H3C S5120-EI Series User manual
H3C S5120-EI Switch Series
ACL and QoS Configuration Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: Release 2220
Document version: 6W100-20130810
Copyright © 2013, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , H3CS, H3CIE, H3CNE, Aolynk, , H3Care, , IRF, NetPilot, Netflow,
SecEngine, SecPath, SecCenter, SecBlade, Comware, ITCMM and HUASAN are trademarks of
Hangzhou H3C Technologies Co., Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.
Preface
The H3C S5120-EI documentation set includes 10 configuration guides, which describe the software
features for the H3C S5120-EI Switch Series Release 2220, and guide you through the software
configuration procedures. These configuration guides also provide configuration examples to help you
apply software features to different network scenarios.
The ACL and QoS Configuration Guide describes fundamentals and configuration of ACL and QoS. It
describes how to create IPv4 ACL and IPv6 ACL, use ACL for packet filtering, use QoS polices to control
traffic, and configure common QoS techniques such as traffic policing, traffic shaping, and congestion
management.
This preface includes:
•Audience
•Added and modified features
•Conventions
•About the S5120-EI documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners
•Field technical support and servicing engineers
•Network administrators working with the S5120-EI series
Added and modified features
None
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
Convention Descri
p
tion
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Convention Descri
p
tion
< > Button names are inside angle brackets. For example, click <OK>.
[ ] Window names, menu items, data table and field names are inside square brackets. For
example, pop up the [New User] window.
/ Multi-level menus are separated by forward slashes. For example, [File/Create/Folder].
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.
Network topology icons
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.
About the S5120-EI documentation set
The H3C S5120-EI documentation set includes:
Cate
g
or
y
Documents
Pur
p
oses
Product description and
specifications
Marketing brochure Describe product specifications and benefits.
Technology white papers
Provide an in-depth description of software features
and technologies.
Hardware specifications
and installation
Compliance and safety
manual
CE DOCs
Provide regulatory information and the safety
instructions that must be followed during installation.
Quick start Guides you through initial installation and setup
procedures to help you quickly set up your device.
Installation guide Provides a complete guide to switch installation and
specifications.
RPS Ordering Information
for H3C Low-End Ethernet
Switches
Helps you order RPSs for switches that can work with
an RPS.
User manuals for RPSs Describe the specifications, installation, and
replacement of RPSs.
User manuals for interface
cards
Describe the specifications, installation, and
replacement of expansion interface cards.
H3C Low End Series
Ethernet Switches
Pluggable Modules
Manual
Describes the specifications of pluggable transceiver
modules.
Pluggable SFP[SFP+][XFP]
Transceiver Modules
Installation Guide
Describe the installation, and replacement of
SFP/SFP+/XFP transceiver modules.
Software configuration
Configuration guides Describe software features and configuration
procedures.
Command references Provide a quick reference to all available
commands.
Operations and
maintenance Release notes
Provide information about the product release,
including the version history, hardware and software
compatibility matrix, version upgrade information,
technical support information, and software
upgrading.
Obtaining documentation
You can access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies, as well as solutions.
[Technical Support & Documents > Software Download] – Provides the documentation released with the
software version.
Technical support
servi[email protected]
http://www.h3c.com
Documentation feedback
We appreciate your comments.
i
Contents
Configuring ACLs························································································································································· 1
Overview············································································································································································1
Applications on the switch ······································································································································1
ACL categories ·························································································································································1
Numbering and naming ACLs ································································································································1
Match order ······························································································································································2
ACL rule comments and rule range remarks ·········································································································2
ACL rule numbering ·················································································································································3
Fragments filtering with ACLs··································································································································3
ACL configuration task list················································································································································3
Configuring a time range·················································································································································4
Configuring a basic ACL··················································································································································4
Configuring an IPv4 basic ACL ······························································································································4
Configuring an IPv6 basic ACL ······························································································································5
Configuring an advanced ACL········································································································································6
Configuring an IPv4 advanced ACL·······················································································································6
Configuring an IPv6 advanced ACL·······················································································································7
Configuring an Ethernet frame header ACL···················································································································8
Copying an ACL ·······························································································································································9
Copying an IPv4 ACL ··············································································································································9
Copying an IPv6 ACL ··········································································································································· 10
Configuring packet filtering with ACLs ························································································································ 10
Applying an IPv4 or Ethernet frame header ACL for packet filtering ······························································ 10
Applying an IPv6 ACL for packet filtering ·········································································································· 11
Displaying and maintaining ACLs································································································································ 11
Configuration example of using ACL for device management ················································································· 12
Network requirements··········································································································································· 12
Configuration procedure ······································································································································ 12
IPv4 packet filtering configuration example················································································································ 13
Network requirements··········································································································································· 13
Configuration procedure ······································································································································ 13
IPv6 packet filtering configuration example················································································································ 14
Network requirements··········································································································································· 14
Configuration procedure ······································································································································ 14
QoS overview·····························································································································································16
QoS service models ······················································································································································· 16
Best-effort service model ······································································································································· 16
IntServ model ························································································································································· 16
DiffServ model ······················································································································································· 16
QoS techniques ······························································································································································ 17
QoS configuration approaches·································································································································18
MQC approach ····························································································································································· 18
Non-MQC approach ····················································································································································· 18
Configuring a QoS policy·········································································································································19
Overview········································································································································································· 19
Defining a class······························································································································································ 19
Configuration restrictions and guidelines ··········································································································· 20
ii
Configuration procedure ······································································································································ 20
Defining a traffic behavior ············································································································································ 21
Defining a policy···························································································································································· 22
Configuration restrictions and guidelines ··········································································································· 22
Configuration procedure ······································································································································ 22
Applying the QoS policy··············································································································································· 22
Applying the QoS policy to an interface············································································································ 23
Applying the QoS policy to online users ············································································································ 23
Applying the QoS policy to a VLAN··················································································································· 24
Applying the QoS policy globally······················································································································· 24
Applying the QoS policy to the control plane···································································································· 24
Displaying and maintaining QoS policies ·················································································································· 25
Configuring priority mapping ···································································································································27
Overview········································································································································································· 27
Types of priorities ·················································································································································· 27
Priority mapping tables········································································································································· 27
Priority trust mode on a port································································································································· 28
Priority mapping procedure ································································································································· 29
Configuration guidelines ··············································································································································· 30
Configuring a priority mapping table·························································································································· 31
Configuring a port to trust packet priority for priority mapping ··············································································· 31
Changing the port priority of an interface ·················································································································· 31
Displaying priority mappings ······································································································································· 32
Priority trust mode configuration example··················································································································· 32
Network requirements··········································································································································· 32
Configuration procedure ······································································································································ 33
Priority mapping table and priority marking configuration example ······································································· 33
Network requirements··········································································································································· 33
Configuration procedure ······································································································································ 34
Configuring traffic policing, traffic shaping, and rate limit ····················································································36
Overview········································································································································································· 36
Traffic evaluation and token buckets··················································································································· 36
Traffic policing······················································································································································· 37
Traffic shaping ······················································································································································· 38
Rate limit································································································································································· 38
Configuring traffic policing··········································································································································· 39
Configuration restrictions and guidelines ··········································································································· 39
Configuration procedure ······································································································································ 39
Configuring GTS ···························································································································································· 40
Configuring the rate limit ·············································································································································· 40
Displaying and maintaining traffic policing, GTS, and rate limit············································································· 41
Traffic policing configuration example ························································································································ 41
Network requirements··········································································································································· 41
Configuration procedures····································································································································· 42
Configuring congestion management ······················································································································44
Overview········································································································································································· 44
Congestion management techniques ··························································································································· 44
SP queuing ····························································································································································· 44
WRR queuing························································································································································· 45
WFQ queuing························································································································································ 46
SP+WRR queuing ·················································································································································· 47
SP+WFQ queuing ················································································································································· 47
Configuring SP queuing ················································································································································ 47
iii
Configuration procedure ······································································································································ 47
Configuration example ········································································································································· 48
Configuring WRR queuing············································································································································ 48
Configuration procedure ······································································································································ 48
Configuration example ········································································································································· 49
Configuring WFQ queuing··········································································································································· 49
Configuration procedure ······································································································································ 49
Configuration example ········································································································································· 50
Configuring SP+WRR queuing ····································································································································· 50
Configuration procedure ······································································································································ 50
Configuration example ········································································································································· 51
Configuring SP+WFQ queuing ···································································································································· 52
Configuration procedure ······································································································································ 52
Configuration example ········································································································································· 52
Displaying and maintaining queue-based accounting······························································································· 53
Configuring traffic filtering ········································································································································54
Configuration procedure··············································································································································· 54
Traffic filtering configuration example ························································································································· 55
Network requirements··········································································································································· 55
Configuration procedure ······································································································································ 55
Configuring priority marking·····································································································································56
Color-based priority marking········································································································································ 56
Coloring a packet ················································································································································· 56
Marking packets based on their colors··············································································································· 56
Configuration procedure··············································································································································· 57
Local precedence re-marking configuration example ································································································ 58
Network requirements··········································································································································· 58
Configuration procedure ······································································································································ 58
Configuring traffic redirecting···································································································································60
Configuration restrictions and guidelines···················································································································· 60
Configuration procedure··············································································································································· 60
Configuring class-based accounting·························································································································62
Configuration procedure··············································································································································· 62
Displaying and maintaining traffic accounting··········································································································· 62
Class-based accounting configuration example ········································································································· 63
Network requirements··········································································································································· 63
Configuration procedure ······································································································································ 63
Configuring the data buffer·······································································································································65
Overview········································································································································································· 65
Data buffer ····························································································································································· 65
Data buffer allocation ··········································································································································· 65
Data buffer configuration approaches························································································································· 66
Using the burst function to configure the data buffer setup······················································································· 67
Manually configuring the data buffer setup················································································································ 67
Manually configuring the data buffer ················································································································· 67
Configuring the cell resource ······························································································································· 67
Configuring the packet resource·························································································································· 68
Applying the data buffer settings························································································································· 69
Appendix A Default priority mapping tables···········································································································70
Priority mapping tables ················································································································································· 70
iv
Appendix B Packet precedences ······························································································································71
IP precedence and DSCP values ·································································································································· 71
802.1p priority ······························································································································································ 72
Index ···········································································································································································74
1
Configuring ACLs
Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document.
Overview
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based on
criteria such as source IP address, destination IP address, and port number.
ACLs are primarily used for packet filtering. A packet filter drops packets that match a deny rule and
permits packets that match a permit rule. ACLs are also used by many modules, QoS and IP routing for
example, for traffic classification and identification.
Applications on the switch
An ACL is implemented in hardware or software, depending on the module that uses it. If the module, the
packet filter or QoS module for example, is implemented in hardware, the ACL is applied to hardware
to process traffic. If the module, the routing or user interface access control module (Telnet, SNMP, or web)
for example, is implemented in software, the ACL is applied to software to process traffic.
The user interface access control module denies packets that do not match any ACL. Some modules, QoS
for example, ignore the permit or deny action in ACL rules and do not base their drop or forwarding
decisions on the action set in ACL rules. See the specified module for information about ACL application.
ACL categories
Cate
g
or
y
ACL number IP version
Match criteria
Basic ACLs 2000 to
2999
IPv4 Source IPv4 address
IPv6 Source IPv6 address
Advanced ACLs 3000 to
3999
IPv4
Source IPv4 address, destination IPv4 address, packet
priority, protocols over IPv4, and other Layer 3 and Layer 4
header fields
IPv6
Source IPv6 address, destination IPv6 address, packet
priority, protocols over IPv6, and other Layer 3 and Layer 4
header fields
Ethernet frame
header ACLs
4000 to
4999
IPv4 and
IPv6
Layer 2 header fields, such as source and destination MAC
addresses, 802.1p priority, and link layer protocol type
Numbering and naming ACLs
Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a
number. In addition, you can assign the ACL a name for ease of identification. After creating an ACL with
a name, you cannot rename it or delete its name.
For an Ethernet frame header ACL, the ACL number and name must be globally unique. For an IPv4 basic
or advanced ACLs, its ACL number and name must be unique among all IPv4 ACLs, and for an IPv6
2
basic or advanced ACL, its ACL number and name must be unique among all IPv6 ACLs. You can assign
an IPv4 ACL and an IPv6 ACL the same number and name.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the
match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting
rules, the matching result and action to take depend on the rule order.
The following ACL match orders are available:
•config—Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a
rule with a higher ID. If you use this approach, carefully check the rules and their order.
•auto—Sorts ACL rules in depth-first order. Depth-first ordering guarantees that any subset of a rule
is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first ordering
uses to sort rules for each type of ACL.
Table 1 Sort ACL rules in depth-first order
ACL cate
g
or
y
Se
q
uence of tie breakers
IPv4 basic ACL
1. More 0s in the source IP address wildcard (more 0s means a narrower IP
address range)
2. Rule configured earlier
IPv4 advanced ACL
3. Specific protocol type rather than IP (IP represents any protocol over IP)
4. More 0s in the source IP address wildcard mask
5. More 0s in the destination IP address wildcard
6. Narrower TCP/UDP service port number range
7. Rule configured earlier
IPv6 basic ACL
8. Longer prefix for the source IP address (a longer prefix means a narrower IP
address range)
9. Rule configured earlier
IPv6 advanced ACL
10. Specific protocol type rather than IP (IP represents any protocol over IPv6)
11. Longer prefix for the source IPv6 address
12. Longer prefix for the destination IPv6 address
13. Narrower TCP/UDP service port number range
14. Rule configured earlier
Ethernet frame header ACL
15. More 1s in the source MAC address mask (more 1s means a smaller MAC
address)
16. More 1s in the destination MAC address mask
17. Rule configured earlier
A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal
notation. In contrast to a network mask, the 0 bits in a wildcard mask represent "do care" bits, and the
1 bits represent "don’t care" bits. If the "do care" bits in an IP address are identical to the "do care" bits
in an IP address criterion, the IP address matches the criterion. All "don’t care" bits are ignored. The 0s
and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask
ACL rule comments and rule range remarks
You can add a comment about an ACL rule to make it easy to understand. The rule comment appears
below the rule statement.
3
You can also add a rule range remark to indicate the start or end of a range of rules created for the same
purpose. A rule range remark always appears above the specified ACL rule. If the specified rule has not
been created yet, the position of the comment in the ACL is as follows:
•If the match order is config, the remark is inserted into the ACL in descending order of rule ID.
•If the match order is auto, the remark is placed at the end of the ACL. After you create the rule, the
remark appears above the rule.
For more information about how to use rule range remarks, see the rule remark command in ACL and
QoS Command Reference for your device.
ACL rule numbering
What is the ACL rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID. The
rule numbering step sets the increment by which the system automatically numbers rules. For example, the
default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are
automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can
insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of
inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are matched
in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to
the current highest rule ID, starting with 0.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10,
and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule is
numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules
numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2,
4, 6, and 8.
Fragments filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent non-first
fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid the risks, the H3C ACL implementation:
•Filters all fragments by default, including non-first fragments.
•Allows for matching criteria modification, for example, filters non-first fragments only.
ACL configuration task list
Task Remarks
Configuring a time range Optional
Applicable to IPv4 and IPv6 ACLs.
4
Task Remarks
Configuring a basic ACL Required
Configure at least one task.
Applicable to IPv4 and IPv6 except that simple ACLs
are for IPv6.
Configuring an advanced ACL
Configuring an Ethernet frame header ACL
Copying an ACL Optional
Applicable to IPv4 and IPv6.
Configuring packet filtering with ACLs Optional
Applicable to IPv4 and IPv6.
Configuring a time range
You can implement ACL rules based on the time of day by applying a time range to them. A time-based
ACL rule only takes effect in any time periods specified by the time range.
The following basic types of time range are available:
•Periodic time range—Recurs periodically on a day or days of the week.
•Absolute time range—Represents only a period of time and does not recur.
You can create a maximum of 256 time ranges, each with a maximum of 32 periodic statements and 12
absolute statements. The active period of a time range is calculated as follows:
1. Combining all periodic statements.
2. Combining all absolute statements.
3. Taking the intersection of the two statement sets as the active period of the time range.
To configure a time range:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Configure a time
range.
time-range time-range-name
{ start-time to end-time days [ from
time1 date1 ] [ to time2 date2 ] |
from time1 date1 [ to time2 date2 ]
| to time2 date2 }
By default, no time range exists.
Repeat this command with the same time
range name to create multiple statements for
a time range.
Configuring a basic ACL
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based only on source IP addresses.
To configure an IPv4 basic ACL:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
5
Ste
p
Command Remarks
2. Create an IPv4
basic ACL and
enter its view.
acl number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv4 basic ACLs are numbered in the range of 2000 to
2999.
You can use the acl name acl-name command to enter
the view of a named IPv4 ACL.
3. Configure a
description for the
IPv4 basic ACL.
description text Optional.
By default, an IPv4 basic ACL has no ACL description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
5. Create or edit a
rule.
rule [ rule-id ] { deny |
permit } [ counting |
fragment |logging |
source {sour-addr
sour-wildcard | any } |
time-range
time-range-name ] *
By default, an IPv4 basic ACL does not contain any rule.
If the ACL is for QoS traffic classification, do not specify
the fragment keyword, and the logging and counting
keywords (even if specified) do not take effect.
6. Add or edit a rule
comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a rule
range remark. rule [ rule-id ] remark text
Optional.
By default, no rule range remarks are configured.
8. Enable counting
ACL rule matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
When the ACL is referenced by a QoS policy, this
command does not take effect.
Configuring an IPv6 basic ACL
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an IPv6
basic ACL view
and enter its view.
acl ipv6 number
acl6-number [ name
acl6-name ] [ match-order
{ auto | config } ]
By default, no ACL exists.
IPv6 basic ACLs are numbered in the range of 2000
to 2999.
You can use the acl ipv6 name acl6-name command
to enter the view of a named IPv6 ACL.
3. Configure a
description for the
IPv6 basic ACL.
description text
Optional.
By default, an IPv6 basic ACL has no ACL
description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
6
Ste
p
Command Remarks
5. Create or edit a
rule.
rule [ rule-id ] { deny |
permit } [ counting |
fragment |logging |
routing [ type routing-type ]
| source { ipv6-address
prefix-length |
ipv6-address/prefix-length
| any } | time-range
time-range-name ] *
By default, an IPv6 basic ACL does not contain any
rule.
If the ACL is for QoS traffic classification or packet
filtering, do not specify the fragment and routing
keywords. The keywords can cause ACL application
failure.
The logging and counting keywords (even if
specified) do not take effect for QoS.
6. Add or edit a rule
comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a rule
range remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable counting
ACL rule matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
When the ACL is referenced by a QoS policy, this
command does not take effect.
Configuring an advanced ACL
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on source IP addresses, destination IP addresses, packet
priorities, protocols over IP, and other protocol header information, such as TCP/UDP source and
destination port numbers, TCP flags, ICMP message types, and ICMP message codes.
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv4 advanced ACL:
Ste
p
Command Remarks
1. Enter system
view. system-view N/A
2. Create an IPv4
advanced ACL
and enter its
view.
acl number acl-number [ name
acl-name ] [ match-order { auto
| config } ]
By default, no ACL exists.
IPv4 advanced ACLs are numbered in the range of
3000 to 3999.
You can use the acl name acl-name command to
enter the view of a named IPv4 ACL.
3. Configure a
description for
the IPv4
advanced ACL.
description text
Optional.
By default, an IPv4 advanced ACL has no ACL
description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
7
Ste
p
Command Remarks
5. Create or edit a
rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination
{ dest-addr dest-wildcard | any }
| destination-port operator
port1 [ port2 ] | dscp dscp |
fragment | icmp-type
{icmp-type [ icmp-code ] |
icmp-message } | logging |
precedence precedence |
source {sour-addr sour-wildcard
| any } | source-port operator
port1 [ port2 ] | time-range
time-range-name | tos tos ] *
By default, an IPv4 advanced ACL does not
contain any rule.
If an IPv4 advanced ACL is for QoS traffic
classification or packet filtering:
•Do not specify the fragment keyword.
•Do not specify neq for the operator argument.
•The logging and counting keywords (even if
specified) do not take effect for QoS traffic
classification.
6. Add or edit a
rule comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a
rule range
remark.
rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable counting
ACL rule
matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
When the ACL is referenced by a QoS policy, this
command does not take effect.
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the source IPv6 addresses, destination IPv6 addresses,
packet priorities, protocols carried over IPv6, and other protocol header fields such as the TCP/UDP
source port number, TCP/UDP destination port number, ICMPv6 message type, and ICMPv6 message
code.
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
Configuration restrictions and guidelines
When the protocol argument takes 43, 44, 51, or 60, the ACL cannot function on for the outbound QoS
application.
Configuration procedure
To configure an IPv6 advanced ACL:
Ste
p
Command Remarks
1. Enter system
view. system-view N/A
8
Ste
p
Command Remarks
2. Create an IPv6
advanced ACL
and enter its
view.
acl ipv6 number acl6-number
[ name acl6-name ]
[ match-order { auto | config } ]
By default, no ACL exists.
IPv6 advanced ACLs are numbered in the range of
3000 to 3999.
You can use the acl ipv6 name acl6-name command
to enter the view of a named IPv6 ACL.
3. Configure a
description for
the IPv6
advanced ACL.
description text
Optional.
By default, an IPv6 advanced ACL has no ACL
description.
4. Set the rule
numbering
step.
step step-value Optional.
5 by default.
5. Create or edit a
rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination { dest
dest-prefix |dest/dest-prefix |
any } | destination-port
operator port1 [ port2 ] | dscp
dscp |flow-label
flow-label-value | fragment |
icmp6-type { icmp6-type
icmp6-code | icmp6-message }
| logging | routing [ type
routing-type ] | source { source
source-prefix |
source/source-prefix | any } |
source-port operator port1
[port2 ] | time-range
time-range-name ] *
By default IPv6 advanced ACL does not contain any
rule.
If an IPv6 advanced ACL is for QoS traffic
classification or packet filtering, do not specify the
fragment or routing keyword, or specify neq for
the operator argument.
The logging and counting keywords (even if
specified) do not take effect for QoS traffic
classification.
6. Add or edit a
rule comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a
rule range
remark.
rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable
counting ACL
rule matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
When the ACL is referenced by a QoS policy, this
command does not take effect.
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol
header fields, such as source MAC address, destination MAC address, 802.1p priority (VLAN priority),
and link layer protocol type.
To configure an Ethernet frame header ACL:
9
Ste
p
Command Remarks
1. Enter system
view. system-view N/A
2. Create an
Ethernet frame
header ACL
and enter its
view.
acl number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
Ethernet frame header ACLs are numbered in the
range of 4000 to 4999.
You can use the acl name acl-name command to enter
the view of a named Ethernet frame header ACL.
3. Configure a
description for
the Ethernet
frame header
ACL.
description text
Optional.
By default, an Ethernet frame header ACL has no ACL
description.
4. Set the rule
numbering
step.
step step-value Optional.
The default setting is 5.
5. Create or edit a
rule.
rule [ rule-id ] { deny |
permit } [ cos vlan-pri |
counting | dest-mac
dest-addr dest-mask | { lsap
lsap-type lsap-type-mask |
type protocol-type
protocol-type-mask } |
source-mac sour-addr
source-mask | time-range
time-range-name ] *
By default,an Ethernet frame header ACL does not
contain any rule.
If the ACL is for QoS traffic classification or packet
filtering, to use the lsap keyword, the lsap-type
argument must be AAAA, and the lasp-type-mask
argument must be FFFF. Otherwise, the ACL cannot be
function normally.
6. Add or edit a
rule comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a
rule range
remark.
rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable
counting ACL
rule matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
When the ACL is referenced by a QoS policy, this
command does not take effect.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL) has the
same properties and content as the source ACL, but not the same ACL number and name.
To successfully copy an ACL, make sure that:
•The destination ACL number is from the same category as the source ACL number.
•The source ACL already exists but the destination ACL does not.
Copying an IPv4 ACL
10
Ste
p
Command
1. Enter system view. system-view
2. Copy an existing IPv4 ACL to create a
new IPv4 ACL.
acl copy { source-acl-number | name source-acl-name } to
{ dest-acl-number | name dest-acl-name }
Copying an IPv6 ACL
Ste
p
Command
1. Enter system view. system-view
2. Copy an existing IPv6 ACL to generate a
new one of the same category.
acl ipv6 copy { source-acl6-number | name
source-acl6-name } to { dest-acl6-number | name
dest-acl6-name }
Configuring packet filtering with ACLs
You can use an ACL to filter incoming IPv4 or IPv6 packets. You can apply one IPv4 ACL, one IPv6 ACL,
and one Ethernet frame header ACL at most to filter packets in the inbound direction of an interface.
With a basic or advanced ACL, you can log filtering events by specifying the logging keyword in the ACL
rules and enabling the counting function. To enable counting for rule matches performed in hardware,
configure the hardware-count enable command for the ACL or specify the counting keyword in the ACL
rules.
You can set the packet filter to periodically send packet filtering logs to the information center as
informational messages. The interval for generating and outputting packet filtering logs is configurable.
The log information includes the number of matching packets and the ACL rules used in an interval. For
more information about the information center, see Network Management and Monitoring
Configuration Guide.
NOTE:
A
CLs on VLAN interfaces filter only packets forwarded at Layer 3.
Applying an IPv4 or Ethernet frame header ACL for packet
filtering
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number
N/A
3. Apply an IPv4 basic, IPv4
advanced, or Ethernet frame
header ACL to the interface to
filter packets.
packet-filter { acl-number |
name acl-name } inbound
By default, no ACL is applied to any
interface.
4. Exit to system view. quit N/A
Other manuals for S5120-EI Series
17
Table of contents
Other H3C Switch manuals
H3C
H3C PSR600-54A-B User manual
H3C
H3C S6800-2C Operating and maintenance manual
H3C
H3C S12500CR Series User manual
H3C
H3C S5130S-EI series Owner's manual
H3C
H3C S10500X Series User manual
H3C
H3C S3610 Series User manual
H3C
H3C S9500 Series User manual
H3C
H3C S9500 Series User manual
H3C
H3C S7500E-XS Series Installation guide
H3C
H3C S6800 Series User manual
Popular Switch manuals by other brands
Omnitron Systems Technology
Omnitron Systems Technology FlexSwitch 6540-FK user manual
Delta Electronics
Delta Electronics NovoConnect B360 quick start guide
Kathrein
Kathrein EXR 1542 manual
Leonton
Leonton REG5-2602-2C Series user manual
Crestron
Crestron DigitalMedia DM-MD8X8-CPU3 Getting started
Belden
Belden Hirschmann Rail Switch Power Lite user manual