HP FlexNetwork 6600 User manual

HPE FlexNetwork 6600/HSR6600 Routers
A
CL and QoS Configuration Guide
Part number: 5998-1491R
Software version: A6600_HSR6602-CMW520-R3303P25
Document version: 6W105-20151231

© Copyright 2015 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ACLs····························································································1
Overview····························································································································································1
ACL categories···········································································································································1
Numbering and naming ACLs····················································································································1
Match order················································································································································1
Rule comments and rule range remarks····································································································2
Rule numbering··········································································································································2
Implementing time-based ACL rules··········································································································3
IPv4 fragments filtering with ACLs·············································································································3
Configuration task list·········································································································································3
Configuring a time range····································································································································4
Configuring a basic ACL ····································································································································4
Configuring an IPv4 basic ACL··················································································································4
Configuring an IPv6 basic ACL··················································································································5
Configuring an advanced ACL···························································································································6
Configuring an IPv4 advanced ACL···········································································································6
Configuring an IPv6 advanced ACL···········································································································7
Configuring an Ethernet frame header ACL·······································································································8
Copying an ACL·················································································································································8
Copying an IPv4 basic, IPv4 advanced, or Ethernet frame header ACL ···················································9
Copying an IPv6 basic or IPv6 advanced ACL ··························································································9
Enabling ACL acceleration for an IPv4 basic or IPv4 advanced ACL································································9
Displaying and maintaining ACLs ····················································································································10
ACL configuration examples····························································································································10
IPv4 advanced ACL configuration examples ···························································································10
IPv6 advanced ACL configuration example·····························································································12
QoS overview································································································15
QoS service models·········································································································································15
Best-effort service model ·························································································································15
IntServ model···········································································································································15
DiffServ model··········································································································································15
QoS techniques overview ································································································································15
Deploying QoS in a network·····················································································································16
QoS processing flow in a device··············································································································16
QoS configuration approaches ·····································································18
QoS configuration approach overview·············································································································18
MQC approach·········································································································································18
Non-MQC approach·································································································································18
Configuring a QoS policy ·································································································································18
Defining a class········································································································································19
Defining a traffic behavior ························································································································20
Defining a policy·······································································································································20
Configuring QoS policy nesting················································································································21
Applying the QoS policy···························································································································22
Displaying and maintaining QoS policies·································································································23
Configuring priority mapping·········································································25
Overview··························································································································································25
Introduction to priorities····························································································································25
Priority mapping tables·····························································································································25
Priority mapping configuration tasks················································································································25
Configuring a priority mapping table ················································································································26
Configuring the trusted packet priority type for an interface or port group·······················································26
Changing the port priority of an interface·········································································································27
Displaying and maintaining priority mapping ···································································································27

ii
Priority mapping configuration examples·········································································································28
Priority trust mode and port priority configuration example······································································28
Priority mapping table configuration example··························································································29
Configuring traffic policing, traffic shaping, and rate limit······························31
Overview··························································································································································31
Traffic evaluation and token buckets········································································································31
Traffic policing··········································································································································32
Traffic shaping··········································································································································33
Rate limit··················································································································································33
Configuration task list·······································································································································34
Configuring traffic policing································································································································35
Configuring traffic policing by using the policy approach·········································································35
Configuring traffic policing by using the non-policy approach··································································35
Configuring GTS ··············································································································································36
Configuring GTS by using the policy approach························································································37
Configuring GTS by using the non-policy approach·················································································37
Configuring the rate limit··································································································································38
Configuring packet resequencing ····················································································································39
Displaying and maintaining traffic policing, GTS, and rate limit·······································································39
Traffic policing and GTS configuration examples ····························································································39
Traffic policing and GTS configuration example ······················································································39
IP rate limiting configuration example······································································································41
Configuring congestion management ···························································42
Overview··························································································································································42
Causes, impacts, and countermeasures of congestion ···········································································42
Congestion management policies············································································································42
Congestion management technique comparison·····················································································47
Configuring the FIFO queue size·····················································································································49
Configuration example·····························································································································50
Configuring PQ ················································································································································50
Configuration restrictions and guidelines·································································································50
Configuration procedure···························································································································50
PQ configuration example························································································································51
Configuring CQ ················································································································································52
CQ configuration example························································································································52
Configuring WFQ ·············································································································································53
WFQ configuration example·····················································································································53
Configuring CBQ··············································································································································54
Predefined classes, traffic behaviors, and policies ··················································································54
Defining a class········································································································································54
Defining a traffic behavior ························································································································55
Defining a QoS policy·······························································································································58
Applying the QoS policy···························································································································58
Configuring the maximum available interface bandwidth·········································································59
Setting the maximum reserved bandwidth as a percentage of available bandwidth································60
Displaying and maintaining CBQ ·············································································································61
CBQ configuration example·····················································································································61
Configuring RTP priority queuing·····················································································································62
Configuration procedure···························································································································62
RTP priority queuing configuration example····························································································63
Configuring QoS tokens···································································································································63
Configuration procedure···························································································································64
QoS token configuration example············································································································64
Configuring packet information pre-extraction ·································································································64
Configuration procedure···························································································································64
Configuration example·····························································································································65
Configuring hardware congestion management ···········································66
Overview··························································································································································66
Causes, impacts, and countermeasures··································································································66

iii
Congestion management techniques·······································································································66
Hardware congestion management configuration approaches········································································69
Configuring per-queue hardware congestion management·············································································69
Configuring SP queuing···························································································································69
Configure group-based WRR queuing·····································································································70
Configuring WFQ queuing························································································································71
Configuring CBQ··············································································································································72
CBQ configuration task list·······················································································································72
Defining a class········································································································································73
Defining a traffic behavior ························································································································73
Defining a QoS policy·······························································································································74
Applying the QoS policy···························································································································74
Displaying and maintaining CBQ ·············································································································75
CBQ configuration example·····················································································································75
Configuring congestion avoidance································································78
Overview··························································································································································78
Introduction to WRED configuration·················································································································79
WRED configuration approaches·············································································································79
Introduction to WRED parameters···········································································································79
Configuring WRED on an interface··················································································································79
Configuration procedure···························································································································79
Configuration example·····························································································································80
Applying a WRED table on an interface···········································································································80
Configuration procedure···························································································································81
Configuration example·····························································································································81
Displaying and maintaining WRED··················································································································81
WRED configuration example··························································································································82
Network requirements······························································································································82
Configuration procedure···························································································································82
Configuring traffic filtering·············································································85
Configuration procedure ··································································································································85
Traffic filtering configuration example ··············································································································86
Network requirements······························································································································86
Configuration procedure···························································································································86
Configuring priority marking··········································································87
Configuration procedure ··································································································································87
Priority marking configuration example············································································································88
Network requirements······························································································································88
Configuration procedure···························································································································88
Configuring traffic redirecting········································································90
Configuration guidelines ··································································································································90
Configuration procedure ··································································································································90
Traffic redirecting configuration example·········································································································91
Network requirements······························································································································91
Configuration procedure···························································································································91
Configuring DAR···························································································93
Overview··························································································································································93
Configuring DAR for P2P traffic recognition·····································································································93
Loading the P2P signature file·················································································································93
Configuring a P2P protocol group············································································································93
Enabling P2P traffic recognition···············································································································94
Configuring protocol match criteria ··········································································································94
Configuring DAR packet accounting········································································································94
Displaying and maintaining DAR ·····················································································································95
Blocking P2P downloading configuration example ··························································································95
Network requirements······························································································································95
Configuration procedure···························································································································95

iv
Configuring class-based accounting·····························································97
Configuration procedure ··································································································································97
Displaying and maintaining class-based accounting ·······················································································97
Class-based accounting configuration example ······························································································98
Network requirements······························································································································98
Configuration procedure···························································································································98
Configuring QPPB·······················································································100
Overview························································································································································100
QPPB fundamentals ······································································································································100
QPPB configuration task list ··························································································································100
Configuring the route sender ·························································································································101
Configuring basic BGP functions ···········································································································101
Creating a routing policy ························································································································101
Configuring the route receiver························································································································101
Configuring basic BGP functions ···········································································································101
Configuring a routing policy····················································································································101
Enabling QPPB on the route receiving interface····················································································101
Configuring a QoS policy ·······················································································································101
Applying the QoS policy to an interface·································································································102
QPPB configuration examples·······················································································································102
QPPB configuration example in an IPv4 network ··················································································102
QPPB configuration example in an MPLS L3VPN·················································································104
QPPB configuration example in an IPv6 network ··················································································110
Appendix·····································································································114
Appendix A Acronyms····································································································································114
Appendix B Default priority mapping tables···································································································115
Appendix C Introduction to packet precedences ···························································································116
IP precedence and DSCP values···········································································································116
802.1p priority ········································································································································117
EXP values·············································································································································118
Configuring MPLS QoS···············································································119
Overview························································································································································119
Configuring MPLS CAR ·································································································································119
Configuring MPLS priority marking ················································································································120
Configuring MPLS congestion management ·································································································121
Configuration prerequisites····················································································································121
Configure MPLS PQ·······························································································································121
Configure MPLS CQ ······························································································································121
MPLS QoS configuration example·················································································································122
Configuring FR QoS····················································································125
Overview························································································································································125
FRTS······················································································································································125
FR traffic policing ···································································································································127
FR queuing·············································································································································127
FR congestion management··················································································································128
FR DE rule list········································································································································128
FR QoS configuration task list ·······················································································································128
Creating and configuring an FR class············································································································128
Configuring FRTS ··········································································································································129
Configuration restrictions and guidelines·······························································································129
Configuration procedure·························································································································129
Configuring FR traffic policing························································································································130
Configuration restrictions and guidelines·······························································································130
Configuration procedure·························································································································130
Configuring FR congestion management ······································································································131
Configuring FR congestion management for an FR interface································································131
Configuring FR congestion management for an FR PVC······································································131

v
Configuring FR DE rule list ····························································································································132
Configuring FR PVC queuing·························································································································132
Configuration restrictions and guidelines·······························································································132
Configuration procedure·························································································································132
Configuring FR fragmentation························································································································132
Configuration restrictions and guidelines·······························································································133
Configuration procedure·························································································································133
Displaying and maintaining FR QoS··············································································································133
FR QoS configuration examples····················································································································134
FRTS configuration example··················································································································134
FR fragmentation configuration example·······························································································135
Configuring HQoS·······················································································136
HQoS overview··············································································································································136
HQoS implementation methods·····················································································································136
Implementing HQoS through nesting QoS policies················································································136
Implementing HQoS through interface-level hierarchical CAR······························································137
Implementing HQoS through nesting QoS policies························································································141
Defining a traffic class····························································································································141
Defining a traffic behavior ······················································································································142
Defining a policy·····································································································································142
Applying the QoS policy·························································································································143
Implementing HQoS through interface-level hierarchical CAR······································································144
Configuring CAR-list-based traffic policing·····························································································144
Configuring ACL-based traffic policing···································································································145
Configuring traffic policing for all traffic··································································································145
Configuration example for HQoS through nesting QoS policies····································································146
Network requirements····························································································································146
Configuration procedures·······················································································································146
Configuration example for implementing hierarchical CAR through nesting QoS policies ····························148
Network requirements····························································································································148
Configuration procedures·······················································································································149
Configuration example for implementing HQoS in an MPLS network through nesting QoS policies ············150
Network requirements····························································································································150
Configuration procedures·······················································································································150
Configuration example for reserving and sharing bandwidth through interface-level hierarchical CAR ········152
Network requirements····························································································································152
Configuration procedures·······················································································································153
Configuration example for implementing per-IP bandwidth reservation and sharing through interface-level
hierarchical CAR············································································································································154
Network requirements····························································································································154
Configuration procedures·······················································································································155
Configuration example for implementing intelligent load sharing through interface-level hierarchical CAR··155
Network requirements····························································································································155
Configuration procedures·······················································································································156
Document conventions and icons·······························································158
Conventions···················································································································································158
Network topology icons··································································································································159
Support and other resources ······································································160
Accessing Hewlett Packard Enterprise Support ····························································································160
Accessing updates·········································································································································160
Websites ················································································································································161
Customer self repair·······························································································································161
Remote support······································································································································161
Documentation feedback ·······················································································································161
Index···········································································································163

1
Configuring ACLs
Overview
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic
based on criteria such as source IP address, destination IP address, and port number.
ACLs are primarily used for traffic identification. The packet drop or forwarding decisions varies with
the modules that use ACLs.
ACL categories
Category ACL number IP version Match criteria
Basic ACLs 2000 to 2999 IPv4 Source IPv4 address
IPv6 Source IPv6 address
Advanced ACLs 3000 to 3999
IPv4 Source IPv4 address, destination IPv4
address, packet priority, protocol number, and
other Layer 3 and Layer 4 header fields
IPv6 Source IPv6 address, destination IPv6 address, packet priority, protocol number, and
other Layer 3 and Layer 4 header fields
Ethernet frame
header ACLs 4000 to 4999 N/A Layer 2 header fields, such as source and
destination MAC addresses, 802.1p priority,
and link layer protocol type
Numbering and naming ACLs
Each ACLcategory has a unique range of ACLnumbers. You can assign the ACL a name for ease of
identification. After creating an ACL with a name, you cannot rename it or delete its name.
For an IPv4 basic or advanced ACLs, its ACL number and name must be unique in IPv4, and for an
IPv6 basic or advanced ACL, its ACL number and name must be unique in IPv6.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops
the match process and performs the action defined in the rule. If an ACL contains overlapping or
conflicting rules, the matching result and action to take depend on the rule order.
The followingACL match orders are available:
•config—SortsACL rules in ascending order of rule ID. Arule with a lower ID is matched before
a rule with a higher ID. If you use this method, check the rules and their order carefully.
•auto—SortsACL rules in depth-first order. Depth-first ordering makes sure that any subset of a
rule is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first
ordering uses to sort rules for each type ofACL.

2
Table 1 Sorting ACL rules in depth-first order
ACL category Sequence of tie breakers
IPv4 basic ACL
1. VPN instance
2. More 0s in the source IP address wildcard (more 0s means a narrower
IP address range)
3. Rule configured earlier
IPv4 advanced ACL
1. VPN instance
2. Specific protocol number
3. More 0s in the source IP address wildcard mask
4. More 0s in the destination IP address wildcard
5. Narrower TCP/UDP service port number range
6. Rule configured earlier
IPv6 basic ACL
1. VPN instance
2. Longer prefix for the source IP address (a longer prefix means a
narrower IP address range)
3. Rule configured earlier
IPv6 advanced ACL
1. VPN instance
2. Specific protocol number
3. Longer prefix for the source IPv6 address
4. Longer prefix for the destination IPv6 address
5. Narrower TCP/UDP service port number range
6. Rule configured earlier
Ethernet frame header ACL
1. More 1s in the source MAC address mask (more 1s means a smaller
MAC address)
2. More 1s in the destination MAC address mask
3. Rule configured earlier
A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal
notation. In contrast to a network mask, the 0 bits in awildcard mask represent "do care" bits, and the
1 bits represent "don’t care" bits. If the "do care" bits in an IP address are identical to the "do care"
bits in an IP address criterion, the IP address matches the criterion.All "don’t care" bits are ignored.
The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid
wildcard mask.
Rule comments and rule range remarks
Add a comment about anACL rule to make it easy to understand. The rule comment appears below
the rule statement.
In addition, add a rule range remark to indicate the start or end of a range of rules created for the
same purpose.
Rule numbering
ACL rules can be manually numbered or automatically numbered. This section describes how
automatic ACL rule numbering works.
Rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID.
The rule numbering step sets the increment by which the system automatically numbers rules. For
example, the default ACLrule numbering step is 5. If you do not assign IDs to rules you are creating,
they are automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more
rules you can insert between two rules.

3
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility
of inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are
matched in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACLrule takes the nearest higher multiple of the numbering step
to the current highest rule ID, starting with 0.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9,
10, and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule
is numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five
rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be
renumbered 0, 2, 4, 6, and 8.
Implementing time-based ACL rules
You can implement ACL rules based on the time of day by applying a time range to them. A
time-based ACL rule only takes effect in any time periods specified by the time range.
The following basic types of time range are available:
•Periodic time range—Recurs periodically on a day or days of the week.
•Absolute time range—Represents only a period of time and does not recur.
You can specify a time range in ACL rules before or after you create it. However, the rules using the
time range take effect only after you define the time range.
IPv4 fragments filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent
non-first fragments to pass through.Attackers can fabricate non-first fragments to attack networks.
To avoid the risks, the ACL implementation of Hewlett Packard Enterprise does the following:
•Filters all fragments by default, including non-first fragments.
•Allows for matching criteria modification, for example, filters non-first fragments only.
Configuration task list
Task Remarks
Configuring a time range Optional.
Applicable to IPv4 and IPv6.
Configuring a basic ACL
Required.
Configure at least one task.
Basic ACLs and advanced ACLs are applicable to
IPv4 and IPv6.
Configuring an advanced ACL
Configuring an Ethernet frame header ACL
Copying an ACL Optional.
Applicable to IPv4 and IPv6.

4
Task Remarks
Enabling ACL acceleration for an IPv4 basic or IPv4
advanced ACL Optional.
Configuring a time range
You can create a maximum of 256 time ranges, each having a maximum of 32 periodic statements
and 12 absolute statements. If a time range has multiple statements, its active period is calculated as
follows:
1. Combining all periodic statements.
2. Combining all absolute statements.
3. Taking the intersection of the two statement sets as the active period of the time range.
To configure a time range:
Step Command Remarks
4. Enter system view. system-view N/A
5. Configure a time
range.
time-range time-range-name
{ start-time to end-time days [ from
time1 date1 ] [ to time2 date2 ] |
from time1 date1 [ to time2 date2 ]
| to time2 date2 }
By default, no time range exists.
Repeat this command with the same time
range name to create multiple statements
for a time range.
Configuring a basic ACL
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based only on source IP addresses.
To configure an IPv4 basic ACL:
Step Command Remarks
1. Enter system
view. system-view N/A
2. Create an IPv4
basic ACL and
enter its view.
acl number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv4 basic ACLs are numbered in the range of 2000
to 2999.
You can use the acl name acl-name command to
enter the view of a named ACL.
3. Configure a
description for
the IPv4 basic
ACL. description text
Optional.
By default, an IPv4 basic ACL has no ACL
description.
4. Set the rule
numbering
step. step step-value Optional.
The default setting is 5.

5
Step Command Remarks
5. Create or edit
a rule.
rule [ rule-id ] { deny |
permit } [ counting |
fragment |logging | source
{source-address
source-wildcard | any } |
time-range
time-range-name |
vpn-instance
vpn-instance-name ] *
By default, an IPv4 basic ACL does not contain any
rule.
The logging keyword takes effect only when the
module (for example, a firewall) that uses the ACL
supports logging.
6. Add or edit a
rule comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a
rule range
remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
Configuring an IPv6 basic ACL
IPv6 basic ACLs match packets based only on source IP addresses.
To configure an IPv6 basic ACL:
Step Command Remarks
1. Enter system
view. system-view N/A
2. Create an IPv6
basic ACL view
and enter its
view.
acl ipv6 number acl6-number
[ name acl6-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv6 basic ACLs are numbered in the range of
2000 to 2999.
You can use the acl ipv6 name acl6-name
command to enter the view of a named ACL.
3. Configure a
description for
the IPv6 basic
ACL.
description text
Optional.
By default, an IPv6 basic ACL has no ACL
description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
5. Create or edit a
rule.
rule [ rule-id ] { deny | permit }
[ counting | fragment |
logging | routing [ type
routing-type ] | source
{source-address source-prefix
|source-address/source-prefix
| any } | time-range
time-range-name |
vpn-instance
vpn-instance-name ] *
By default, an IPv6 basic ACL does not contain
any rule.
The logging keyword takes effect only when
the module (for example, a firewall) using the
ACL supports logging.
6. Add or edit a rule
comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a rule
range remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are
configured.

6
Configuring an advanced ACL
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on source IPv4 addresses, destination IPv4 addresses,
packet priorities, protocol numbers, and other protocol header information, such as TCP/UDPsource
and destination port numbers, TCP flags, ICMP message types, and ICMP message codes.
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv4 advanced ACL:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an IPv4
advanced ACL and
enter its view.
acl number acl-number [ name
acl-name ] [ match-order { auto
| config } ]
By default, no ACL exists.
IPv4 advanced ACLs are numbered in the
range of 3000 to 3999.
You can use the acl name acl-name
command to enter the view of a named
ACL.
3. Configure a
description for the
IPv4 advanced ACL. description text
Optional.
By default, an IPv4 advanced ACL has no
ACL description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination
{ dest-addr dest-wildcard | any } |
destination-port operator port1
[port2 ] | dscp dscp |fragment |
icmp-type { icmp-type
[ icmp-code ] | icmp-message } |
logging | precedence
precedence | reflective | source
{sour-addr sour-wildcard | any }
| source-port operator port1
[port2 ] | time-range
time-range-name | tos tos |
vpn-instance
vpn-instance-name ] *
By default, an IPv4 advanced ACL does
not contain any rule.
The logging keyword takes effect only
when the module (for example, a firewall)
using the ACL supports logging.
6. Add or edit a rule
comment. rule rule-id comment text Optional.
By default, no rule comments are
configured.
7. Add or edit a rule
range remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are
configured.

7
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the source IPv6 addresses, destination IPv6
addresses, packet priorities, protocol numbers, and other protocol header fields such as the
TCP/UDP source port number, TCP/UDP destination port number, ICMPv6 message type, and
ICMPv6 message code.
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv6 advanced ACL:
Step Command Remarks
1. Enter system
view. system-view N/A
2. Create an IPv6
advanced ACL
and enter its
view.
acl ipv6 number acl6-number
[ name acl6-name ] [ match-order
{ auto | config } ]
By default, no ACL exists.
IPv6 advanced ACLs are numbered in the
range of 3000 to 3999.
You can use the acl ipv6 name
acl6-name command to enter the view of
a named ACL.
3. Configure a
description for
the IPv6
advanced ACL.
description text
Optional.
By default, an IPv6 advanced ACL has no
ACL description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
5. Create or edit a
rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination
{dest-address dest-prefix |
dest-address/dest-prefix |any } |
destination-port operator port1
[port2 ] | dscp dscp |flow-label
flow-label-value | fragment |
icmp6-type { icmp6-type icmp6-code
| icmp6-message } | logging | routing
[ type routing-type ] | source
{source-address source-prefix |
source-address/source-prefix | any } |
source-port operator port1 [ port2 ] |
time-range time-range-name|
vpn-instance vpn-instance-name ] *
By default IPv6 advanced ACL does not
contain any rule.
The logging keyword takes effect only
when the module (for example, a firewall)
using the ACL supports logging.
6. Add or edit a rule
comment. rule rule-id comment text Optional.
By default, no rule comments are
configured.
7. Add or edit a rule
range remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are
configured.

8
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol
header fields, such as source MAC address, destination MAC address, 802.1p priority (VLAN
priority), and link layer protocol type.
Ethernet frame header ACLs identifies Ethernet packets that are sent to the control plane (such as
VTY and local user services), but not those sent to the forwarding plane (such as QoS, firewall, and
debug services).
To configure an Ethernet frame headerACL:
Step Command Remarks
1. Enter system
view. system-view N/A
2. Create an
Ethernet frame
header ACL and
enter its view.
acl number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
Ethernet frame header ACLs are numbered in the
range of 4000 to 4999.
You can use the acl name acl-name command to
enter the view of a named Ethernet frame header
ACL.
3. Configure a
description for
the Ethernet
frame header
ACL.
description text
Optional.
By default, an Ethernet frame header ACL has no
ACL description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
5. Create or edit a
rule.
rule [ rule-id ] { deny |
permit } [ cos vlan-pri |
counting | dest-mac
dest-address dest-mask |
{ lsap lsap-type
lsap-type-mask | type
protocol-type
protocol-type-mask } |
source-mac
source-address
source-mask | time-range
time-range-name ] *
By default,an Ethernet frame header ACL does not
contain any rule.
6. Add or edit a rule
comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a rule
range remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL)
has the same properties and content as the source ACL, but not the sameACL number and name.
To successfully copy an ACL, make sure that:
•The destinationACL number is from the same category as the source ACL number.
•The source ACL already exists, but the destination ACL does not.

9
Copying an IPv4 basic, IPv4 advanced, or Ethernet frame
header ACL
Step Command
1. Enter system view. system-view
2. Copy an existing IPv4
basic, IPv4 advanced,
or Ethernet frame
header ACL to create a
new ACL.
acl copy { source-acl-number | name source-acl-name } to
{ dest-acl-number | name dest-acl-name }
Copying an IPv6 basic or IPv6 advanced ACL
Step Command
1. Enter system view. system-view
2. Copy an existing IPv6 basic
or IPv6 advanced ACL to
create a new ACL. acl ipv6 copy { source-acl6-number | name source-acl6-name } to
{ dest-acl6-number | name dest-acl6-name }
Enabling ACL acceleration for an IPv4 basic or
IPv4 advanced ACL
CAUTION:
•ACL acceleration is not available forACLs that contain a non-contiguous wildcard mask.
•After you modify an ACLwith ACLacceleration enabled, disable and re-enable ACLacceleration
to ensure correct rule matching.
ACL acceleration speeds up ACL lookup. The acceleration effect increases with the number of ACL
rules. ACL acceleration uses memory. To achieve the best trade-off between memory and ACL
processing performance, Hewlett Packard Enterprise recommends enabling ACL acceleration for
large ACLs, for example, ACLs containing more than 50 rules.
For example, when you use a large ACL for a session-based service, you can enable ACL
acceleration to avoid session timeouts caused by ACL processing delays.
Enable ACL acceleration in an ACL after you have finished editing ACL rules. ACL acceleration
always uses ACL criteria that have been set before it is enabled for rule matching. It does not
synchronize with any subsequent match criterion changes.
To enable ACL acceleration for an IPv4 basic or IPv4 advancedACL:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable ACL
acceleration for an
IPv4 basic or IPv4
advanced ACL.
acl accelerate number
acl-number
By default, the function is disabled.
The ACL must exist.
Only IPv4 basic ACLs and advanced ACLs
support ACL acceleration.

10
Displaying and maintaining ACLs
Task Command Remarks
Display configuration and match
statistics for IPv4 basic, IPv4
advanced, and Ethernet frame
header ACLs.
display acl { acl-number | all | name
acl-name } [ slot slot-number ] [ |{ begin |
exclude | include } regular-expression ] Available in any view.
Display information about the
ACL acceleration feature.
display acl accelerate { acl-number | all } [ |
{ begin | exclude | include }
regular-expression ] Available in any view.
Display configuration and match
statistics for IPv6 basic and IPv6
advanced ACLs.
display acl ipv6 { acl6-number | all | name
acl6-name } [ slot slot-number ] [ |{ begin |
exclude | include } regular-expression ] Available in any view.
Display the usage of ACL rules.
(See the following matrix for
information about the support for
the command.)
display acl resource [ slot slot-number ] [ |
{ begin | exclude | include }
regular-expression ] Available in any view.
Display the configuration and
status of one or all time ranges.
display time-range {time-range-name | all }
[ |{ begin | exclude | include }
regular-expression ] Available in any view.
Clear statistics for one or all IPv4
basic, IPv4 advanced, and
Ethernet frame header ACLs.
reset acl counter { acl-number | all | name
acl-name } Available in user view.
Clear statistics for one or all IPv6
basic and advanced ACLs. reset acl ipv6 counter { acl6-number | all |
name acl6-name } Available in user view.
The following matrix shows the display acl resource command and hardware compatibility:
Hardware Compatibility
HSR6602 No
6604/6608/6616 •Routers with RPE-X1 or RSE-X1 installed: Yes
•Routers with MCP installed: No
ACL configuration examples
IPv4 advanced ACL configuration examples
Network requirements
A company interconnects its departments through Router A. Configure anACL to:
•Permit access from the President office at any time to the financial database server.
•Permit access from the Financial department to the database server only during working hours
(from 8:00 to 18:00) on working days.
•Deny access from any other department to the database server.

11
Figure 1 Network diagram
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<RouterA> system-view
[RouterA] time-range work 8:0 to 18:0 working-day
# Create an IPv4 advanced ACL numbered 3000 and configure three rules in the ACL. One rule
permits access from the President office to the financial database server, one rule permits access
from the Financial department to the database server during working hours, and one rule denies
access from any other department to the database server.
[RouterA] acl number 3000
[RouterA-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination
192.168.0.100 0
[RouterA-acl-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination
192.168.0.100 0 time-range work
[RouterA-acl-adv-3000] rule deny ip source any destination 192.168.0.100 0
[RouterA-acl-adv-3000] quit
# Enable IPv4 firewall, and apply IPv4 advanced ACL 3000 to filter outgoing packets on interface
GigabitEthernet 1/0/1.
[RouterA] firewall enable
[RouterA] interface gigabitethernet 1/0/1
[RouterA-GigabitEthernet1/0/1] firewall packet-filter 3000 outbound
[RouterA-GigabitEthernet1/0/1] quit
Verifying the configuration
# Ping the database server from a PC in the Financial department during working hours. (All PCs in
this example use Windows XP.)
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Reply from 192.168.0.100: bytes=32 time=1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
President office
192.168.1.0/24 Financial department 192.168.2.0/24 Marketing department 192.168.3.0/24
Device A
GE1/0/1
GE1/0/4GE1/0/2
GE1/0/3
Financial database server
192.168.0.100/24

12
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
The output shows the database server can be pinged.
# Ping the database server from a PC in the Marketing department during working hours.
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
The output shows the database server cannot be pinged.
# Display configuration andmatch statistics for IPv4 advanced ACL3000 on Device Aduring working
hours.
[RouterA] display acl 3000
Advanced ACL 3000, named -none-, 3 rules,
ACL's step is 5
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100 0
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100 0 time-range work
(4 times matched) (Active)
rule 10 deny ip destination 192.168.0.100 0 (4 times matched)
The output shows rule 5 is active. Rule 5 and rule 10 have been matched four times as the result of
the ping operations.
IPv6 advanced ACL configuration example
Network requirements
A company interconnects its departments through Router A. Configure an ACL to do the following:
•Permit access from the President office at any time to the financial database server.
•Permit access from the Financial department to the database server only during working hours
(from 8:00 to 18:00) on working days.
•Deny access from any other department to the database server.

13
Figure 2 Network diagram
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<RouterA> system-view
[RouterA] time-range work 8:0 to 18:0 working-day
# Create an IPv6 advanced ACL numbered 3000 and configure three rules in the ACL. One rule
permits access from the President office to the database server, one rule permits access from the
Financial department to the database server during working hours, and one rule denies access from
other departments to the database server.
[RouterA] acl ipv6 number 3000
[RouterA-acl6-adv-3000] rule permit ipv6 source 1001:: 16 destination 1000::100 128
[RouterA-acl6-adv-3000] rule permit ipv6 source 1002:: 16 destination 1000::100 128
time-range work
[RouterA-acl6-adv-3000] rule deny ipv6 source any destination 1000::100 128
[RouterA-acl6-adv-3000] quit
# Enable IPv6 firewall, and apply IPv6 advanced ACL 3000 to filter outgoing IPv6 packets on
interface GigabitEthernet 1/0/1.
[RouterA] firewall ipv6 enable
[RouterA] interface gigabitethernet 1/0/1
[RouterA-GigabitEthernet1/0/1] firewall packet-filter ipv6 3000 outbound
Verifying the configuration
# Ping the database server from a PC in the Financial department during working hours. (All PCs in
this example use Windows XP.)
C:\> ping 1000::100
Pinging 1000::100 with 32 bytes of data:
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
President office
1001::/16 Financial department 1002::/16 Marketing department 1003::/16
Device A
GE1/0/1
GE1/0/4GE1/0/2
GE1/0/3
Financial database server
1000::100/16