H3C WX Series User manual

H3C WX Series Access Controllers
ACL and QoS Configuration Guide
Abstract
This document describes ACL and QoS configurations. You can use ACL or other match
criteria to classify traffic in your network, and implement flow control based on traffic
classes. With ACL and QoS, you can well allocate the limited network resources, and
improve network usage. The intended audience includes network planners, field
technical support and servicing engineers, and network administrators working with the
WX series.
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com

2
Copyright © 2009-2010, Hangzhou H3C Technologies Co., Ltd. and its licensors
No part of this manual may be reproduced or transmitted in any form or by any means
without prior written consent of Hangzhou H3C Technologies Co., Ltd.
The information in this document is subject to change without notice. Every effort has
been made in the preparation of this document to ensure accuracy of the contents.
However, the statements, information, and recommendations in this document do not
constitute a warranty of any kind, express or implied. Hangzhou H3C Technologies Co.,
Ltd. and its licensors shall not be liable for technical or editorial errors or omissions
contained herein.
Acknowledgments
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean,
NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA,
VVG, V2G, VnG, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of
Hangzhou H3C Technologies Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their
respective owners.

3
Contents
1ACL configuration ·············································································································· 8
ACL classification ·························································································································8
ACL numbering and naming·········································································································8
Match order ································································································································9
ACL rule numbering···················································································································· 11
ACL rule numbering step ········································································································ 11
Automatic rule numbering and re-numbering·········································································· 11
Implementing time-based ACL rules ···························································································· 11
IPv4 fragments filtering with ACLs································································································· 12
ACL configuration task list ··········································································································· 12
IPv4 ACL configuration task list································································································ 12
IPv6 ACL configuration task list································································································ 12
Configuring an ACL ···················································································································· 13
Creating a time range ··········································································································· 13
Configuring a WLAN ACL ······································································································· 13
Configuring a basic ACL ········································································································ 14
Configuring an advanced ACL······························································································· 16
Configuring an Ethernet frame header ACL············································································· 18
Copying an ACL···················································································································· 19
Displaying and maintaining ACLs································································································· 20
ACL configuration examples ······································································································· 21
IPv4 ACL configuration example ····························································································· 21
IPv6 ACL configuration example ····························································································· 22
2QoS overview ···················································································································24
QoS service models ···················································································································· 24
Best-effort service model ········································································································ 24

4
IntServ model ························································································································ 25
DiffServ model ······················································································································· 25
QoS techniques ························································································································· 25
Applying QoS techniques in a network ···················································································· 26
QoS processing flow in an AC ································································································· 27
3QoS configuration approaches ··························································································28
Non-policy approach ················································································································· 28
Policy approach ························································································································ 28
Configuring a QoS policy ············································································································ 28
Defining a class ····················································································································· 29
Defining a traffic behavior······································································································ 30
Defining a policy ··················································································································· 31
Applying the QoS policy········································································································· 32
Displaying and maintaining QoS policies ················································································· 34
4Priority mapping configuration ···························································································35
Priority mapping overview··········································································································· 35
Priority mapping tables ··············································································································· 35
Priority mapping configuration tasks ···························································································· 37
Configuring priority mapping······································································································· 38
Configuring a priority mapping table ······················································································ 38
Configuring a port to trust packet priority for priority mapping··················································· 39
Configuring the port priority of a port ······················································································ 39
Displaying and maintaining priority mapping················································································ 40
Priority mapping configuration examples (on WX Series access controllers)····································· 41
Trusted priority type configuration example ············································································· 42
Port priority configuration example ························································································· 43
5Traffic policing and line rate configuration ···········································································45
Traffic evaluation and token bucket ···························································································· 45
Token bucket features ··········································································································· 45
Evaluating traffic with the token bucket ·················································································· 45

5
Complicated evaluation ········································································································ 46
Traffic policing ··························································································································· 46
Line rate ···································································································································· 47
Configuration task list·················································································································· 48
Configuring traffic policing·········································································································· 48
Configuring traffic policing in policy-based approach······························································ 49
Configuring traffic policing in non policy-based approach ······················································· 49
Configuring line rate ··················································································································· 50
Displaying and maintaining line rate ···························································································· 51
6Congestion management configuration ·············································································52
Causes, impacts, and countermeasures of congestion ································································· 52
Congestion management policies ······························································································ 53
FIFO ······································································································································ 53
Priority queuing······················································································································ 54
Custom queuing···················································································································· 55
Congestion management technology comparison ······································································ 55
Configuring PQ ·························································································································· 56
PQ configuration procedure··································································································· 57
PQ configuration example on WX5002 ···················································································· 58
PQ configuration example (on any H3C WX access controllers but WX5002) ······························ 60
Configuring CQ·························································································································· 60
Configuration procedure ······································································································· 61
CQ configuration example on WX5002···················································································· 62
CQ configuration example (on any H3C WX access controllers but WX5002) ····························· 62
7Support and other resources ······························································································64
Related documentation ············································································································· 64
Contact us································································································································· 64
Documentation feedback ·········································································································· 64
Technical support······················································································································· 64
Typographical conventions and symbols ····················································································· 65

6
Command conventions ········································································································· 65
Document conventions·········································································································· 65
Symbols ································································································································ 66
Index 67

7
NOTE:
The models listed in this document are not applicable to all regions. Please consult your local
sales office for the models applicable to your region.
Support of the H3C WX series access controllers (ACs) for features may vary by AC model. For
more information, see ―Feature Matrix‖ in About the WX Configuration Guides.
The interface types and the number of interfaces vary by AC model.

8
1ACL configuration
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying
traffic based on criteria such as the source IP address, destination IP address, and port
number.
ACLs are essentially used for packet filtering. A packet filter drops packets that match a
deny rule and permits packets that match a permit rule. ACLs are also widely used by
many modules, for example, QoS and IP routing, for traffic identification.
NOTE:
Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document.
ACL classification
ACLs fall into four categories, as shown in Table 1 .
Table 1 ACL categories
Category
ACL number
IP version
Match criteria
WLAN ACLs
100 to 199
IPv4
Wireless client SSID
Basic ACLs
2000 to 2999
IPv4
Source IPv4 address
IPv6
Source IPv6 address
Advanced
ACLs
3000 to 3999
IPv4
Source/destination IPv4 address,
protocols over IPv4, and other Layer 3
and Layer 4 header fields
IPv6
Source/destination IPv6 address,
protocols over IPv6, and other Layer 3
and Layer 4 header fields
Ethernet
frame header
ACLs
4000 to 4999
IPv4
Layer 2 header fields, such as source
and destination MAC addresses, 802.1p
priority, and link layer protocol type
ACL numbering and naming
Each ACL category has a unique range of ACL numbers. When creating an ACL, you
must assign it a number for identification, and in addition, you can also assign the ACL a

9
name for the ease of identification. After creating an ACL with a name, you can neither
rename it nor delete its name.
You cannot assign a name for a WLAN ACL.
For a WLAN ACL, the ACL number and name must be globally unique. For an IPv4 basic
or advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and
for an IPv6 basic or advanced ACL, among all IPv6 ACLs. You can assign an IPv4 ACL
the same number and name as an IPv6 ACL.
Match order
The rules in an ACL are sorted in certain order. When a packet matches a rule, the
device stops the match process and performs the action defined in the rule. If an ACL
contains overlapping or conflicting rules, the matching result and action to take
depend on the rule order.
Two ACL match orders are available:
config: Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is
matched before a rule with a higher ID. If you use this approach, check rule
content and order carefully.
auto: Sorts ACL rules in depth-first order. Depth-first ordering ensures that any subset
of a rule is always matched before the rule. The depth-first ordering procedure
varies with ACL categories, as shown in Table 2 .
NOTE:
The rule order of WLAN ACLs can only be config.
Table 2 Sorting ACL rules in depth-first order
ACL category
Depth-first rule sorting procedures
IPv4 basic ACL
1. The rule configured with a VPN instance takes precedence.
2. The rule with more 0s in the source IP address wildcard mask takes
precedence. More 0s means a narrower IP address range.
3. The rule with a smaller rule ID takes precedence.

10
ACL category
Depth-first rule sorting procedures
IPv4 advanced
ACL
1. The rule configured with a VPN instance takes precedence.
2. The rule configured with a specific protocol is prior to a rule with the
protocol type set to IP. IP represents any protocol over IP.
3. The rule with more 0s in the source IP address wildcard mask takes
precedence. More 0s means a narrower IP address range.
4. The rule with more 0s in the destination IP address wildcard mask takes
precedence.
5. The rule with a narrower TCP/UDP service port number range takes
precedence.
6. The rule with a smaller ID takes precedence.
IPv6 basic ACL
1. The rule configured with a longer prefix for the source IP address takes
precedence. A longer prefix means a narrower IP address range.
2. The rule with a smaller ID takes precedence.
IPv6 advanced
ACL
1. The rule configured with a specific protocol is prior to a rule with the
protocol type set to IP. IP represents any protocol over IPv6.
2. The rule configured with a longer prefix for the source IPv6 address has a
higher priority.
3. The rule configured with a longer prefix for the destination IPv6 address
takes precedence.
4. The rule with a narrower TCP/UDP service port number range takes
precedence.
5. The rule with a smaller ID takes precedence.
Ethernet frame
header ACL
1. The rule with more 1s in the source MAC address mask takes precedence.
More 1s means a smaller MAC address.
2. The rule with more 1s in the destination MAC address mask takes
precedence.
3. The rule with a smaller ID takes precedence.
NOTE:
Currently, the AC does not support ACL rules with the VPN instance attribute.
A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted
decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent ‗do
care‘ bits, while the 1 bits represent 'don‘t care bits.' If the 'do care' bits in an IP address are
identical to the 'do care' bits in an IP address criterion, the IP address matches the criterion. All
'don‘t care' bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For
example, 0.255.0.255 is a valid wildcard mask.