H3C s5820x series Configuration manual

H3C S5820X&S5800 Series Ethernet Switches

ACL and QoS

Configuration Guide

Hangzhou H3C Technologies Co., Ltd.

http://www.h3c.com

Document Version: 6W103-20100716

Product Version: Release 1110

No part of this manual may be reproduced or transmitted in any form or by any means without prior

written consent of Hangzhou H3C Technologies Co., Ltd.

Trademarks

H3C, , Aolynk, , H

3

Care,

, TOP G, , IRF, NetPilot, Neocean, NeoVTL,

SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V

2

G, V

n

G, PSPT,

XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,

Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners.

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface

The H3C S5800&S5820X documentation set includes 11 configuration guides, which describe the

software features for the S5800&S5820X Series Ethernet Switches and guide you through the software

configuration procedures. These configuration guides also provide configuration examples to help you

apply software features to different network scenarios.

The ACL and QoS Configuration Guide describes fundamentals and configuration of ACL and QoS. It

describes how to create IPv4 ACL and IPv6 ACL, use ACL for packet filtering, use QoS polices to

control traffic, and configure common QoS techniques such as traffic policing, traffic shaping,

congestion management, and congestion avoidance.

This preface includes:

z Audience

z Document Organization

z Conventions

z About the H3C S5820X&S5800 Documentation Set

z Obtaining Documentation

z Documentation Feedback

Audience

This documentation set is intended for:

z Network planners

z Field technical support and servicing engineers

z Network administrators working with the S5800 and S5820X series

Document Organization

The ACL and QoS Configuration Guide comprises these parts:

ACL Configuration QoS Overview

QoS Configuration

Approaches

Priority Mapping

Configuration

Traffic Policing, Traffic

Shaping, and Line Rate

Configuration

Congestion Management

Configuration

Congestion Avoidance

Configuration

Traffic Filtering

Configuration

Priority Marking

Configuration

Traffic Redirecting

Configuration

Global CAR

Configuration

Class-Based Accounting

Configuration

Data Buffer Configuration

Appendix A Default

Priority Mapping Tables

Appendix B Introduction

to Packet Precedences

Conventions

This section describes the conventions used in this documentation set.

Command conventions

Convention Description

Boldface Bold text represents commands and keywords that you enter literally as shown.

italic

Italic text represents arguments that you replace with actual values.

[ ]

Square brackets enclose syntax choices (keywords or arguments) that are

optional.

{ x | y | ... }

Braces enclose a set of required syntax choices separated by vertical bars,

from which you select one.

[ x | y | ... ]

Square brackets enclose a set of optional syntax choices separated by vertical

bars, from which you select one or none.

{ x | y | ... } *

Asterisk marked braces enclose a set of required syntax choices separated by

vertical bars, from which you select at least one.

[ x | y | ... ] *

Asterisk marked square brackets enclose optional syntax choices separated by

vertical bars, from which you may select multiple choices or none.

&<1-n>

The argument or keyword and argument combination before the ampersand (&)

sign can be entered 1 to n times.

# A line that starts with a pound (#) sign is comments.

GUI conventions

Convention Description

Boldface

Window names, button names, field names, and menu items are in Boldface.

For example, the New User window appears; click OK.

>

Multi-level menus are separated by angle brackets. For example, File > Create

> Folder.

Symbols

Convention Description

Means reader be careful. Improper operation may cause data loss or damage to

equipment.

Means a complementary description.

About the H3C S5820X&S5800 Documentation Set

The H3C S5800&S5820X documentation set also includes:

Category Documents Purposes

Marketing brochures Describe product specifications and benefits.

Product description and

specifications

Technology white papers

Provide an in-depth description of software features

and technologies.

Category Documents Purposes

PSR150-A [ PSR150-D ]

Power Modules User

Manual

Describes the appearances, features, specifications,

installation, and removal of the pluggable 150W power

modules available for the products.

PSR300-12A

[ PSR300-12D1 ] Power

Modules User Manual

Describes the appearances, features, specifications,

installation, and removal of the pluggable 300W power

modules available for the products.

PSR750-A [ PSR750-D ]

Power Modules User

Manual

Describes the appearances, features, specifications,

installation, and removal of the pluggable 750W power

modules available for the products.

RPS User Manual

Describes the appearances, features, and

specifications of the RPS units available for the

products.

LSW1FAN and

LSW1BFAN Installation

Manual

Describes the appearances, specifications,

installation, and removal of the pluggable fan modules

available for the products.

LSW148POEM Module

User Manual

Describes the appearance, features, installation, and

removal of the pluggable PoE module available for the

products.

S5820X [ S5800 ] Series

Ethernet Switches

Interface Cards User

Manual

Describes the models, hardware specifications,

installation, and removal of the interface cards

available for the products.

H3C OAP Cards User

Manual

Describes the benefits, features, hardware

specifications, installation, and removal of the OAP

cards available for the products.

Pluggable module

description

H3C Low End Series

Ethernet Switches

Pluggable Modules

Manual

Describes the models, appearances, and

specifications of the pluggable modules available for

the products.

S5800-60C-PWR

Ethernet Switch Hot

Swappable Power

Module Ordering Guide

Guides you through ordering the hot-swappable power

modules available for the S5800-60C-PWR switches

in different cases.

Power configuration

RPS Ordering

Information for H3C

Low-End Ethernet

Switches

Provides the RPS and switch compatibility matrix and

RPS cable specifications.

Hardware installation

z S5800 Series

Ethernet Switches

Quick Start

z S5820X Series

Ethernet Switches

Quick Start

z S5800 Series

Ethernet Switches

CE DOC

z S5820X Series

Ethernet Switches

CE DOC

Provides regulatory information and the safety

instructions that must be followed during installation.

Category Documents Purposes

z S5800 Series

Ethernet Switches

Quick Start

z S5820X Series

Ethernet Switches

Quick Start

Guides you through initial installation and setup

procedures to help you quickly set up and use your

device with the minimum configuration.

z S5800 Series

Ethernet Switches

Installation Manual

z S5820X Series

Ethernet Switches

Installation Manual

Provides a complete guide to hardware installation

and hardware specifications.

Pluggable

SFP[SFP+][XFP]

Transceiver Modules

Installation Guide

Guides you through installing SFP/SFP+/XFP

transceiver modules.

z S5800-60C-PWR

Switch Video

Installation Guide

z S5820X-28C Switch

Video Installation

Guide

Shows how to install the H3C S5800-60C-PWR and

H3C S5820X-28C Ethernet switches.

Configuration guide

Describe software features and configuration

procedures.

Software configuration

Command reference Provide a quick reference to all available commands.

H3C Series Ethernet

Switches Login

Password Recovery

Manual

Tells how to find the lost password or recover the

password when the login password is lost.

Operations and

maintenance

Release notes

Provide information about the product release,

including the version history, hardware and software

compatibility matrix, version upgrade information,

technical support information, and software upgrading.

Obtaining Documentation

You can access the most up-to-date H3C product documentation on the World Wide Web at

http://www.h3c.com.

Click the links on the top navigation bar to obtain different categories of product documentation:

[Technical Support & Documents > Technical Documents] – Provides hardware installation, software

upgrading, and software feature configuration and maintenance documentation.

[Products & Solutions] – Provides information about products and technologies, as well as solutions.

[Technical Support & Documents > Software Download] – Provides the documentation released with

the software version.

Documentation Feedback

You can e-mail your comments about product documentation to [email protected].

We appreciate your comments.

i

Table of Contents

1 ACL Configuration·····································································································································1-1

ACL Overview·········································································································································1-1

Application of ACLs on the Switch ··································································································1-1

ACL Classification ···························································································································1-2

ACL Numbering and Naming ··········································································································1-3

Match Order·····································································································································1-3

ACL Rule Numbering Step··············································································································1-4

Implementing Time-Based ACL Rules····························································································1-5

IPv4 Fragments Filtering with ACLs································································································1-5

ACL Configuration Task List ···················································································································1-5

Configuring an ACL·································································································································1-6

Creating a Time Range ···················································································································1-6

Configuring a Basic ACL ·················································································································1-6

Configuring an Advanced ACL········································································································1-9

Configuring an Ethernet Frame Header ACL················································································1-13

Copying an ACL ····························································································································1-14

Applying an ACL for Packet Filtering·····························································································1-15

Displaying and Maintaining ACLs·········································································································1-16

ACL Configuration Examples················································································································1-17

IPv4 ACL Application Configuration Example···············································································1-17

IPv6 ACL Application Configuration Example···············································································1-17

2 QoS Overview ············································································································································2-1

Introduction to QoS·································································································································2-1

QoS Service Models ·······························································································································2-1

Best-Effort Service Model················································································································2-1

IntServ Model ··································································································································2-1

DiffServ Model·································································································································2-2

QoS Techniques Overview·····················································································································2-2

Applying QoS Techniques in a Network··························································································2-2

QoS Processing Flow in a Device···································································································2-3

3 QoS Configuration Approaches···············································································································3-1

QoS Configuration Approach Overview··································································································3-1

Non-Policy Approach·······················································································································3-1

Policy Approach·······························································································································3-1

Configuring a QoS Policy························································································································3-1

Defining a Class ······························································································································3-2

Defining a Traffic Behavior··············································································································3-5

Defining a Policy······························································································································3-5

Applying the QoS Policy··················································································································3-6

Displaying and Maintaining QoS Policies························································································3-9

ii

4 Priority Mapping Configuration················································································································4-1

Priority Mapping Overview······················································································································4-1

Introduction to Priority Mapping·······································································································4-1

Priority Mapping Tables···················································································································4-1

Priority Trust Mode on a Port ··········································································································4-2

Priority Mapping Procedure·············································································································4-2

Priority Mapping Configuration Tasks·····································································································4-3

Configuring Priority Mapping···················································································································4-4

Configuring a Priority Mapping Table······························································································4-4

Configuring the Priority Trust Mode on a Port·················································································4-4

Configuring the Port Priority of a Port······························································································4-5

Displaying and Maintaining Priority Mapping··························································································4-5

Priority Mapping Configuration Examples·······························································································4-5

Priority Mapping Table and Priority Marking Configuration Example··············································4-5

5 Traffic Policing, Traffic Shaping, and Line Rate Configuration····························································5-1

Traffic Policing, Traffic Shaping, and Line Rate Overview······································································5-1

Traffic Evaluation and Token Buckets·····························································································5-1

Traffic Policing·································································································································5-2

Traffic Shaping ································································································································5-3

Line Rate·········································································································································5-4

Configuring Traffic Policing·····················································································································5-5

Configuration Procedure··················································································································5-5

Configuration Example····················································································································5-6

Configuring GTS ·····································································································································5-7

Configuration Procedure··················································································································5-7

Configuration Example····················································································································5-7

Configuring the Line Rate·······················································································································5-7

Configuration Procedure··················································································································5-7

Configuration Example····················································································································5-8

Displaying and Maintaining Traffic Policing, GTS, and Line Rate ··························································5-8

6 Congestion Management Configuration·································································································6-1

Congestion Management Overview········································································································6-1

Causes, Impacts, and Countermeasures of Congestion·································································6-1

Congestion Management Techniques·····························································································6-2

Congestion Management Configuration Approaches·············································································6-4

Configuring Congestion Management····································································································6-4

Configuring SP Queuing··················································································································6-4

Configuring WRR Queuing··············································································································6-5

Configuring WFQ Queuing··············································································································6-6

Configuring SP+WRR Queuing·······································································································6-7

Configuration Example····················································································································6-8

Displaying and Maintaining Congestion Management············································································6-8

7 Congestion Avoidance Configuration·····································································································7-1

Congestion Avoidance Overview············································································································7-1

Introduction to WRED Configuration·······································································································7-2

iii

WRED Configuration Approach·······································································································7-2

Introduction to WRED Parameters··································································································7-2

Configuring WRED on an Interface·········································································································7-2

Configuration Procedure··················································································································7-2

Configuration Example····················································································································7-3

Displaying and Maintaining WRED·········································································································7-3

8 Traffic Filtering Configuration··················································································································8-1

Traffic Filtering Overview ························································································································8-1

Configuring Traffic Filtering·····················································································································8-1

Traffic Filtering Configuration Example···································································································8-2

Traffic Filtering Configuration Example···························································································8-2

9 Priority Marking Configuration·················································································································9-1

Priority Marking Overview·······················································································································9-1

Configuring Priority Marking····················································································································9-1

Priority Marking Configuration Example··································································································9-3

Priority Marking Configuration Example··························································································9-3

QoS-Local-ID Marking Configuration Example···············································································9-5

10 Traffic Redirecting Configuration········································································································10-1

Traffic Redirecting Overview·················································································································10-1

Configuring Traffic Redirecting ·············································································································10-1

11 Global CAR Configuration····················································································································11-1

Global CAR Overview···························································································································11-1

Aggregation CAR···························································································································11-1

Hierarchical CAR···························································································································11-1

Configuring Global CAR························································································································11-2

Referencing an Aggregation CAR in a Traffic Behavior································································11-2

Referencing a Hierarchical CAR in a Traffic Behavior··································································11-3

Displaying and Maintaining Global CAR·······························································································11-4

Global CAR Configuration Examples····································································································11-4

Aggregation CAR Configuration Example·····················································································11-4

AND-Mode Hierarchical CAR Configuration Example ··································································11-5

OR-Mode Hierarchical CAR Configuration Example·····································································11-7

12 Class-Based Accounting Configuration······························································································12-1

Class-Based Accounting Overview·······································································································12-1

Configuring Class-Based Accounting ···································································································12-1

Displaying and Maintaining Class-Based Accounting···········································································12-2

Class-Based Accounting Configuration Example·················································································12-2

Class-Based Accounting Configuration Example··········································································12-2

13 Data Buffer Configuration·····················································································································13-1

Introduction to the Data Buffer··············································································································13-1

Data Buffer ····································································································································13-1

Data Buffer Allocation····················································································································13-1

How the Shared Resource Is Used·······························································································13-2

Configuring the Data Buffer ··················································································································13-3

iv

Data Buffer Configuration Approaches··························································································13-3

Using the Burst Function to Configure the Data Buffer Setup·······················································13-3

Manually Configuring the Data Buffer Setup·················································································13-4

14 Appendix A Default Priority Mapping Tables ·····················································································14-1

Priority Mapping Tables························································································································14-1

15 Appendix B Introduction to Packet Precedences··············································································15-1

IP Precedence and DSCP Values ········································································································15-1

802.1p Priority·······································································································································15-2

16 Index ·······················································································································································16-1

1-1

1 ACL Configuration

This chapter includes these sections:

z ACL Overview

z ACL Configuration Task List

z Configuring an ACL

z Creating a Time Range

z Configuring a Basic ACL

z Configuring an Advanced ACL

z Configuring an Ethernet Frame Header ACL

z Copying an ACL

z Applying an ACL for Packet Filtering

z Displaying and Maintaining ACLs

z ACL Configuration Examples

Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document.

ACL Overview

An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based

on criteria such as the source IP address, destination IP address, and port number.

ACLs are essentially used for packet filtering. A packet filter drops packets that match a deny rule and

permits packets that match a permit rule. ACLs are also widely used by many modules, for example,

QoS and IP routing, for traffic identification.

This section covers these topics:

z Application of ACLs on the Switch

z ACL Classification

z ACL Numbering and Naming

z Match Order

z Implementing Time-Based ACL Rules

z IPv4 Fragments Filtering with ACLs

Application of ACLs on the Switch

The switch supports two ACL application modes:

1-2

z Hardware-based application: An ACL is assigned to a piece of hardware. For example, an ACL is

applied to an Ethernet interface or VLAN interface for packet filtering or is referenced by a QoS

policy for traffic classification. Note that when an ACL is referenced to implement QoS, the actions

defined in the ACL rules, deny or permit, do not take effect; actions to be taken on packets

matching the ACL depend on the traffic behavior definition in QoS. For details about traffic

behavior, see QoS Configuration Approaches in the ACL and QoS Configuration Guide.

z Software-based application: An ACL is referenced by a piece of upper layer software. For

example, an ACL can be referenced to configure login user control behavior, thus controlling

Telnet, SNMP and Web users. Note that when an ACL is reference by the upper layer software,

actions to be taken on packets matching the ACL depend on those defined by the ACL rules. For

details about login user control, see User Login Control in the Fundamentals Configuration Guide.

z When an ACL is assigned to a piece of hardware and referenced by a QoS policy for traffic

classification, the switch does not take action according to the traffic behavior definition on a

packet that does not match the ACL.

z When an ACL is referenced by a piece of software to control Telnet, SNMP, and Web login users,

the switch denies all packets that do not match the ACL.

z For details of ACL application for packet filtering, see Applying an ACL for Packet Filtering.

ACL Classification

ACLs fall into three categories, as shown in Table 1-1.

Table 1-1 ACL categories

Category ACL number IP version Match criteria

IPv4 Source IPv4 address

Basic ACLs 2000 to 2999

IPv6 Source IPv6 address

IPv4

Source/destination IPv4 address, protocols over

IPv4, and other Layer 3 and Layer 4 header

fields

Advanced ACLs 3000 to 3999

IPv6

Source/destination IPv6 address, protocols over

IPv6, and other Layer 3 and Layer 4 header

fields

Ethernet frame

header ACLs

4000 to 4999 IPv4 and IPv6

Layer 2 header fields, such as source and

destination MAC addresses, 802.1p priority, and

link layer protocol type

1-3

ACL Numbering and Naming

Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a

number for identification, and in addition, you can also assign the ACL a name for the ease of

identification. After creating an ACL with a name, you can neither rename it nor delete its name.

For an Ethernet frame header ACL, the ACL number and name must be globally unique. For an IPv4

basic or advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and for an

IPv6 basic or advanced ACL, among all IPv6 ACLs. You can assign an IPv4 ACL and an IPv6 ACL the

same number and name.

Match Order

The rules in an ACL are sorted in a certain order. When a packet matches a rule, the device stops the

match process and performs the action defined in the rule. If an ACL contains overlapping or

conflicting rules, the matching result and action to take depend on the rule order.

Two ACL match orders are available:

z config: Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a

rule with a higher ID. If you use this approach, check the rules and their order carefully.

z auto: Sorts ACL rules in depth-first order, as described in Table 1-2. The depth-first order varies

with ACL categories.

Table 1-2 Sorting ACL rules in depth-first order

ACL category Depth-first rule sorting procedures

IPv4 basic ACL

1) A rule configured with a VPN instance takes precedence.

2) A rule with more 0s in the source IP address wildcard mask takes precedence.

More 0s means a narrower IP address range.

3) A rule with a smaller ID takes precedence.

IPv4 advanced ACL

1) A rule configured with a VPN instance takes precedence.

2) A rule configured with a specific protocol is prior to a rule with the protocol type set

to IP. IP represents any protocol over IP.

3) A rule with more 0s in the source IP address wildcard mask takes precedence.

More 0s means a narrower IP address range.

4) A rule with more 0s in the destination IP address wildcard mask takes

precedence.

5) A rule with a narrower TCP/UDP service port number range takes precedence.

6) A rule with a smaller ID takes precedence.

IPv6 basic ACL

1) A rule configured with a longer prefix for the source IP address takes precedence.

A longer prefix means a narrower IP address range.

2) A rule with a smaller ID takes precedence.

1-4

ACL category Depth-first rule sorting procedures

IPv6 advanced ACL

1) A rule configured with a specific protocol is prior to a rule with the protocol type set

to IP. IP represents any protocol over IPv6.

2) A rule configured with a longer prefix for the source IPv6 address has a higher

priority.

3) A rule configured with a longer prefix for the destination IPv6 address takes

precedence.

4) A rule with a narrower TCP/UDP service port number range takes precedence.

5) A rule with a smaller ID takes precedence.

Ethernet frame

header ACL

1) A rule with more 1s in the source MAC address mask takes precedence. More 1s

means a smaller MAC address.

2) A rule with more 1s in the destination MAC address mask takes precedence.

3) A rule with a smaller ID takes precedence.

A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal

notation. In contrast to a network mask, the 0 bits in a wildcard mask represent ‘do care’ bits, while the

1 bits represent 'don’t care bits'. If the 'do care' bits in an IP address identical to the 'do care' bits in an

IP address criterion, the IP address matches the criterion. All 'don’t care' bits are ignored. The 0s and

1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask. With

wildcard masks, you can create more granular match criteria than network masks.

ACL Rule Numbering Step

What is the ACL rule numbering step

If you do not assign an ID for the rule you are creating, the system automatically assigns it a rule ID.

The rule numbering step sets the increment by which the system numbers rules automatically. For

example, the default ACL rule numbering step is 5. If you do assign IDs to rules you are creating, they

are numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert

between two rules.

By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of

inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are

matched in ascending order of rule ID.

Automatic rule numbering and re-numbering

The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step

to the current highest rule ID, starting with 0.

For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10,

and 12, the newly defined rule will be numbered 15. If the ACL does not contain any rule, the first rule

will be numbered 0.

1-5

Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five

rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be

renumbered 0, 2, 4, 6 and 8.

Likewise, after you restore the default step, ACL rules are renumbered in the default step. Assume that

there are four ACL rules numbered 0, 2, 4, and 6 in steps of 2. When the default step is restored, the

rules are renumbered 0, 5, 15, and 15.

Implementing Time-Based ACL Rules

You can implement ACL rules based on the time of day by applying a time range to them. A time-based

ACL rule takes effect only in any time periods specified by the time range.

Two basic types of time range are available:

z Periodic time range, which recurs periodically on a day or days of the week.

z Absolute time range, which represents only a period of time and does not recur.

You may apply a time range to ACL rules before or after you create it. However, the rules using the

time range can take effect only after you define the time range.

IPv4 Fragments Filtering with ACLs

Traditional packet filtering matched only first fragments of IPv4 packets, and allowed all subsequent

non-first fragments to pass through. This mechanism resulted in security risks, because attackers may

fabricate non-first fragments to attack networks.

As for the configuration of a rule of an IPv4 ACL, the fragment keyword specifies that the rule applies

to non-first fragment packets only, and does not apply to non-fragment packets or the first fragment

packets. ACL rules that do not contain this keyword is applicable to both non-fragment packets and

fragment packets.

ACL Configuration Task List

IPv4 configuration task list

Complete the following tasks to configure an IPv4 ACL:

Task Remarks

Creating a Time Range Optional

Configuring an IPv4 basic ACL

Configuring an IPv4 advanced ACL

Configuring an Ethernet Frame Header ACL

Required

Configure at least one task

Copying an IPv4 ACL Optional

Applying an IPv4 ACL for Packet Filtering Optional

IPv6 ACL configuration task list

Complete the following tasks to configure an IPv6 ACL:

1-6

Task Remarks

Creating a Time Range Optional

Configuring an IPv6 basic ACL

Configuring an IPv6 Advanced ACL

Configuring an Ethernet Frame Header ACL

Required

Configure at least one task

Copying an IPv6 ACL Optional

Applying an IPv6 ACL for Packet Filtering Optional

Configuring an ACL

Creating a Time Range

Follow these steps to create a time range:

To do… Use the command… Remarks

Enter system view

system-view

––

Create a time range

time-range

time-range-name

{ start-time

to

end-time days

[

from

time1 date1 ] [

to

time2

date2 ] |

from

time1 date1 [

to

time2 date2 ] |

to

time2 date2 }

Required

By default, no time range exists.

You may create time ranges identified with the same name. They are regarded as one time range

whose active period is the result of ORing periodic ones, ORing absolute ones, and ANDing periodic

and absolute ones.

You may create a maximum of 256 uniquely named time ranges, each with 32 periodic time ranges at

most and 12 absolute time ranges at most.

Configuring a Basic ACL

Configuring an IPv4 basic ACL

IPv4 basic ACLs match packets based on only source IP address.

Follow these steps to configure an IPv4 basic ACL:

To do… Use the command… Remarks

Enter system view

system-view

––

1-7

To do… Use the command… Remarks

Create an IPv4 basic ACL and

enter its view

acl number

acl-number [

name

acl-name ] [

match-order

{

auto

|

config

} ]

Required

By default, no ACL exists.

IPv4 basic ACLs are numbered in

the range 2000 to 2999.

You can use the

acl

name

acl-name command to enter the

view of an existing named IPv4

ACL.

Configure a description for the

IPv4 basic ACL

description

text

Optional

By default, an IPv4 basic ACL has

no ACL description.

Set the rule numbering step

step

step-value

Optional

5 by default.

Create or edit a rule

rule

[ rule-id ] {

deny

|

permit

}

[

fragment

|

logging

|

source

{ sour-addr sour-wildcard |

any

} |

time-range

time-range-name |

vpn-instance

vpn-instance-name ] *

Required

By default, an IPv4 basic ACL

does not contain any rule.

To create or edit multiple rules,

repeat this step.

Note that the

logging

and

vpn-instance

keywords are not

supported if the ACL is to be

referenced by a QoS policy for

traffic classification.

Configure or edit a rule description

rule

rule-id

comment

text

Optional

By default, an IPv4 ACL rule has

no rule description.

Note that:

z You can only modify the existing rules of an ACL that uses the rule order of config. When

modifying a rule of such an ACL, you may choose to change just some of the settings, in which

case the other settings remain the same.

z You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an

existing rule in the ACL.

z When the ACL rule order is auto, a newly created rule will be inserted among the existing rules in

the depth-first order. Note that the IDs of the rules still remain the same.

1-8

You can modify the rule order of an ACL with the acl number acl-number [ name acl-name ]

match-order { auto | config } command, but only when the ACL does not contain any rules.

Configuring an IPv6 basic ACL

Follow these steps to configure an IPv6 basic ACL:

To do… Use the command… Remarks

Enter system view

system-view

––

Create an IPv6 basic ACL view

and enter its view

acl ipv6 number

acl6-number

[

name

acl6-name ] [

match-order

{

auto

|

config

} ]

Required

By default, no ACL exists.

IPv6 basic ACLs are numbered in

the range 2000 to 2999.

You can use the

acl

ipv6

name

acl6-name command to enter the

view of an existing named IPv6

ACL.

Configure a description for the

IPv6 basic ACL

description

text

Optional

By default, an IPv6 basic ACL has

no ACL description.

Set the rule numbering step

step

step-value

Optional

5 by default

Create or edit a rule

rule

[ rule-id ] {

deny

|

permit

}

[

fragment

|

logging

|

source

{ ipv6-address prefix-length |

ipv6-address/prefix-length

| any

} |

time-range

time-range-name ] *

Required

By default, an IPv6 basic ACL

does not contain any rule.

To create or edit multiple rules,

repeat this step.

Note that the

logging

and

fragment

keywords are not

supported if the ACL is to be

referenced by a QoS policy for

traffic classification.

Configure or edit a rule description

rule

rule-id

comment

text

Optional

By default, an IPv6 basic ACL rule

has no rule description.

Note that:

1-9

z You can only modify the existing rules of an ACL that uses the rule order of config. When

modifying a rule of such an ACL, you may choose to change just some of the settings, in which

case the other settings remain the same.

z You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an

existing rule in the ACL.

z When the ACL rule order is auto, a newly created rule will be inserted among the existing rules in

the depth-first order. Note that the IDs of the rules still remain the same.

You can modify the rule order of an IPv6 ACL with the acl ipv6 number acl6-number [ name

acl6-name ] match-order { auto | config } command, but only when the ACL does not contain any

rules.

Configuring an Advanced ACL

Configuring an IPv4 advanced ACL

IPv4 advanced ACLs match packets based on source and destination IP addresses, protocols over IP,

and other protocol header information, such as TCP/UDP source and destination port numbers, TCP

flags, ICMP message types, and ICMP message codes.

IPv4 advanced ACLs also allow you to filter packets based on three priority criteria: type of service

(ToS), IP precedence, and differentiated services codepoint (DSCP) priority.

Compared with IPv4 basic ACLs, IPv4 advanced ACLs allow of more flexible and accurate filtering.

Follow these steps to configure an IPv4 advanced ACL:

To do… Use the command… Remarks

Enter system view

system-view

––

Create an IPv4 advanced ACL and

enter its view

acl number

acl-number [

name

acl-name ] [

match-order

{

auto

|

config

} ]

Required

By default, no ACL exists.

IPv4 advanced ACLs are

numbered in the range 3000 to

3999.

You can use the

acl

name

acl-name command to enter the

view of an existing named IPv4

ACL.

Configure a description for the

IPv4 advanced ACL

description

text

Optional

By default, an IPv4 advanced ACL

has no ACL description.

1-10

To do… Use the command… Remarks

Set the rule numbering step

step

step-value

Optional

5 by default.

Create or edit a rule

rule

[ rule-id ] {

deny

|

permit

}

protocol [ {

established

| {

ack

ack-value |

fin

fin-value |

psh

psh-value |

rst

rst-value |

syn

syn-value |

urg

urg-value } * } |

destination

{ dest-addr

dest-wildcard |

any

} |

destination-port

operator port1

[ port2 ] |

dscp

|

fragment

|

icmp-type

{ icmp-type icmp-code |

icmp-message } |

logging

|

precedence

precedence |

reflective

|

source

{ sour-addr

sour-wildcard |

any

} |

source-port

operator port1 [ port2 ] |

time-range

time-range-name |

tos

tos |

vpn-instance

vpn-instance-name

] *

Required

By default, an IPv4 advanced ACL

does not contain any rule.

To create or edit multiple rules,

repeat this step.

Notes that the

reflective

keyword

is not supported.

When an advanced IPv4 ACL is

referenced by a QoS policy for

traffic classification:

z If the QoS policy is applied to

the inbound direction, the

keywords of logging,

vpn-instance, and neq are not

supported.

z If the QoS policy is applied to

the outbound direction, the

keywords of logging,

vpn-instance, gt, lt, neq, and

range are not supported

Configure or edit a rule description

rule

rule-id

comment

text

Optional

By default, an IPv4 ACL rule has

no rule description.

Note that:

z You can only modify the existing rules of an ACL that uses the rule order of config. When

modifying a rule of such an ACL, you may choose to change just some of the settings, in which

case the other settings remain the same.

z You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an

existing rule in the ACL.

z When the ACL rule order is auto, a newly created rule will be inserted among the existing rules in

the depth-first order. Note that the IDs of the rules still remain the same.

Page is loading ...

H3C s5820x series, s5800 series Configuration manual

Related papers

Other documents