H3C S5120-EI Series Ethernet Switches
ACL and QoS
Configuration Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Document Version: 6W102-20100722
Product Version: Release 2202
Copyright © 2009-2010, Hangzhou H3C Technologies Co., Ltd. and its licensors
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H
3
Care,
, TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V
2
G, V
n
G, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners.
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Preface
The H3C S5120-EI documentation set includes 10 configuration guides, which describe the software
features for the S5120-EI Series Ethernet Switches and guide you through the software configuration
procedures. These configuration guides also provide configuration examples to help you apply software
features to different network scenarios.
The ACL and QoS Configuration Guide describes fundamentals and configuration of ACL and QoS. It
describes how to create IPv4 ACL and IPv6 ACL, use ACL for packet filtering, use QoS polices to
control traffic, and configure common QoS techniques such as traffic policing, traffic shaping, and
congestion management.
This preface includes:
z Audience
z Document Organization
z Conventions
z About the H3C S5120-EI Documentation Set
z Obtaining Documentation
z Documentation Feedback
Audience
This documentation set is intended for:
z Network planners
z Field technical support and servicing engineers
z Network administrators working with the S5120-EI series
Document Organization
The ACL and QoS Configuration Guide comprises these parts:
ACL Configuration QoS Overview
QoS Configuration
Approaches
Priority Mapping
Configuration
Traffic Policing, Traffic
Shaping, and Line Rate
Configuration
Congestion Management
Configuration
Traffic Filtering
Configuration
Priority Marking
Configuration
Traffic Redirecting
Configuration
Class-Based Accounting
Configuration
Appendix A Default
Priority Mapping Tables
Appendix B Introduction
to Packet Precedences
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
italic
Italic text represents arguments that you replace with actual values.
Convention Description
[ ]
Square brackets enclose syntax choices (keywords or arguments) that are
optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars,
from which you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical
bars, from which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by
vertical bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by
vertical bars, from which you may select multiple choices or none.
&<1-n>
The argument or keyword and argument combination before the ampersand (&)
sign can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Description
Boldface
Window names, button names, field names, and menu items are in Boldface.
For example, the New User window appears; click OK.
>
Multi-level menus are separated by angle brackets. For example, File > Create
> Folder.
Symbols
Convention Description
Means reader be careful. Improper operation may cause data loss or damage to
equipment.
Means a complementary description.
About the H3C S5120-EI Documentation Set
The H3C S5120-EI documentation set also includes:
Category Documents Purposes
Marketing brochures Describe product specifications and benefits.
Technology white papers
Provide an in-depth description of software features
and technologies.
RPS User Manual
Describes the appearances, features, and
specifications of the RPS units available for the
products.
RPS Ordering Information for
H3C Low-End Ethernet Switches
Provides the RPS and switch compatibility matrix and
RPS cable specifications.
Product
description and
specifications
H3C Low End Series Ethernet
Switches Pluggable Modules
Manual
Describes the models, appearances, and
specifications of the pluggable modules available for
the products.
Category Documents Purposes
Interface Card User Manual
Describes the appearance and specifications of the
interface card.
S5120-EI Series Ethernet
Switches Installation Manual
Provides a complete guide to hardware installation
and hardware specifications.
Provides regulatory information and the safety
instructions that must be followed during installation.
Pluggable SFP[SFP+][XFP]
Transceiver Modules Installation
Guide
Guides you through installing SFP/SFP+/XFP
transceiver modules.
Hardware
installation
Interface Card User Manual Describes how to install the interface card.
Configuration guides
Describe software features and configuration
procedures.
Software
configuration
Command references Provide a quick reference to all available commands.
H3C Series Ethernet Switches
Login Password Recovery
Manual
Tells how to find the lost password or recover the
password when the login password is lost.
Operations and
maintenance
Release notes
Provide information about the product release,
including the version history, hardware and software
compatibility matrix, version upgrade information,
technical support information, and software
upgrading.
Obtaining Documentation
You can access the most up-to-date H3C product documentation on the World Wide Web at
http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies, as well as solutions.
[Technical Support & Documents > Software Download] – Provides the documentation released with
the software version.
Documentation Feedback
You can e-mail your comments about product documentation to [email protected].
We appreciate your comments.
i
Table of Contents
1 ACL Configuration·····································································································································1-1
ACL Overview·········································································································································1-1
Introduction to ACL··························································································································1-1
Application of ACLs on the Switch ··································································································1-2
ACL Classification ···························································································································1-2
ACL Numbering and Naming ··········································································································1-3
Match Order·····································································································································1-3
ACL Rule Numbering Step··············································································································1-4
Implementing Time-Based ACL Rules····························································································1-5
IPv4 Fragments Filtering with ACLs································································································1-5
ACL Configuration Task List ···················································································································1-5
Configuring an ACL·································································································································1-6
Creating a Time Range ···················································································································1-6
Configuring a Basic ACL ·················································································································1-6
Configuring an Advanced ACL········································································································1-9
Configuring an Ethernet Frame Header ACL················································································1-12
Copying an ACL ····························································································································1-13
Applying an ACL for Packet Filtering·····························································································1-14
Displaying and Maintaining ACLs·········································································································1-15
ACL Configuration Examples················································································································1-16
IPv4 ACL Application Configuration Example···············································································1-16
IPv6 ACL Application Configuration Example···············································································1-17
2 QoS Overview ············································································································································2-1
Introduction to QoS·································································································································2-1
Introduction to QoS Service Models ·······································································································2-1
Best-Effort Service Model················································································································2-1
IntServ Service Model ·····················································································································2-1
DiffServ Service Model····················································································································2-2
QoS Techniques Overview·····················································································································2-2
Positions of the QoS Techniques in a Network···············································································2-2
3 QoS Configuration Approaches···············································································································3-1
QoS Configuration Approach Overview··································································································3-1
Non Policy-Based Configuration ·····································································································3-1
Policy-Based Configuration·············································································································3-1
Configuring a QoS Policy························································································································3-1
Defining a Class ······························································································································3-2
Defining a Traffic Behavior··············································································································3-4
Defining a Policy······························································································································3-5
Applying the QoS Policy··················································································································3-5
Displaying and Maintaining QoS Policies························································································3-8
ii
4 Priority Mapping Configuration················································································································4-1
Priority Mapping Overview······················································································································4-1
Introduction to Priority Mapping·······································································································4-1
Priority Mapping Tables···················································································································4-1
Priority Trust Mode on a Port ··········································································································4-2
Priority Mapping Procedure·············································································································4-2
Priority Mapping Configuration Tasks·····································································································4-3
Configuring Priority Mapping···················································································································4-4
Configuring a Priority Mapping Table······························································································4-4
Configuring the Priority Trust Mode on a Port·················································································4-4
Configuring the Port Priority of a Port······························································································4-5
Displaying and Maintaining Priority Mapping··························································································4-6
Priority Mapping Configuration Examples·······························································································4-6
Priority Mapping Table and Priority Marking Configuration Example··············································4-6
5 Traffic Policing, Traffic Shaping, and Line Rate Configuration····························································5-1
Traffic Policing and Line Rate Overview·································································································5-1
Traffic Evaluation and Token Buckets·····························································································5-1
Traffic Policing·································································································································5-2
Traffic Shaping ································································································································5-3
Line Rate·········································································································································5-4
Configuring Traffic Policing·····················································································································5-4
Configuration Procedure··················································································································5-4
Configuration Example····················································································································5-5
Configuring GTS ·····································································································································5-6
Configuration Procedure··················································································································5-6
Configuration Example····················································································································5-6
Configuring the Line Rate·······················································································································5-6
Configuration Procedure··················································································································5-6
Configuration Example····················································································································5-7
Displaying and Maintaining Traffic Policing, GTS, and Line Rate ··························································5-7
6 Congestion Management Configuration·································································································6-1
Congestion Management Overview········································································································6-1
Causes, Impacts, and Countermeasures of Congestion·································································6-1
Congestion Management Policies···································································································6-2
Congestion Management Configuration Approaches·············································································6-4
Configuring Congestion Management····································································································6-5
Configuring SP Queuing··················································································································6-5
Configure WRR Queuing·················································································································6-6
Configuring WFQ Queuing··············································································································6-7
Configuring SP+WRR Queues········································································································6-8
Configuration Example····················································································································6-8
Displaying and Maintaining Congestion Management············································································6-9
7 Traffic Filtering Configuration··················································································································7-1
Traffic Filtering Overview ························································································································7-1
Configuring Traffic Filtering·····················································································································7-1
iii
Traffic Filtering Configuration Example···································································································7-2
Traffic Filtering Configuration Example···························································································7-2
8 Priority Marking Configuration·················································································································8-1
Priority Marking Overview·······················································································································8-1
Configuring Priority Marking····················································································································8-1
Priority Marking Configuration Example··································································································8-2
Priority Marking Configuration Example··························································································8-2
9 Traffic Redirecting Configuration············································································································9-1
Traffic Redirecting Overview···················································································································9-1
Traffic Redirecting ···························································································································9-1
Configuring Traffic Redirecting ···············································································································9-1
10 Class-Based Accounting Configuration······························································································10-1
Class-Based Accounting Overview·······································································································10-1
Configuring Class-Based Accounting ···································································································10-1
Displaying and Maintaining Traffic Accounting·····················································································10-2
Class-Based Accounting Configuration Example·················································································10-2
Class-Based Accounting Configuration Example··········································································10-2
11 Appendix A Default Priority Mapping Tables ·····················································································11-1
12 Appendix B Introduction to Packet Precedences··············································································12-1
IP Precedence and DSCP Values ········································································································12-1
802.1p Priority·······································································································································12-2
13 Index ·······················································································································································13-1
1-1
1 ACL Configuration
This chapter includes these sections:
z ACL Overview
z ACL Configuration Task List
z Configuring an ACL
z Creating a Time Range
z Configuring a Basic ACL
z Configuring an Advanced ACL
z Configuring an Ethernet Frame Header ACL
z Copying an ACL
z Displaying and Maintaining ACLs
z ACL Configuration Examples
Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document.
ACL Overview
This section covers these topics:
z Introduction to ACL
z Application of ACLs on the Switch
z ACL Classification
z ACL Numbering and Naming
z Match Order
z Implementing Time-Based ACL Rules
z IPv4 Fragments Filtering with ACLs
Introduction to ACL
As network scale and network traffic are increasingly growing, network security and bandwidth
allocation become more and more critical to network management. Packet filtering can be used to
efficiently prevent illegal users from accessing networks and to control network traffic and save
network resources. Access control lists (ACL) are often used to filter packets with configured matching
rules.
1-2
ACLs are sets of rules (or sets of permit or deny statements) that decide what packets can pass and
what should be rejected based on matching criteria such as source MAC address, destination MAC
address, source IP address, destination IP address, and port number.
Application of ACLs on the Switch
The switch supports two ACL application modes:
z Hardware-based application: An ACL is assigned to a piece of hardware. For example, an ACL
can be referenced by QoS for traffic classification. Note that when an ACL is referenced to
implement QoS, the actions defined in the ACL rules, deny or permit, do not take effect; actions to
be taken on packets matching the ACL depend on the traffic behavior definition in QoS. For details
about traffic behavior, see QoS Configuration Approaches in the ACL and QoS Configuration
Guide.
z Software-based application: An ACL is referenced by a piece of upper layer software. For
example, an ACL can be referenced to configure login user control behavior, thus controlling
Telnet, SNMP and Web users. Note that when an ACL is reference by the upper layer software,
actions to be taken on packets matching the ACL depend on those defined by the ACL rules. For
details about login user control, see User Login Control in the Fundamentals Configuration Guide.
z When an ACL is assigned to a piece of hardware and referenced by a QoS policy for traffic
classification, the switch does not take action according to the traffic behavior definition on a
packet that does not match the ACL.
z When an ACL is referenced by a piece of software to control Telnet, SNMP, and Web login users,
the switch denies all packets that do not match the ACL.
z For details of ACL application for packet filtering, see Applying an ACL for Packet Filtering.
ACL Classification
ACLs fall into three categories, as shown in Table 1-1.
Table 1-1 ACL categories
Category ACL number IP version Match criteria
IPv4 Source IPv4 address
Basic ACLs 2000 to 2999
IPv6 Source IPv6 address
Advanced ACLs 3000 to 3999
IPv4
Source/destination IPv4 address, protocols over
IPv4, and other Layer 3 and Layer 4 header
fields
1-3
Category ACL number IP version Match criteria
IPv6
Source/destination IPv6 address, protocols over
IPv6, and other Layer 3 and Layer 4 header
fields
Ethernet frame
header ACLs
4000 to 4999 IPv4 and IPv6
Layer 2 header fields, such as source and
destination MAC addresses, 802.1p priority,
and link layer protocol type
ACL Numbering and Naming
Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a
number for identification, and in addition, you can also assign the ACL a name for the ease of
identification. After creating an ACL with a name, you can neither rename it nor delete its name.
For an Ethernet frame header ACL, the ACL number and name must be globally unique. For an IPv4
basic or advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and for an
IPv6 basic or advanced ACL, among all IPv6 ACLs. You can assign an IPv4 ACL and an IPv6 ACL the
same number and name.
Match Order
The rules in an ACL are sorted in a certain order. When a packet matches a rule, the device stops the
match process and performs the action defined in the rule. If an ACL contains overlapping or
conflicting rules, the matching result and action to take depend on the rule order.
Two ACL match orders are available:
z config: Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a
rule with a higher ID. If you use this approach, check the rules and their order carefully.
z auto: Sorts ACL rules in depth-first order, as described in Table 1-2. The depth-first order varies
with ACL categories.
Table 1-2 Sorting ACL rules in depth-first order
ACL category Depth-first rule sorting procedures
IPv4 basic ACL
1) A rule with more 0s in the source IP address wildcard mask takes precedence.
More 0s means a narrower IP address range.
2) A rule with a smaller ID takes precedence.
IPv4 advanced ACL
1) A rule configured with a specific protocol is prior to a rule with the protocol type set
to IP. IP represents any protocol over IP.
2) A rule with more 0s in the source IP address wildcard mask takes precedence.
More 0s means a narrower IP address range.
3) A rule with more 0s in the destination IP address wildcard mask takes
precedence.
4) A rule with a narrower TCP/UDP service port number range takes precedence.
5) A rule with a smaller ID takes precedence.
1-4
ACL category Depth-first rule sorting procedures
IPv6 basic ACL
1) A rule configured with a longer prefix for the source IP address takes precedence.
A longer prefix means a narrower IP address range.
2) A rule with a smaller ID takes precedence.
IPv6 advanced ACL
1) A rule configured with a specific protocol is prior to a rule with the protocol type set
to IP. IP represents any protocol over IPv6.
2) A rule configured with a longer prefix for the source IPv6 address has a higher
priority.
3) A rule configured with a longer prefix for the destination IPv6 address takes
precedence.
4) A rule with a narrower TCP/UDP service port number range takes precedence.
5) A rule with a smaller ID takes precedence.
Ethernet frame
header ACL
1) A rule with more 1s in the source MAC address mask takes precedence. More 1s
means a smaller MAC address.
2) A rule with more 1s in the destination MAC address mask takes precedence.
3) A rule with a smaller ID takes precedence.
A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal
notation. In contrast to a network mask, the 0 bits in a wildcard mask represent ‘do care’ bits, while the
1 bits represent 'don’t care bits'. If the 'do care' bits in an IP address identical to the 'do care' bits in an
IP address criterion, the IP address matches the criterion. All 'don’t care' bits are ignored. The 0s and
1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask. With
wildcard masks, you can create more granular match criteria than network masks.
ACL Rule Numbering Step
What is the ACL rule numbering step
If you do not assign an ID for the rule you are creating, the system automatically assigns it a rule ID.
The rule numbering step sets the increment by which the system numbers rules automatically. For
example, the default ACL rule numbering step is 5. If you do assign IDs to rules you are creating, they
are numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can insert
between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of
inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are
matched in ascending order of rule ID.
Automatic rule numbering and re-numbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step
to the current highest rule ID, starting with 0.
1-5
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10,
and 12, the newly defined rule will be numbered 15. If the ACL does not contain any rule, the first rule
will be numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five
rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be
renumbered 0, 2, 4, 6 and 8.
Likewise, after you restore the default step, ACL rules are renumbered in the default step. Assume that
there are four ACL rules numbered 0, 2, 4, and 6 in steps of 2. When the default step is restored, the
rules are renumbered 0, 5, 15, and 15.
Implementing Time-Based ACL Rules
You can implement ACL rules based on the time of day by applying a time range to them. A time-based
ACL rule takes effect only in any time periods specified by the time range.
Two basic types of time range are available:
z Periodic time range, which recurs periodically on a day or days of the week.
z Absolute time range, which represents only a period of time and does not recur.
You may apply a time range to ACL rules before or after you create it. However, the rules using the
time range can take effect only after you define the time range.
IPv4 Fragments Filtering with ACLs
Traditional packet filtering matched only first fragments of IPv4 packets, and allowed all subsequent
non-first fragments to pass through. This mechanism resulted in security risks, because attackers may
fabricate non-first fragments to attack networks.
As for the configuration of a rule of an IPv4 ACL, the fragment keyword specifies that the rule applies
to non-first fragment packets only, and does not apply to non-fragment packets or the first fragment
packets. ACL rules that do not contain this keyword is applicable to both non-fragment packets and
fragment packets.
ACL Configuration Task List
IPv4 configuration task list
Complete the following tasks to configure an IPv4 ACL:
Task Remarks
Creating a Time Range Optional
Configuring an IPv4 basic ACL
Configuring an IPv4 advanced ACL
Configuring an Ethernet Frame Header ACL
Required
Configure at least one task
Copying an IPv4 ACL Optional
Applying an IPv4 ACL for Packet Filtering Optional
1-6
IPv6 ACL configuration task list
Complete the following tasks to configure an IPv6 ACL:
Task Remarks
Creating a Time Range Optional
Configuring an IPv6 basic ACL
Configuring an IPv6 Advanced ACL
Configuring an Ethernet Frame Header ACL
Required
Configure at least one task
Copying an IPv6 ACL Optional
Applying an IPv6 ACL for Packet Filtering Optional
Configuring an ACL
Creating a Time Range
Follow these steps to create a time range:
To do… Use the command… Remarks
Enter system view
system-view
––
Create a time range
time-range
time-range-name
{ start-time
to
end-time days
[
from
time1 date1 ] [
to
time2
date2 ] |
from
time1 date1 [
to
time2 date2 ] |
to
time2 date2 }
Required
By default, no time range exists.
You may create time ranges identified with the same name. They are regarded as one time range
whose active period is the result of ORing periodic ones, ORing absolute ones, and ANDing periodic
and absolute ones.
You may create a maximum of 256 uniquely named time ranges, each with 32 periodic time ranges at
most and 12 absolute time ranges at most.
Configuring a Basic ACL
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based on only source IP address.
Follow these steps to configure an IPv4 basic ACL:
To do… Use the command… Remarks
Enter system view
system-view
––
1-7
To do… Use the command… Remarks
Create an IPv4 basic ACL and
enter its view
acl number
acl-number [
name
acl-name ] [
match-order
{
auto
|
config
} ]
Required
By default, no ACL exists.
IPv4 basic ACLs are numbered in
the range 2000 to 2999.
You can use the
acl
name
acl-name command to enter the
view of an existing named IPv4
ACL.
Configure a description for the
IPv4 basic ACL
description
text
Optional
By default, an IPv4 basic ACL has
no ACL description.
Set the rule numbering step
step
step-value
Optional
5 by default.
Create or edit a rule
rule
[ rule-id ] {
deny
|
permit
}
[
fragment
|
logging
|
source
{ sour-addr sour-wildcard |
any
} |
time-range
time-range-name ] *
Required
By default, an IPv4 basic ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
Note that the
logging
keyword is
not supported if the ACL is to be
referenced by a QoS policy for
traffic classification.
Configure or edit a rule description
rule
rule-id
comment
text
Optional
By default, an IPv4 ACL rule has
no rule description.
Note that:
z You can only modify the existing rules of an ACL that uses the match order of config. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z When the ACL match order is auto, a newly created rule will be inserted among the existing rules
in the depth-first match order. Note that the IDs of the rules still remain the same.
1-8
You can modify the match order of an ACL with the acl number acl-number [ name acl-name ]
match-order { auto | config } command but only when it does not contain any rules.
Configuring an IPv6 basic ACL
Follow these steps to configure an IPv6 basic ACL:
To do… Use the command… Remarks
Enter system view
system-view
––
Create an IPv6 basic ACL view
and enter its view
acl ipv6 number
acl6-number
[
name
acl6-name ] [
match-order
{
auto
|
config
} ]
Required
By default, no ACL exists.
IPv6 basic ACLs are numbered in
the range 2000 to 2999.
You can use the
acl
ipv6
name
acl6-name command to enter the
view of an existing named IPv6
ACL.
Configure a description for the
IPv6 basic ACL
description
text
Optional
By default, an IPv6 basic ACL has
no ACL description.
Set the rule numbering step
step
step-value
Optional
5 by default
Create or edit a rule
rule
[ rule-id ] {
deny
|
permit
}
[
fragment
|
logging
|
source
{ ipv6-address prefix-length |
ipv6-address/prefix-length
| any
} |
time-range
time-range-name ]*
Required
By default, an IPv6 basic ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
Note that the
logging
and
fragment
keywords are not
supported if the ACL is to be
referenced by a QoS policy for
traffic classification.
Configure or edit a rule description
rule
rule-id
comment
text
Optional
By default, an IPv6 basic ACL rule
has no rule description.
Note that:
1-9
z You can only modify the existing rules of an ACL that uses the match order of config. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z When the ACL match order is auto, a newly created rule will be inserted among the existing rules
in the depth-first match order. Note that the IDs of the rules still remain the same.
You can modify the match order of an IPv6 ACL with the acl ipv6 number acl6-number [ name
acl6-name ] match-order { auto | config } command but only when it does not contain any rules.
Configuring an Advanced ACL
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on source and destination IP addresses, protocols over IP,
and other protocol header information, such as TCP/UDP source and destination port numbers, TCP
flags, ICMP message types, and ICMP message codes.
IPv4 advanced ACLs also allow you to filter packets based on three priority criteria: type of service
(ToS), IP precedence, and differentiated services codepoint (DSCP) priority.
Compared with IPv4 basic ACLs, IPv4 advanced ACLs allow of more flexible and accurate filtering.
Follow these steps to configure an IPv4 advanced ACL:
To do… Use the command… Remarks
Enter system view
system-view
––
Create an IPv4 advanced ACL and
enter its view
acl number
acl-number [
name
acl-name ] [
match-order
{
auto
|
config
} ]
Required
By default, no ACL exists.
IPv4 advanced ACLs are
numbered in the range 3000 to
3999.
You can use the
acl
name
acl-name command to enter the
view of an existing named IPv4
ACL.
Configure a description for the
IPv4 advanced ACL
description
text
Optional
By default, an IPv4 advanced ACL
has no ACL description.
Set the rule numbering step
step
step-value
Optional
5 by default.
1-10
To do… Use the command… Remarks
Create or edit a rule
rule
[ rule-id ] {
deny
|
permit
}
protocol [ {
established
| {
ack
ack-value |
fin
fin-value |
psh
psh-value |
rst
rst-value |
syn
syn-value |
urg
urg-value } * } |
destination
{ dest-addr
dest-wildcard |
any
} |
destination-port
operator port1
[ port2 ] |
dscp
dscp
|
fragment
|
icmp-type
{ icmp-type icmp-code |
icmp-message } |
logging
|
precedence
precedence |
reflective
|
source
{ sour-addr
sour-wildcard |
any
} |
source-port
operator port1 [ port2 ] |
time-range
time-range-name |
tos
tos ] *
Required
By default, an IPv4 advanced ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
Notes that the
reflective
keyword
is not supported.
Note that if the ACL is to be
referenced by a QoS policy for
traffic classification, the
logging
keyword is not supported and the
operator argument cannot be
neq
.
Configure or edit a rule description
rule
rule-id
comment
text
Optional
By default, an IPv4 ACL rule has
no rule description.
Note that:
z You can only modify the existing rules of an ACL that uses the match order of config. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z When the ACL match order is auto, a newly created rule will be inserted among the existing rules
in the depth-first match order. Note that the IDs of the rules still remain the same.
You can modify the match order of an ACL with the acl number acl-number [ name acl-name ]
match-order { auto | config } command but only when it does not contain any rules.
Configuring an IPv6 Advanced ACL
IPv6 advanced ACLs match packets based on the source IPv6 address, destination IPv6 address,
protocol carried over IPv6, and other protocol header fields such as the TCP/UDP source port number,
TCP/UDP destination port number, ICMP message type, and ICMP message code.
Compared with IPv6 basic ACLs, they allow of more flexible and accurate filtering.
1-11
Follow these steps to configure an IPv6 advanced ACL:
To do… Use the command… Remarks
Enter system view
system-view
––
Create an IPv6 advanced ACL
and enter its view
acl ipv6
number
acl6-number [
name
acl6-name ] [
match-order
{
auto
|
config
} ]
Required
By default, no ACL exists.
IPv6 advanced ACLs are
numbered in the range 3000 to
3999.
You can use the
acl
ipv6
name
acl6-name command to enter
the view of an existing named
IPv6 ACL.
Configure a description for the
IPv6 advanced ACL
description
text
Optional
By default, an IPv6 advanced
ACL has no ACL description.
Set the rule numbering step
step
step-value
Optional
5 by default.
Create or edit a rule
rule
[ rule-id ] {
deny
|
permit
} protocol
[ {
established
| {
ack
ack-value |
fin
fin-value |
psh
psh-value |
rst
rst-value |
syn
syn-value |
urg
urg-value } * } |
destination
{ dest dest-prefix |
dest/dest-prefix |
any
} |
destination-port
operator port1 [ port2 ]
|
dscp
dscp |
fragment
|
icmpv6-type
{ icmpv6-type icmpv6-code |
icmpv6-message } |
logging
|
source
{ source source-prefix |
source/source-prefix
| any
} |
source-port
operator port1 [ port2 ] |
time-range
time-range-name ] *
Required
By default IPv6 advanced ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
Note that if the ACL is to be
referenced by a QoS policy for
traffic classification, the
logging
and
fragment
keywords are not
supported and the operator
argument cannot be
neq
.
Configure or edit a rule
description
rule
rule-id
comment
text
Optional
By default, an IPv6 ACL rule has
no rule description.
1-12
Note that:
z You can only modify the existing rules of an ACL that uses the match order of config. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which
case the other settings remain the same.
z You cannot create a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
z When the ACL match order is auto, a newly created rule will be inserted among the existing rules
in the depth-first match order. Note that the IDs of the rules still remain the same.
You can modify the match order of an IPv6 ACL with the acl ipv6 number acl6-number [ name
acl6-name ] match-order { auto | config } command but only when it does not contain any rules.
Configuring an Ethernet Frame Header ACL
Ethernet frame header ACLs, also called Layer 2 ACLs, match packets based on Layer 2 protocol
header fields such as source MAC address, destination MAC address, 802.1p priority (VLAN priority),
and link layer protocol type.
Follow these steps to configure an Ethernet frame header ACL:
To do… Use the command… Remarks
Enter system view
system-view ––
Create an Ethernet frame header
ACL and enter its view
acl number
acl-number [
name
acl-name ] [
match-order
{
auto
|
config
} ]
Required
By default, no ACL exists.
Ethernet frame header ACLs are
numbered in the range 4000 to
4999.
You can use the
acl
name
acl-name command to enter the
view of an existing named
Ethernet frame header ACL.
Configure a description for the
Ethernet frame header ACL
description
text
Optional
By default, an Ethernet frame
header ACL has no ACL
description.
Set the rule numbering step
step
step-value
Optional
5 by default.
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
/