filter configured on a VLAN interface to the main processing unit and all interface cards. When an application failure occurs on an interface card, the switch cannot automatically remove the ACL that has been applied to the main processing unit or any other interface card. You must also use the undo packet-filter to remove the packet filter if the switch fails to update the packet filter on an interface card after you edit the ACL rules. If you do not remove the packet filter, the old ACL rules continue to take effect and the display packet-filter command shows the initial ACL application status. NOTE: In IRF mode, the switch does not support cross-chassis IP packet filtering. Applying an IPv6 ACL for packet filtering To apply an IPv6 ACL for packet filtering: 15

26 Step Command Remarks 1. Enter system view. system-view N/A 2. Enter interface view. 3. Apply an IPv6 basic or IPv6 advanced ACL to the interface to filter IPv6 packets. interface interface-type interface-number packet-filter ipv6 { acl6-number name acl6-name } { inbound outbound } N/A By default, no IPv6 ACL is applied to the interface. On a VLAN interface, an inbound packet filter handles only Layer 3 unicast packets and an outbound packet filter handles all packets. On an Ethernet interface, the packet filter handles all packets. Avoid the case that multiple users configure the packet-filter ipv6 command at the same time. Otherwise, the configuration may fail. 4. Exit to system view. quit N/A 5. Set the interval for generating and outputting IPv6 packet filtering logs. acl ipv6 logging frequence frequence The default interval is 0. No IPv6 packet filtering logs are generated. The rule you add to an ACL that has been used by a packet filter cannot take effect if hardware resources are insufficient or the packet filter does not support the rule. Such rules are marked as uncompleted in the output of the display acl ipv6 { acl-number all name acl-name } slot slot-number command. To successfully apply the rule, you must delete the rule and reconfigure it when hardware resources are sufficient. Follow these guidelines when you configure a packet filter on a VLAN interface: Use the undo packet-filter ipv6 command to remove the packet filter from the VLAN interface if the ACL application fails on an interface card, for example, because of hardware resource insufficiency. The switch applies the packet filter configured on a VLAN interface to the main processing unit and all interface cards. When an application failure occurs on an interface card, the switch cannot automatically remove the ACL that has been applied to the main processing unit or any other interface card. You must also use the undo packet-filter ipv6 to remove the packet filter if the switch fails to update the packet filter on an interface card after you edit the ACL rules. If you do not remove the packet filter, the old ACL rules continue to take effect and the display packet-filter ipv6 command shows the initial ACL application status. NOTE: In IRF mode, the switch does not support cross-chassis IP packet filtering. Displaying and maintaining ACLs 16

27 Task Command Remarks Display the IPv4 ACL configuration and match statistics (standalone mode). Display the IPv4 ACL configuration and match statistics (IRF mode). Display the IPv6 ACL configuration and match statistics (standalone mode). Display the IPv6 ACL configuration and match statistics (IRF mode). Display the usage of ACL resources (standalone mode). Display the usage of ACL resources (IRF mode). Display information about flow templates applied to interfaces. Display the configuration of one or all user-defined flow templates. Display application information of ACLs for packet filtering (standalone mode). Display application information of ACLs for packet filtering (IRF mode). Display the configuration and status of one or all time ranges. Clear statistics on one or all IPv4 ACLs. Clear statistics on one or all IPv6 basic and advanced ACLs. display acl { acl-number all name acl-name } [ slot slot-number ] [ { begin exclude include } regular-expression ] display acl { acl-number all name acl-name } [ chassis chassis-number slot slot-number ] [ { begin exclude include } regular-expression ] display acl ipv6 { acl6-number all name acl6-name } [ slot slot-number ] [ { begin exclude include } regular-expression ] display acl ipv6 { acl6-number all name acl6-name } [ chassis chassis-number slot slot-number ] [ { begin exclude include } regular-expression ] display acl resource [ slot slot-number ] [ { begin exclude include } regular-expression ] display acl resource [ chassis chassis-number slot slot-number ] [ { begin exclude include } regular-expression ] display flow-template user-defined [ flow-template-name ] [ { begin exclude include } regular-expression ] display flow-template interface [ interface-type interface-number ] [ { begin exclude include } regular-expression ] display packet-filter { { all interface interface-type interface-number } [ inbound outbound ] interface vlan-interface vlan-interface-number [ inbound outbound ] [ slot slot-number ] } [ { begin exclude include } regular-expression ] display packet-filter { { all interface interface-type interface-number } [ inbound outbound ] interface vlan-interface vlan-interface-number [ inbound outbound ] [ chassis chassis-number slot slot-number ] } [ { begin exclude include } regular-expression ] display time-range { time-range-name all } [ { begin exclude include } regular-expression ] reset acl counter { acl-number all name acl-name } reset acl ipv6 counter { acl6-number all name acl6-name } Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view Available in user view Available in user view 17

28 ACL configuration examples NOTE: By default, Ethernet, VLAN, and aggregate interfaces are down. To configure these interfaces, use the undo shutdown command to bring them up first. IPv4 ACL configuration example Network requirements A company interconnects its departments through a switch A. Configure an ACL to: Permit access from the President's office at any time to the salary server. Deny access from any other department to the salary server during office hours (from 8:00 to 18:00) on working days. Figure 1 Network diagram Configuration procedure 1. Create a time range for office hours # Create a periodic time range from 8:00 to 18:00 on working days. <Switch> system-view [Switch] time-range trname 8:00 to 18:00 working-day 2. Define ACLs # Create ACL 3000, and configure an ACL rule for it. [Switch] acl number 3000 [Switch-acl-adv-3000] rule 1 permit ip source destination [Switch-acl-adv-3000] quit # Create ACL 3001, and configure an ACL rule for it. [Switch] acl number

29 [Switch-acl-adv-3001] rule 1 permit ip source any destination time-range trname [Switch-acl-adv-3001] quit 3. Define a QoS policy and apply the policy to ports # Create traffic classes and define traffic behaviors. [Switch] traffic classifier test_permit [Switch-classifier-test_permit] if-match acl 3000 [Switch-classifier-test_permit] quit [Switch] traffic behavior test_permit [Switch-behavior-test_permit] filter permit [Switch-behavior-test_permit] quit [Switch] traffic classifier test_deny [Switch-classifier-test_deny] if-match acl 3001 [Switch-classifier-test_deny] quit [Switch] traffic behavior test_deny [Switch-behavior-test_deny] filter deny [Switch-behavior-test_deny] quit # Create a QoS policy. [Switch] qos policy test [Switch-qospolicy-test] classifier test_permit behavior test_permit [Switch-qospolicy-test] classifier test_deny behavior test_deny [Switch-qospolicy-test] quit # Apply the QoS policy to ports GigabitEthernet 4/0/1 through GigabitEthernet 4/0/3 in the inbound direction. [Switch] interface gigabitethernet 4/0/1 [Switch-GigabitEthernet4/0/1] qos apply policy test inbound [Switch-GigabitEthernet4/0/1] quit [Switch] interface gigabitethernet 4/0/2 [Switch-GigabitEthernet4/0/2] qos apply policy test inbound [Switch-GigabitEthernet4/0/2] quit [Switch] interface gigabitethernet 4/0/3 [Switch-GigabitEthernet4/0/3] qos apply policy test inbound [Switch-GigabitEthernet4/0/3] quit IPv6 ACL configuration example Network requirements Perform packet filtering in the inbound direction of interface GigabitEthernet 4/0/1 to deny all IPv6 packets but those with source addresses in the range 4050::9000 to 4050::90FF. Configuration procedure # Create ACL 2000, and define an ACL rule for it. <Switch> system-view [Switch] acl ipv6 number 2000 [Switch-acl6-basic-2000] rule permit source 4050::9000/120 [Switch-acl6-basic-2000] quit # Create ACL 2001, and define an ACL rule for it. 19

30 [Switch] acl ipv6 number 2001 [Switch-acl6-basic-2001] rule permit source any [Switch-acl6-basic-2001] quit # Define a class and a traffic behavior to permit packets with source addresses in the range 4050::9000 to 4050::90FF. [Switch] traffic classifier c_permit [Switch-classifier-c_permit] if-match acl ipv [Switch-classifier-c_permit] quit [Switch] traffic behavior b_permit [Switch-behavior-b_permit] filter permit [Switch-behavior-b_permit] quit # Define a class and a traffic behavior to deny other packets. [Switch] traffic classifier c_deny [Switch-classifier-c_deny] if-match acl ipv [Switch-classifier-c_deny] quit [Switch] traffic behavior b_deny [Switch-behavior-b_deny] filter deny [Switch-behavior-b_deny] quit # Configure a QoS policy. [Switch] qos policy test [Switch-qospolicy-test] classifier c_permit behavior b_permit [Switch-qospolicy-test] classifier c_deny behavior b_deny [Switch-qospolicy-test] quit # Apply the QoS policy to port GigabitEthernet 4/0/1 in the inbound direction. [Switch] interface gigabitethernet 4/0/1 [Switch-GigabitEthernet4/0/1] qos apply policy test inbound [Switch-GigabitEthernet4/0/1] quit IPv4 packet filtering configuration example Network requirements As shown in Figure 2, Host A and Host B connect to the switch to access the Internet. Configure packet filtering on the VLAN interface of the switch so that everyday from 8:00 to 18:00, the VLAN-interface denies only IPv4 packets sourced from Host A. Configure the switch to output IPv4 packet filtering logs to the console at 10-minute intervals. As actual requirements change, edit the ACL so that the VLAN interface denies only IPv4 packets sourced from Host B. 20