HP Pavilion a6600 User manual

HP A6600 Routers
ACL and QoS
Configuration Guide
Abstract
This document describes the software features for the HP A Series products and guides you through the
software configuration procedures. These configuration guides also provide configuration examples to help
you apply software features to different network scenarios.
This documentation is intended for network planners, field technical support and servicing engineers, and
network administrators working with the HP A Series products.
Part number: 5998-1491
Software version: A6600-CMW520-R2603
Document version: 6PW101-20110630

Legal and notice information
© Copyright 2011 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without prior
written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for
incidental or consequential damages in connection with the furnishing, performance, or use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an additional
warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

iii
Contents
Configuring an ACL························································································································································· 1
ACL categories ·························································································································································1
Numbering and naming··········································································································································1
Match order ······························································································································································1
ACL rule numbering ·················································································································································3
Implementing time-based ACL rules························································································································3
Filtering IPv4 fragments with ACLs ·························································································································3
Applying ACL ···························································································································································3
Configuration task lists ·····················································································································································4
Configuring a time range········································································································································4
Configuring an IPv4 basic ACL ······························································································································5
Configuring an IPv6 basic ACL ······························································································································6
Configuring an IPv4 advanced ACL ······················································································································6
Configuring an IPv6 advanced ACL ······················································································································8
Configuring an Ethernet frame header ACL··········································································································9
Copying an ACL·······················································································································································9
Enabling IPv4 ACL acceleration ·························································································································· 10
Displaying and maintaining ACLs································································································································ 11
Configuration examples ················································································································································ 11
IPv4 ACL configuration example ························································································································· 11
IPv6 ACL configuration example ························································································································· 13
QoS overview ································································································································································16
QoS service models······················································································································································· 16
Best-effort service model ······································································································································· 16
IntServ model ························································································································································· 16
DiffServ model ······················································································································································· 17
QoS techniques······························································································································································ 17
Applying QoS techniques in a network·············································································································· 17
QoS processing flow in a device ························································································································ 18
Configuring QoS ···························································································································································19
Non-policy approach············································································································································ 19
Policy approach ···················································································································································· 19
Configuring a QoS policy············································································································································· 20
Defining a class ····················································································································································· 20
Defining a traffic behavior ··································································································································· 21
Defining a policy··················································································································································· 22
Configuring QoS policy nesting ·························································································································· 22
Applying the QoS policy······································································································································ 23
Displaying and maintaining QoS policies·········································································································· 25
Configuring priority mapping·······································································································································26
Overview········································································································································································· 26
Priority types ·························································································································································· 26
Priority mapping tables········································································································································· 26
Configuration task list ···················································································································································· 27
Configuring a priority mapping table················································································································· 27
Configuring a port to trust packet priority for priority mapping ······································································ 28
Changing interface port priority·························································································································· 28
Displaying and maintaining priority mapping············································································································ 28

iv
Configuration examples ················································································································································ 29
Priority trust mode configuration example ·········································································································· 29
Priority mapping table and priority marking configuration example ······························································ 30
Configuring traffic policing, traffic shaping, and line rate ·······················································································33
Traffic evaluation and token buckets··················································································································· 33
Traffic policing······················································································································································· 34
Traffic shaping······················································································································································· 35
Line rate·································································································································································· 36
Configuration task list ···················································································································································· 36
Configuring traffic policing ·································································································································· 37
Configuring GTS ···························································································································································· 38
Configuring GTS in policy approach·················································································································· 38
Configuring GTS in non-policy approach ·········································································································· 39
Configuring the line rate ··············································································································································· 40
Configuring packet resequencing ································································································································ 40
Displaying and maintaining traffic policing, GTS, and line rate·············································································· 40
Configuration examples ················································································································································ 41
IP rate limiting configuration example ················································································································ 43
Configuring congestion management ·························································································································44
Overview································································································································································ 44
Congestion management techniques ·················································································································· 46
Configuring queuing······················································································································································ 51
Configuring the FIFO queue size························································································································· 51
Configuration example ········································································································································· 52
Configuring PQ ······························································································································································ 52
PQ configuration example ··································································································································· 53
Configuring CQ ····························································································································································· 54
CQ configuration example ·································································································································· 55
Configuring WFQ·························································································································································· 55
WFQ configuration example ······························································································································· 56
Configuring CBQ ··························································································································································· 56
Predefined classes················································································································································· 56
Predefined traffic behaviors ································································································································· 57
Predefined QoS policy ········································································································································· 57
Defining a class ····················································································································································· 57
Defining a traffic behavior ··································································································································· 58
Configuring WFQ·························································································································································· 59
Configuring the maximum queue size ················································································································ 59
Using WRED drop················································································································································· 60
Defining a QoS policy·········································································································································· 62
Applying the QoS policy······································································································································ 62
Configuring the maximum available interface bandwidth ··············································································· 63
Setting the maximum reserved bandwidth as a percentage of available bandwidth ··································· 64
Displaying and maintaining CBQ ······················································································································· 64
CBQ configuration example ································································································································ 65
Configuring RTP priority queuing ································································································································· 66
Configuration procedure ······································································································································ 66
RTP priority queuing configuration example ······································································································ 66
Configuring QoS tokens················································································································································ 67
QoS token configuration example ······················································································································ 67
Configuring packet information pre-extraction ··········································································································· 68
Configuration example ········································································································································· 68

v
Configuring hardware congestion management ·······································································································69
Overview································································································································································ 69
Techniques ····························································································································································· 69
Configuration task list ···················································································································································· 73
Per-queue hardware congestion management············································································································ 73
Configuring SP queuing········································································································································ 73
Configure WRR queuing ······································································································································ 74
Configuring WFQ queuing ·································································································································· 76
Configuring CBQ ··························································································································································· 77
Configuration task list ··········································································································································· 77
Defining a class ····················································································································································· 78
Defining a traffic behavior ··································································································································· 78
Defining a QoS policy·········································································································································· 80
Applying the QoS policy······································································································································ 80
Displaying and maintaining CBQ ······················································································································· 81
CBQ configuration example ································································································································ 81
Configuring congestion avoidance······························································································································83
Configuring WRED ························································································································································ 84
Parameters ····························································································································································· 84
Configuration example ········································································································································· 85
Displaying and maintaining WRED ····························································································································· 86
Configuration example·················································································································································· 86
Configuring traffic filtering············································································································································88
Traffic filtering configuration example ························································································································· 89
Configuring priority marking········································································································································90
Configuration example·················································································································································· 91
Configuring traffic redirecting ······································································································································93
Overview········································································································································································· 93
Configuration procedure··············································································································································· 93
Configuration example·················································································································································· 94
Traffic redirection to an interface configuration································································································· 94
Configuring DAR····························································································································································97
Configuring DAR for P2P traffic recognition ··············································································································· 97
Loading the P2P signature file······························································································································ 97
Configuring a P2P protocol group ······················································································································ 97
Enabling DAR for P2P traffic recognition············································································································ 98
Configuring protocol match criteria ···················································································································· 98
Configuring DAR packet accounting··················································································································· 98
Displaying and maintaining DAR for non-P2P traffic ································································································· 99
Configuration example·················································································································································· 99
P2P downloading traffic blocking configuration example················································································ 99
Configuring class-based accounting························································································································· 101
Displaying and maintaining traffic accounting·········································································································101
Configuration example················································································································································101
Configuring QPPB······················································································································································· 103
Fundamentals································································································································································103
Configuration task list ··················································································································································103
Configuring the route sender ·····························································································································104
Configuring the route receiver ···························································································································104
Configuration examples ··············································································································································105
IPv4 QPPB configuration example·····················································································································105

vi
MPLS L3VPN QPPB configuration example······································································································107
IPv6 QPPB configuration example·····················································································································112
Configuring MPLS QoS ·············································································································································· 115
Configuring MPLS CAR·······································································································································115
Configuring MPLS priority marking ···················································································································116
Configuring MPLS congestion management ····································································································117
Configuration example················································································································································118
QoS for VPN traffic configuration ·····················································································································118
Configuring FR QoS ··················································································································································· 122
FRTS ······································································································································································122
Traffic policing·····················································································································································124
Queuing ·······························································································································································124
Congestion management····································································································································125
DE rule list ····························································································································································125
Configuration task list ··················································································································································126
Creating and configuring an FR class···············································································································126
Configuring FRTS·················································································································································127
Configuring FR traffic policing···························································································································128
Configuring FR congestion management··········································································································128
Configuring FR DE rule list ·································································································································129
Configuring FR PVC queuing ·····························································································································130
Configuring FR fragmentation····························································································································130
Displaying and maintaining FR QoS ·························································································································131
FR QoS configuration examples·································································································································131
FR fragmentation configuration example··········································································································132
Support and other resources······································································································································ 134
Contacting HP ······························································································································································134
Subscription service ············································································································································134
Related information······················································································································································134
Documents····························································································································································134
Websites ······························································································································································134
Conventions ··································································································································································135
Appendix A Default priority mapping tables··········································································································· 137
Appendix B Packet precedences······························································································································· 138
IP precedence and DSCP values ································································································································138
802.1p priority ····························································································································································139
EXP values·····································································································································································140
Index············································································································································································· 141

1
Configuring an ACL
Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document.
An ACL is a set of rules (or permit or deny statements) for identifying traffic based on criteria such as source
IP address, destination IP address, and port number.
ACLs are used primarily for packet filtering. A packet filter drops packets that match a deny rule and permits
packets that match a permit rule. ACLs are also used by many modules, for example, QoS and IP routing, for
traffic identification.
ACL categories
Category
ACL number
IP version
Match criteria
Basic ACLs
2000 to 2999
IPv4
Source IPv4 address
IPv6
Source IPv6 address
Advanced ACLs
3000 to 3999
IPv4
Source/destination IPv4 address, protocols over
IPv4, and other Layer 3 and Layer 4 header fields
IPv6
Source/destination IPv6 address, protocols over
IPv6, and other Layer 3 and Layer 4 header fields
Ethernet frame
header ACLs
4000 to 4999
IPv4 and IPv6
Layer 2 header fields, such as source and
destination MAC addresses, 802.1p priority, and
link layer protocol type
Numbering and naming
Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a number
for identification. In addition, assign the ACL a name for ease of identification. After creating an ACL with a
name, you cannot rename it or delete its name.
For an Ethernet frame header the ACL number and name must be globally unique. For an IPv4 basic or
advanced ACL, the ACL number and name must be unique among all IPv4 ACLs, and for an IPv6 basic or
advanced ACL, among all IPv6 ACLs. Assign an IPv4 ACL the same number and name as an IPv6 ACL.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the match
process and performs the action defined in the rule. If an ACL contains overlapping or conflicting rules, the
matching result and action to take depend on the rule order.
The following ACL match orders are available:
configSorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a rule
with a higher ID. If you use this approach, check the rule content and order carefully.

2
autoSorts ACL rules in depth-first order. Depth-first ordering ensures that any subset of a rule is always
matched before the rule. Table 1 lists the sequence of tiebreakers that depth-first ordering uses to sort
rules for each type of ACL.
Table 1 Sort ACL rules in depth-first order
ACL category
Sequence of tie breakers
IPv4 basic ACL
1. VPN instance
2. More 0s in the source IP address wildcard (more 0s means a narrower IP
address range)
3. Smaller rule ID
IPv4 advanced ACL
1. VPN instance
2. Specific protocol type rather than IP (IP represents any protocol over IP)
3. More 0s in the source IP address wildcard mask
4. More 0s in the destination IP address wildcard
5. Narrower TCP/UDP service port number range
6. Smaller ID
IPv6 basic ACL
1. Longer prefix for the source IP address (a longer prefix means a narrower
IP address range)
2. Smaller ID
IPv6 advanced ACL
1. Specific protocol type rather than IP (IP represents any protocol over
IPv6)
2. Longer prefix for the source IPv6 address
3. Longer prefix for the destination IPv6 address
4. Narrower TCP/UDP service port number range
5. Smaller ID
Ethernet frame header ACL
1. More 1s in the source MAC address mask (more 1s means a smaller
MAC address)
2. More 1s in the destination MAC address mask
3. Smaller ID
NOTE:
A wildcard mask, also called an "inverse mask," is a 32-bit binary and represented in dotted decimal
notation. In contrast to a network mask, the 0 bits in a wildcard mask represent 'do care' bits, and the 1
bits represent 'don’t care' bits. If the 'do care' bits in an IP address are identical to the 'do care' bits in an
IP address criterion, the IP address matches the criterion. All 'don’t care' bits are ignored. The 0s and 1s
in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid wildcard mask.

3
ACL rule numbering
If you do not assign an ID for the rule you are creating, the system automatically assigns it a rule ID.
Rule numbering step
The rule numbering step sets the increment by which the system automatically numbers rules. For example,
the default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are numbered
0, 5, 10, 15, and so on. The wider the numbering step, the more rules insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of
inserting rules in an ACL. This feature is important for a configuration order ACL, where ACL rules are
matched in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to the
current highest rule ID, starting with 0.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10, and
12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule is numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules
numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4,
6, and 8.
Implementing time-based ACL rules
Implement ACL rules based on the time of day by applying a time range to them. A time-based ACL rule takes
effect only in any time periods specified by the time range.
The following basic types of time ranges are available:
Periodic time rangeRecurs periodically on a day or days of the week.
Absolute time rangeRepresents only a period of time and does not recur.
You may apply a time range to ACL rules before or after you create it. However, the rules using the time range
can take effect only after you define the time range.
Filtering IPv4 fragments with ACLs
Traditional packet filtering matches only first fragments of IPv4 packets, and allows all subsequent non-first
fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid the risks, the HP ACL implementation:
Filters all fragments by default, including non-first fragments.
Provides ACL-based firewalls with standard and exact match modes for matching ACLs that contain
advanced attributes, such as TCP/UDP port number and ICMP type. The standard match mode is the
default mode; it considers only Layer 3 attributes. Exact match considers all header attributes defined
in IPv4 ACL rules. For more information, see Security Configuration Guide.
Applying ACL
Use ACLs in QoS, firewall, routing, and other technologies for identifying traffic.

4
Configuration task lists
IPv4 ACL configuration task list
Task
Remarks
Configuring a time range
Optional
Configuring an IPv4 basic ACL
Required
Configure at least one task
Configuring an IPv4 advanced ACL
Configuring an Ethernet frame header ACL
Copying an IPv4 ACL
Optional
Enabling IPv4 ACL acceleration
Optional
IPv6 ACL configuration task list
Task
Remarks
Configuring a time range
Optional
Configuring an IPv6 basic ACL
Required
Configure at least one task
Configuring an IPv6 advanced ACL
Configuring an Ethernet frame header ACL
Copying an IPv6 ACL
Optional
Configuring a time range
Create multiple statements in a time range. The active period of a time range is calculated as follows:
1. Combining all periodic statements
2. Combining all absolute statements
3. Taking the intersection of the two statement sets as the active period of the time range

5
Create a maximum of 256 time ranges, each with 32 periodic statements and 12 absolute statements at
most.
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Configure a time range.
time-range time-range-name
{ start-time to end-time days [ from
time1 date1 ] [ to time2 date2 ] |
from time1 date1 [ to time2 date2 ]
| to time2 date2 }
Required.
By default, no time range exists.
Repeat this command with the same
time range name to create multiple
statements for a time range.
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based on only a source IP address.
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Create an IPv4 basic ACL
and enter its view.
acl number acl-number [ name
acl-name ] [ match-order { auto |
config } ]
Required.
By default, no ACL exists.
IPv4 basic ACLs are numbered in the
range 2000 to 2999.
Use acl name acl-name to enter the view
of a named IPv4 ACL.
3. Configure a description for
the IPv4 basic ACL.
description text
Optional.
By default, an IPv4 basic ACL has no
ACL description.
4. Set the rule numbering
step.
step step-value
Optional.
5 by default.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ counting | fragment |logging |
source {sour-addr sour-wildcard |
any } | time-range
time-range-name | vpn-instance
vpn-instance-name ] *
Required.
By default, an IPv4 basic ACL does not
contain any rule.
To create or edit multiple rules, repeat
this step.
The logging keyword takes effect only
when the module (for example, a
firewall) that uses the ACL supports
logging.
6. Configure or edit a rule
description.
rule rule-id comment text
Optional.
By default, an IPv4 ACL rule has no rule
description.

6
Configuring an IPv6 basic ACL
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Create an IPv6 basic ACL view
and enter its view.
acl ipv6 number acl6-number
[ name acl6-name ] [ match-order
{ auto | config } ]
Required.
By default, no ACL exists.
IPv6 basic ACLs are numbered in
the range 2000 to 2999.
Use acl ipv6 name acl6-name to
enter the view of a named IPv6
ACL.
3. Configure a description for the
IPv6 basic ACL.
description text
Optional.
By default, an IPv6 basic ACL has
no ACL description.
4. Set the rule numbering step.
step step-value
Optional.
5 by default.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ counting | fragment |logging |
source { ipv6-address prefix-length
| ipv6-address/prefix-length |
any } | time-range
time-range-name ] *
Required.
By default, an IPv6 basic ACL does
not contain any rule.
To create or edit multiple rules,
repeat this step.
The logging keyword takes effect
only when the module (for
example, a firewall) using the ACL
supports logging.
6. Configure or edit a rule
description.
rule rule-id comment text
Optional.
By default, an IPv6 basic ACL rule
has no rule description.
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on source and destination IP addresses, protocols over IP, and
other protocol header information, such as TCP/UDP source and destination port numbers, TCP flags, ICMP
message types, and ICMP message codes.
IPv4 advanced ACLs also allow you to filter packets based on priority criteria: ToS, IP precedence, and DSCP
priority.

7
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Create an IPv4 advanced ACL
and enter its view.
acl number acl-number [ name
acl-name ] [ match-order { auto |
config } ]
Required.
By default, no ACL exists.
IPv4 advanced ACLs are
numbered in the range 3000 to
3999.
Use acl name acl-name to enter the
view of a named IPv4 ACL.
3. Configure a description for the
IPv4 advanced ACL.
description text
Optional.
By default, an IPv4 advanced ACL
has no ACL description.
4. Set the rule numbering step.
step step-value
Optional.
5 by default.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination { dest-addr
dest-wildcard | any } |
destination-port operator port1
[port2 ] | dscp dscp | fragment |
icmp-type { icmp-type icmp-code |
icmp-message } | logging |
precedence precedence | reflective
| source {sour-addr sour-wildcard
| any } | source- port operator
port1 [ port2 ] | time-range
time-range-name | tos tos |
vpn-instance vpn-instance- name ]
*
Required.
By default, an IPv4 advanced ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
The logging keyword takes effect
only when the module (for
example, a firewall) using the ACL
supports logging.
6. Configure or edit a rule
description.
rule rule-id comment text
Optional.
By default, an IPv4 advanced ACL
rule has no rule description.

8
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the source IPv6 address, destination IPv6 address, protocol
carried over IPv6, and other protocol header fields such as the TCP/UDP source port number, TCP/UDP
destination port number, ICMP message type, and ICMP message code.
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Create an IPv6 advanced
ACL and enter its view.
acl ipv6 number acl6-number [ name
acl6-name ] [ match-order { auto |
config } ]
Required.
By default, no ACL exists.
IPv6 advanced ACLs are
numbered in the range 3000 to
3999.
Use acl ipv6 name acl6-name to
enter the view of a named IPv6
ACL.
3. Configure a description for
the IPv6 advanced ACL.
description text
Optional.
By default, an IPv6 advanced
ACL has no ACL description.
4. Set the rule numbering
step.
step step-value
Optional.
5 by default.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit } protocol
[ { { ack ack-value | fin fin-value | psh
psh-value | rst rst-value | syn syn-value |
urg urg-value } * | established } |
counting | destination { dest dest-prefix |
dest/dest-prefix | any } | destination-
port operator port1 [ port2 ] | dscp dscp
| flow-label flow-label-value | fragment
| icmp6-type { icmp6-type icmp6-code |
icmp6-message } | logging | source
{source source-prefix |
source/source-prefix | any } | source-
port operator port1 [ port2 ] | time-
range time-range-name ] *
Required.
By default IPv6 advanced ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
The logging keyword takes effect
only when the module (for
example, a firewall) using the
ACL supports logging.
6. Configure or edit a rule
description.
rule rule-id comment text
Optional.
By default, an IPv6 advanced
ACL rule has no rule description.

9
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol header
fields such as source MAC address, destination MAC address, 802.1p priority (VLAN priority), and link layer
protocol type.
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Create an Ethernet frame
header ACL and enter its view.
acl number acl-number [ name
acl-name ] [ match-order { auto |
config } ]
Required.
By default, no ACL exists.
Ethernet frame header ACLs are
numbered in the range 4000 to
4999.
Use acl name acl-name to enter the
view of a named Ethernet frame
header ACL.
3. Configure a description for the
Ethernet frame header ACL.
description text
Optional.
By default, an Ethernet frame
header ACL has no ACL
description.
4. Set the rule numbering step.
step step-value
Optional.
5 by default.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit } [ cos
vlan-pri | counting | dest- mac
dest-addr dest-mask | { lsap
lsap-type lsap-type-mask | type
protocol-type protocol-type-mask }
| source-mac sour-addr source-
mask | time-range time-range-
name ] *
Required.
By default,an Ethernet frame
header ACL does not contain any
rule.
To create or edit multiple rules,
repeat this step.
6. Configure or edit a rule
description.
rule rule-id comment text
Optional.
By default, an Ethernet frame
header ACL rule has no rule
description.
Copying an ACL
Create an ACL by copying an existing ACL. The new ACL has the same properties and content as the source
ACL, except the ACL number and name.
To successfully copy an ACL, ensure the following:
The destination ACL number is from the same category as the source ACL number.
The source ACL already exists but the destination ACL does not.

10
Copying an IPv4 ACL
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Copy an existing IPv4 ACL to create a
new IPv4 ACL.
acl copy { source-acl-number | name
source-acl-name } to { dest-acl-number |
name dest-acl-name }
Required.
Copying an IPv6 ACL
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Copy an existing IPv6 ACL to generate a
new one of the same category.
acl ipv6 copy { source-acl6-number | name
source-acl6-name } to { dest-acl6-number |
name dest-acl6-name }
Required.
Enabling IPv4 ACL acceleration
ACL acceleration speeds up ACL lookup. The acceleration effect increases with the number of ACL rules. ACL
acceleration uses memory. To achieve the best trade-off between memory and ACL processing performance,
HP recommends enabling ACL acceleration for large ACLs.
For example, when you use a large ACL for a session-based service, such as NAT or ASPF, enable ACL
acceleration to avoid session timeouts caused by ACL processing delays.
Enable ACL acceleration in an ACL after you have finished editing ACL rules. ACL acceleration always uses
ACL criteria that have been set before it is enabled for rule matching. It does not synchronize with any
subsequent match criterion changes.
ACL acceleration is not available for ACLs that contain a non-contiguous wildcard mask.
After you modify an IPv4 ACL with ACL acceleration enabled, disable and re-enable ACL acceleration
to ensure correct rule matching.
To enable ACL acceleration for an IPv4 ACL:
To do…
Command…
Remarks
1. Enter system view.
system-view

2. Enable ACL acceleration for an
IPv4 ACL.
acl accelerate number
acl-number
Required.
Disabled by default.
The ACL must exist.
Only IPv4 basic ACLs and advanced
ACLs support ACL acceleration.

11
Displaying and maintaining ACLs
To do...
Command…
Remarks
Display the IPv4 ACL configuration and
match statistics (centralized device).
display acl { acl-number | all | name
acl-name } [ |{ begin | exclude |
include } regular-expression ]
Available in any view.
Display the IPv4 ACL configuration and
match statistics (distributed device).
display acl { acl-number | all | name
acl-name } [ slot slot-number ] [ |
{ begin | exclude | include }
regular-expression ]
Available in any view.
Display information about the IPv4 ACL
acceleration feature.
display acl accelerate { acl-number |
all } [ |{ begin | exclude | include }
regular-expression ]
Available in any view.
Display the IPv6 ACL configuration and
match statistics (centralized device).
display acl ipv6 { acl6-number | all |
name acl6-name } [ |{ begin |
exclude | include } regular-
expression ]
Available in any view.
Display the IPv6 ACL configuration and
match statistics (distributed device).
display acl ipv6 { acl6-number | all |
name acl6-name } [ slot slot-number ]
[ |{ begin | exclude | include }
regular-expression ]
Available in any view.
Display the usage of ACL rules (distributed
device).
display acl resource [ slot slot-
number ] [ |{ begin | exclude |
include } regular-expression ]
Available in any view.
Display the configuration and status of one
or all time ranges.
display time-range {time-range-name
| all } [ |{ begin | exclude | include }
regular-expression ]
Available in any view.
Clear statistics for one or all IPv4 ACLs.
reset acl counter { acl-number | all |
name acl-name }
Available in user view.
Clear statistics for one or all IPv6 basic and
advanced ACLs.
reset acl ipv6 counter { acl6-number |
all | name acl6-name }
Available in user view.
Configuration examples
IPv4 ACL configuration example
Network requirements
A company interconnects its departments through Router A. Configure an ACL to do the following:
Permit access from the president's office to the financial database server at any time.
Permit access from the financial department to the database server only during working hours (from
8:00 to 18:00) on working days.
Deny access from any other department to the database server.

12
Figure 1 IPv4 ACL
President’s office
192.168.1.0/24 Financial department
192.168.2.0/24 Marketing department 192.168.3.0/24
Router A
GE1/0/1
GE1/0/4GE1/0/2
GE1/0/3
Financial database server
192.168.0.100/24
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<RouterA> system-view
[RouterA] time-range work 8:0 to 18:0 working-day
# Create an IPv4 advanced ACL numbered 3000 and configure three rules in the ACL. One rule permits
access from the poffice to the financial database server, one rule permits access from the financial
department to the database server during working hours, and one rule denies access from any other
department to the database server.
[RouterA] acl number 3000
[RouterA-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100
0
[RouterA-acl-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100
0 time-range work
[RouterA-acl-adv-3000] rule deny ip source any destination 192.168.0.100 0
[RouterA-acl-adv-3000] quit
# Enable IPv4 firewall, and apply IPv4 ACL 3000 to filter outgoing packets on interface GigabitEthernet
1/0/1.
[RouterA] firewall enable
[RouterA] interface gigabitethernet 1/0/1
[RouterA-GigabitEthernet1/0/1] firewall packet-filter 3000 outbound
[RouterA-Ethernet1/1] quit
Verification
# Ping the database server from a PC in the financial department during the working hours. (All PCs in this
example use Windows XP).
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Reply from 192.168.0.100: bytes=32 time=1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255

13
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
The output shows that the database server can be pinged.
# Ping the database server from a PC in the marketing department during the working hours.
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
The output shows the database server cannot be pinged.
# Display configuration and match statistics for IPv4 ACL 3000 on Router A during the working hours.
[RouterA] display acl 3000
Advanced ACL 3000, named -none-, 3 rules,
ACL's step is 5
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100 0
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100 0 time-range work
(4 times matched) (Active)
rule 10 deny ip destination 192.168.0.100 0 (4 times matched)
The output shows rule 5 is active. Rule 5 and rule 10 have been matched four times as the result of the ping
operations.
IPv6 ACL configuration example
Network requirements
A company interconnects its departments through Router A. Configure an ACL to do the following:
Permit access from the president's office at any time to the financial database server.
Permit access from the financial department to the database server only during working hours (from
8:00 to 18:00) on working days.
Deny access from any other department to the database server.

14
Figure 2 IPv6 ACL
Router A
GE1/0/1
GE1/0/4GE1/0/2
GE1/0/3
Financial database server
1000::100/16
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<RouterA> system-view
[RouterA] time-range work 8:0 to 18:0 working-day
# Create an IPv6 advanced ACL numbered 3000 and configure three rules in the ACL. One rule permits
access from the  office to the database server, one rule permits access from the financial
department to the database server during working hours, and one rule denies access from other departments
to the database server.
[RouterA] acl ipv6 number 3000
[RouterA-acl6-adv-3000] rule permit ipv6 source 1001:: 16 destination 1000::100 128
[RouterA-acl6-adv-3000] rule permit ipv6 source 1002:: 16 destination 1000::100 128 time-range
work
[RouterA-acl6-adv-3000] rule deny ipv6 source any destination 1000::100 128
[RouterA-acl6-adv-3000] quit
# Enable IPv6 firewall, and apply IPv6 ACL 3000 to filter outgoing packets on interface GigabitEthernet
1/0/1.
[RouterA] firewall ipv6 enable
[RouterA] interface gigabitethernet 1/0/1
[RouterA-GigabitEthernet1/0/1] firewall packet-filter ipv6 3000 outbound
Verification
# Ping the database server from a PC in the financial department during the working hours. (All PCs in this
example use Windows XP).
C:\> ping 1000::100
Pinging 1000::100 with 32 bytes of data:
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Ping statistics for 1000::100: