HP 6125XLG Installation manual

HP 6125XLG Blade Switch
A
CL and QoS
Command Reference
Part number: 5998-3737
Software version: Release 2306
Document version: 6W100-20130912

Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.

i
Contents
ACL commands ···························································································································································· 1
acl ··············································································································································································1
acl copy·····································································································································································2
acl logging interval ··················································································································································3
acl name····································································································································································4
description·································································································································································4
display acl·································································································································································5
display packet-filter ··················································································································································6
display packet-filter statistics ···································································································································8
display packet-filter statistics sum ···························································································································9
display packet-filter verbose································································································································· 11
display qos-acl resource ······································································································································· 12
packet-filter····························································································································································· 13
packet-filter default deny ······································································································································ 14
reset acl counter ···················································································································································· 15
reset packet-filter statistics····································································································································· 16
rule (Ethernet frame header ACL view) ··············································································································· 17
rule (IPv4 advanced ACL view)···························································································································· 18
rule (IPv4 basic ACL view)···································································································································· 23
rule (IPv6 advanced ACL view)···························································································································· 24
rule (IPv6 basic ACL view)···································································································································· 29
rule comment·························································································································································· 31
step·········································································································································································· 32
QoS policy commands ··············································································································································34
Traffic class commands ················································································································································· 34
display traffic classifier ········································································································································· 34
if-match ··································································································································································· 35
traffic classifier······················································································································································· 40
Traffic behavior commands··········································································································································· 40
accounting······························································································································································ 40
car··········································································································································································· 41
display traffic behavior········································································································································· 42
filter ········································································································································································· 44
nest top-most ·························································································································································· 44
redirect ··································································································································································· 45
remark customer-vlan-id ········································································································································ 46
remark dot1p ························································································································································· 46
remark drop-precedence ······································································································································ 47
remark dscp ··························································································································································· 48
remark ip-precedence ··········································································································································· 49
remark local-precedence ······································································································································ 50
remark qos-local-id ················································································································································ 50
remark service-vlan-id ··········································································································································· 51
traffic behavior ······················································································································································ 51
QoS policy commands ·················································································································································· 52
classifier behavior ················································································································································· 52
control-plane ·························································································································································· 53
display qos policy ················································································································································· 53

ii
display qos policy control-plane·························································································································· 54
display qos policy control-plane pre-defined ····································································································· 56
display qos policy global ····································································································································· 56
display qos policy interface ································································································································· 58
display qos vlan-policy ········································································································································· 59
qos apply policy (interface view, control plane view) ······················································································ 61
qos apply policy global········································································································································ 62
qos policy······························································································································································· 62
qos vlan-policy······················································································································································· 63
reset qos policy control-plane ······························································································································ 64
reset qos policy global·········································································································································· 64
reset qos vlan-policy·············································································································································· 65
Priority mapping commands ·····································································································································66
Priority map commands················································································································································· 66
display qos map-table··········································································································································· 66
import······································································································································································ 67
qos map-table ························································································································································ 67
Port priority commands·················································································································································· 68
qos priority····························································································································································· 68
Priority trust mode commands······································································································································· 69
display qos trust interface····································································································································· 69
qos trust ·································································································································································· 69
GTS and rate limit commands···································································································································71
GTS commands ······························································································································································ 71
display qos gts interface······································································································································· 71
qos gts ···································································································································································· 71
Rate limit commands······················································································································································ 72
display qos lr interface ········································································································································· 72
qos lr······································································································································································· 73
Congestion management commands ·······················································································································75
SP commands ································································································································································· 75
display qos sp························································································································································ 75
qos sp ····································································································································································· 75
WRR commands····························································································································································· 76
display qos wrr interface······································································································································ 76
qos wrr ··································································································································································· 77
qos wrr { byte-count | weight }···························································································································· 78
qos wrr group sp··················································································································································· 79
WFQ commands···························································································································································· 80
display qos wfq interface ····································································································································· 80
qos bandwidth queue ··········································································································································· 81
qos wfq··································································································································································· 82
qos wfq { byte-count | weight } ··························································································································· 83
qos wfq group sp ·················································································································································· 84
Congestion avoidance commands····························································································································85
display qos wred interface··································································································································· 85
display qos wred table ········································································································································· 85
qos wred apply ····················································································································································· 87
qos wred table······················································································································································· 87
queue······································································································································································ 88
queue ecn······························································································································································· 89
queue weighting-constant ····································································································································· 90

iii
Aggregate CAR commands·······································································································································92
car name ································································································································································ 92
display qos car name ··········································································································································· 92
qos car···································································································································································· 93
reset qos car name················································································································································ 95
Data buffer commands ··············································································································································96
buffer apply···························································································································································· 96
buffer queue guaranteed ······································································································································ 96
buffer queue shared ·············································································································································· 97
buffer total-shared·················································································································································· 98
burst-mode enable················································································································································· 99
display buffer ·······················································································································································100
Time range commands ··········································································································································· 102
display time-range···············································································································································102
time-range ····························································································································································102
Support and other resources ·································································································································· 105
Contacting HP ······························································································································································105
Subscription service ············································································································································105
Related information······················································································································································105
Documents····························································································································································105
Websites·······························································································································································105
Conventions ··································································································································································106
Index ········································································································································································ 108

1
ACL commands
acl
Use acl to create an ACL, and enter its view. If the ACL has been created, you directly enter its view.
Use undo acl to delete the specified or all ACLs.
Syntax
acl [ ipv6 ] number acl-number [ name acl-name ] [ match-order { auto | config } ]
undo acl [ ipv6 ] { all | name acl-name | number acl-number }
Default
No ACL exists.
Views
System view
Predefined user roles
network-admin
Parameters
number acl-number: Specifies the number of an ACL:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
name acl-name: Assigns a name to the ACL for easy identification. The acl-name argument is a
case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid confusion, it
cannot be all.
match-order: Sets the order in which ACL rules are compared against packets.
•auto: Compares ACL rules in depth-first order. The depth-first order differs with ACL categories. For
more information, see ACL and QoS Configuration Guide.
•config: Compares ACL rules in ascending order of rule ID. The rule with a smaller ID has higher
priority. If no match order is specified, the config-order applies by default.
all: Specifies all ACLs.
•If the ipv6 keyword is not specified, all ACLs refer to all IPv4 basic, IPv4 advanced, and Ethernet
frame header ACLs.
•If the ipv6 keyword is specified, all ACLs refer to all IPv6 basic and IPv6 advanced ACLs.
Usage guidelines
You can assign a name to an ACL only when you create it. After an ACL is created with a name, you
cannot rename it or remove its name.

2
You can change the match order only for ACLs that do not contain any rules.
Examples
# Create IPv4 basic ACL 2000, and enter its view.
<Sysname> system-view
[Sysname] acl number 2000
[Sysname-acl-basic-2000]
# Create IPv4 basic ACL 2001 with the name flow, and enter its view.
<Sysname> system-view
[Sysname] acl number 2001 name flow
[Sysname-acl-basic-2001-flow]
Related commands
display acl
acl copy
Use acl copy to create an ACL by copying an ACL that already exists.
Syntax
acl [ ipv6 ] copy { source-acl-number | name source-acl-name } to { dest-acl-number | name
dest-acl-name }
Views
System view
Predefined user roles
network-admin
Parameters
source-acl-number: Specifies an existing source ACL by its number:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
name source-acl-name: Specifies an existing source ACL by its name. The source-acl-name argument is
a case-insensitive string of 1 to 63 characters. For a basic ACL or advanced ACL, if you do not specify
the ipv6 keyword, this option specifies the name of an IPv4 basic ACL or advanced ACL; if you specify
the ipv6 keyword, this option specifies the name of an IPv6 basic ACL or advanced ACL.
dest-acl-number: Assigns a unique number to the ACL you are creating. This number must be from the
same ACL category as the source ACL. If no ACL number is specified, the system automatically picks the
smallest number from all available numbers in the same ACL category as the source ACL. Available
value ranges include:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.

3
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
name dest-acl-name: Assigns a unique name to the ACL you are creating. The dest-acl-name is a
case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid confusion, it
cannot be all. If no ACL name is specified, the system does not name the ACL. For a basic ACL or
advanced ACL, if you do not specify the ipv6 keyword, this option specifies the name of an IPv4 basic
ACL or advanced ACL; if you specify the ipv6 keyword, this option specifies the name of an IPv6 basic
ACL or advanced ACL.
Usage guidelines
The new ACL has the same properties and content as the source ACL, but not the same ACL number and
name.
You can assign a name to an ACL only when you create it. After an ACL is created with a name, you
cannot rename it or remove its name.
Examples
# Create IPv4 basic ACL 2002 by copying IPv4 basic ACL 2001.
<Sysname> system-view
[Sysname] acl copy 2001 to 2002
acl logging interval
Use acl logging interval to set the interval for generating and outputting packet filtering logs. The log
information includes the number of matching packets and the matched ACL rules.
Use undo acl logging interval to restore the default.
Syntax
acl [ ipv6 ] logging interval interval
undo acl [ ipv6 ] logging interval
Default
The interval is 0. No packet filtering logs are generated.
Views
System view
Predefined user roles
network-admin
Parameters
interval: Specifies the interval in minutes at which packet filtering logs are generated and output. It must
be a multiple of 5 and in the range of 0 to 1440. To disable generating packet filtering logs, assign 0
to the argument.
Usage guidelines
The system collects packet filtering logs for only IPv4 basic, IPv4 advanced, IPv6 basic, and IPv6
advanced ACL rules that have the logging keyword.
When the ipv6 keyword is not specified, this command sets the interval for generating and outputting
IPv4 packet filtering logs.

4
When the ipv6 keyword is specified, this command sets the interval for generating and outputting IPv6
packet filtering logs.
Examples
# Enable the device to generate and output IPv4 packet filtering logs at 10-minute intervals.
<Sysname> system-view
[Sysname] acl logging interval 10
Related commands
•rule (IPv4 advanced ACL view)
•rule (IPv4 basic ACL view)
•rule (IPv6 advanced ACL view)
•rule (IPv6 basic ACL view)
acl name
Use acl name to enter the view of an ACL that has a name.
Syntax
acl [ ipv6 ] name acl-name
Views
System view
Predefined user roles
network-admin
Parameters
acl-name: Specifies the name of an ACL, a case-insensitive string of 1 to 63 characters. It must start with
an English letter. The ACL must already exist. For a basic ACL or advanced ACL, if you do not specify the
ipv6 keyword, this option specifies the name of an IPv4 basic ACL or advanced ACL. If you specify the
ipv6 keyword, this option specifies the name of an IPv6 basic ACL or advanced ACL.
Examples
# Enter the view of IPv4 basic ACL flow, which already exists.
<Sysname> system-view
[Sysname] acl name flow
[Sysname-acl-basic-2001-flow]
# Enter the view of IPv6 basic ACL flow, which already exists.
<Sysname> system-view
[Sysname] acl ipv6 name flow
[Sysname-acl6-basic-2001-flow]
Related commands
acl
description
Use description to configure a description for an ACL.

5
Use undo description to delete an ACL description.
Syntax
description text
undo description
Default
An ACL has no description.
Views
IPv4 basic/advanced ACL view, IPv6 basic/advanced ACL view, Ethernet frame header ACL view
Predefined user roles
network-admin
Parameters
text: Configures a description for the ACL, a case-sensitive string of 1 to 127 characters.
Examples
# Configure a description for IPv4 basic ACL 2000.
<Sysname> system-view
[Sysname] acl number 2000
[Sysname-acl-basic-2000] description This is an IPv4 basic ACL.
Related commands
display acl
display acl
Use display acl to display configuration and match statistics for ACLs.
Syntax
display acl [ ipv6 ] { acl-number | all | name acl-name }
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
acl-number: Specifies an ACL by its number:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.

6
all: Displays information about all IPv4 basic, IPv4 advanced, and Ethernet frame header ACLs if you do
not specify the ipv6 keyword, or displays information about all IPv6 basic and IPv6 advanced ACLs if
you specify the ipv6 keyword.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to
63 characters. It must start with an English letter. For a basic ACL or advanced ACL, if you do not specify
the ipv6 keyword, this option specifies the name of an IPv4 basic ACL or advanced ACL. If you specify
the ipv6 keyword, this option specifies the name of an IPv6 basic ACL or advanced ACL.
Usage guidelines
This command displays ACL rules in config or depth-first order, whichever is configured.
Examples
# Display configuration and match statistics for IPv4 basic ACL 2001.
<Sysname> display acl 2001
Basic ACL 2001, named flow, 1 rule, match-order is auto,
This is an IPv4 basic ACL.
ACL's step is 5
rule 5 permit source 1.1.1.1 0 (5 times matched)
rule 5 comment This rule is used on FortyGigE 1/1/1.
Table 1 Command output
Field Descri
p
tion
Basic ACL 2001 Category and number of the ACL. The following field information is about
IPv4 basic ACL 2000.
named flow The name of the ACL is flow. If the ACL is not named, this field displays
-none-.
1 rule The ACL contains one rule.
match-order is auto The match order for the ACL is auto, which sorts ACL rules in depth-first
order. This field is not present when the match order is config.
This is an IPv4 basic ACL. Description of this ACL.
ACL's step is 5 The rule numbering step is 5.
rule 5 permit source 1.1.1.1 0 Content of rule 5.
5 times matched
There have been five matches for the rule. The statistic counts only ACL
matches performed in software.
This field is not displayed when no packets matched the rule.
rule 5 comment This rule is used
on FortyGigE 1/1/1. Comment of ACL rule 5.
display packet-filter
Use display packet-filter to display whether an ACL has been successfully applied to an interface for
packet filtering.
Syntax
display packet-filter { interface [ interface-type interface-number ] [ inbound | outbound ] | interface
vlan-interface vlan-interface-number [ inbound | outbound ] [ slot slot-number ] }

7
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface [ interface-type interface-number ]: Specifies an interface by its type and number. VLAN
interfaces are not supported. If no interface is specified, the command displays ACL application
information on all interfaces except VLAN interfaces for packet filtering.
interface vlan-interface vlan-interface-number: Specifies a VLAN interface by its number.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
slot slot-number: Specifies an IRF member device. The slot-number argument represents the ID of the IRF
member device. If no IRF member device is specified, the command displays ACL application information
for packet filtering on the master.
Usage guidelines
If you specify neither the inbound keyword nor the outbound keyword, the command displays the ACL
application information for both incoming and outgoing packet filtering.
Examples
# Display ACL application information for incoming packet filtering on interface FortyGigE 1/1/1.
<Sysname> display packet-filter interface FortyGigE 1/1/1
Interface: FortyGigE1/1/1
In-bound policy:
ACL 2001, Hardware-count
Default action: Deny
Out-bound policy:
ACL 2005
Default action: Deny
Table 2 Command output
Field Descri
p
tion
Interface Interface to which the ACL applies.
In-bound policy ACL used for filtering incoming traffic.
Out-bound policy ACL used for filtering outgoing traffic.
ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
Hardware-count Successfully enables counting ACL rule matches.
Default action
Default action for packet filtering, namely, the action to take on
packets that do not match the ACL. Deny means to drop the packets.
If the default action is to permit the packets to pass through, the field
is not displayed.

8
display packet-filter statistics
Use display packet-filter statistics to display match statistics of ACLs for packet filtering.
Syntax
display packet-filter statistics interface interface-type interface-number { inbound | outbound } [ [ ipv6 ]
{ acl-number | name acl-name } ] [ brief ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Displays the statistics of an interface specified by its type and
number.
inbound: Displays the statistics in the inbound direction.
outbound: Displays the statistics in the outbound direction.
acl-number: Specifies the number of an ACL:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to
63 characters. It must start with an English letter. For a basic ACL or advanced ACL, if you do not specify
the ipv6 keyword, this option specifies the name of an IPv4 basic ACL or advanced ACL. If you specify
the ipv6 keyword, this option specifies the name of an IPv6 basic ACL or advanced ACL.
brief: Displays brief statistics.
Usage guidelines
When none of acl-number and name acl-name is specified, this command displays match statistics of all
ACLs for packet filtering.
•If the ipv6 keyword is not specified, all ACLs refer to all IPv4 basic, IPv4 advanced, and Ethernet
frame header ACLs.
•If the ipv6 keyword is specified, all ACLs refer to all IPv6 basic and IPv6 advanced ACLs.
Examples
# Display match statistics of all ACLs (including IPv4 basic, IPv4 advanced, and Ethernet frame header
ACLs) for incoming packet filtering on FortyGigE 1/1/1.
<Sysname> display packet-filter statistics interface FortyGigE 1/1/1 inbound
Interface: FortyGigE1/1/1
In-bound policy:
ACL 2000, Hardware-count

9
From 2013-01-01 05:16:55 to 2013-01-01 05:17:30
rule 0 permit source 2.2.2.2 0
rule 5 permit source 192.168.0.0 0.0.0.255 (2 packets)
Totally 2 packets, 100% permitted
Totally 0 packets, 0% denied
Default action: Deny
Table 3 Command output
Field Descri
p
tion
Interface Interface to which the ACL applies.
In-bound policy ACL used for filtering incoming traffic.
Out-bound policy ACL used for filtering outgoing traffic.
ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
Hardware-count Successfully enables counting ACL rule matches.
From 2013-01-01 00:46:14 to
2013-01-01 01:46:20 Start time and end time of the statistics.
2 packets Two packets matched the rule. When zero packets matched the
rule, the field is not displayed.
Totally 2 packets, 100% permitted Number of packets permitted by the ACL, and the ratio of
permitted packets to all packets.
Totally 0 packets, 0% denied Number of packets denied by the ACL, and the ratio of denied
packets to all packets.
Default action
Default action for packet filtering, namely, the action to take on
packets that do not match the ACL. Deny means to drop the
packets. If the default action is to permit the packets to pass
through, the field is not displayed.
Related commands
reset packet-filter statistics
display packet-filter statistics sum
Use display packet-filter statistics sum to display accumulated packet filtering ACL statistics.
Syntax
display packet-filter statistics sum { inbound | outbound } [ ipv6 ] { acl-number | name acl-name }
[ brief ]
Views
Any view
Predefined user roles
network-admin
network-operator

10
Parameters
inbound: Displays the statistics in the inbound direction.
outbound: Displays the statistics in the outbound direction.
acl-number: Specifies the number of an ACL:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to
63 characters. It must start with an English letter. For a basic ACL or advanced ACL, if you do not specify
the ipv6 keyword, this option specifies the name of an IPv4 basic ACL or advanced ACL; if you specify
the ipv6 keyword, this option specifies the name of an IPv6 basic ACL or advanced ACL.
brief: Displays brief accumulated packet filtering ACL statistics.
Examples
# Display accumulated packet filtering ACL statistics of IPv4 basic ACL 2001 for incoming packets.
<Sysname> display packet-filter statistics sum inbound 2001
Sum:
In-bound policy:
ACL 2001
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0
Totally 2 packets, 100% permitted
Totally 0 packets, 0% denied
Table 4 Command output
Field Descri
p
tion
Sum Accumulated packet filtering ACL statistics.
In-bound policy Accumulated ACL statistics used for filtering incoming traffic.
Out-bound policy Accumulated ACL statistics used for filtering outgoing traffic.
ACL 2001 Accumulated ACL statistics used for IPv4 basic ACL 2001.
2 packets Two packets matched the rule. When zero packets matched the
rule, the field is not displayed.
Totally 2 packets, 100% permitted Number of packets permitted by the ACL, and the ratio of
permitted packets to all packets.
Totally 0 packets, 0% denied Number of packets denied by the ACL, and the ratio of denied
packets to all packets.
Related commands
reset packet-filter statistics

11
display packet-filter verbose
Use display packet-filter verbose to display application details of ACLs for packet filtering.
Syntax
display packet-filter verbose interface interface-type interface-number { inbound | outbound } [ [ ipv6 ]
{ acl-number | name acl-name } ] [ slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
acl-number: Specifies the number of an ACL:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to
63 characters. It must start with an English letter. For a basic ACL or advanced ACL, if you do not specify
the ipv6 keyword, this option specifies the name of an IPv4 basic ACL or advanced ACL. If you specify
the ipv6 keyword, this option specifies the name of an IPv6 basic ACL or advanced ACL.
slot slot-number: Specifies an IRF member device. The slot-number argument represents the ID of the IRF
member device. If no IRF member device is specified, the command displays ACL application details for
packet filtering on the master. The option is available only when the interface-type argument is
Vlan-interface.
Usage guidelines
When none of acl-number and name acl-name is specified, this command displays application details of
all ACLs for packet filtering.
•If the ipv6 keyword is not specified, all ACLs refer to all IPv4 basic, IPv4 advanced, Ethernet frame
header, and user-defined ACLs.
•If the ipv6 keyword is specified, all ACLs refer to all IPv6 basic and IPv6 advanced ACLs.
Examples
# Display application details of all IPv4 ACLs (including IPv4 basic, IPv4 advanced, and Ethernet frame
header ACLs) for incoming packet filtering on FortyGigE 1/1/1.
<Sysname> display packet-filter verbose interface FortyGigE 1/1/1 inbound
Interface: FortyGigE 1/1/1

12
In-bound policy:
ACL 2001, Hardware-count
rule 0 permit source 2.2.2.2 0
rule 5 permit source 1.1.1.1 0
Default action: Deny
Table 5 Command output
Field Descri
p
tion
Interface Interface to which the ACL applies.
In-bound policy ACL used for filtering incoming traffic.
Out-bound policy ACL used for filtering outgoing traffic.
ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
Hardware-count Successfully enables counting ACL rule matches.
Default action
Default action for packet filtering, namely, the action to take on
packets that do not match the ACL. Deny means to drop the
packets. If the default action is to permit the packets to pass
through, the field is not displayed.
display qos-acl resource
Use display qos-acl resource to display QoS and ACL resource usage.
Syntax
display qos-acl resource [ slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
slot slot-number: Specifies an IRF member device. The slot-number argument represents the ID of the IRF
member device. If no IRF member device is specified, the command displays QoS and ACL resource
usage on all member devices.
Examples
# Display QoS and ACL resource usage.
<Sysname> display qos-acl resource
Interfaces: TGE1/0/1 to TGE1/0/16, XGE1/0/17 to XGE1/0/20
FGE1/1/1 to FGE1/1/4, XGE1/1/5 to XGE1/1/12
---------------------------------------------------------------------
Type Total Reserved Configured Remaining Usage
---------------------------------------------------------------------
VFP ACL 1024 256 0 768 25%

13
IFP ACL 2048 1536 4 508 75%
IFP Meter 1024 768 0 256 75%
IFP Counter 1024 768 2 254 75%
EFP ACL 1024 0 6 1018 0%
EFP Meter 512 0 0 512 0%
EFP Counter 512 0 0 512 0%
Table 6 Command output
Field Descri
p
tion
Interfaces Interface range for the resource.
Type
Resource type:
•VFP ACL—ACL rules for local QoS ID remarking before Layer 2 forwarding
•IFP ACL—ACL rules applied to inbound traffic
•IFP Meter—Traffic policing rules for inbound traffic
•IFP Counter—Traffic counting rules for inbound traffic
•EFP Meter—Traffic policing rules for outbound traffic
•EFP Counter—Traffic counting rules for outbound traffic
Total Total number of resource.
Reserved Number of reserved resource.
Configured Number of resource that has been applied.
Remaining Number of resource that you can apply.
Usage Percent of the used resource.
packet-filter
Use packet-filter to apply an ACL to an interface to filter packets.
Use undo packet-filter to remove an ACL application from an interface.
Syntax
packet-filter [ ipv6 ] { acl-number | name acl-name } { inbound | outbound } [ hardware-count ]
undo packet-filter [ ipv6 ] { acl-number | name acl-name } { inbound | outbound }
Default
An interface does not filter packets.
Views
Interface view
Predefined user roles
network-admin
Parameters
acl-number: Specifies an ACL by its number:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.

14
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to
63 characters. It must start with an English letter. For a basic ACL or advanced ACL, if you do not specify
the ipv6 keyword, this option specifies the name of an IPv4 basic ACL or advanced ACL. If you specify
the ipv6 keyword, this option specifies the name of an IPv6 basic ACL or advanced ACL.
inbound: Filters incoming packets.
outbound: Filters outgoing packets.
hardware-count: Enables counting ACL rule matches performed in hardware. This keyword enables
match counting for all rules in an ACL, and the counting keyword in the rule command enables match
counting specific to rules. If the hardware-count keyword is not specified, rule matches for the ACL are
not counted.
Examples
# Apply IPv4 basic ACL 2001 to filter incoming traffic on FortyGigE 1/1/1, and enable counting ACL
rule matches performed in hardware.
<Sysname> system-view
[Sysname] interface FortyGigE 1/1/1
[Sysname-FortyGigE1/1/1] packet-filter 2001 inbound hardware-count
Related commands
•display packet-filter
•display packet-filter statistics
•display packet-filter verbose
packet-filter default deny
Use packet-filter default deny to set the packet filtering default action to deny. The packet filter denies
packets that do not match any ACL rule.
Use undo packet-filter default deny to restore the default.
Syntax
packet-filter default deny
undo packet-filter default deny
Default
The packet filter permits packets that do not match any ACL rule.
Views
System view
Predefined user roles
network-admin

15
Usage guidelines
The packet filter applies the default action to all ACL applications for packet filtering. The default action
appears in the display command output for packet filtering.
Examples
# Set the packet filter default action to deny.
<Sysname> system-view
[Sysname] packet-filter default deny
Related commands
•display packet-filter
•display packet-filter statistics
•display packet-filter verbose
reset acl counter
Use reset acl counter to clear statistics for ACLs.
Syntax
reset acl counter [ ipv6 ] { acl-number | all | name acl-name }
Views
User view
Predefined user roles
network-admin
Parameters
acl-number: Specifies an ACL by its number:
•2000 to 2999 for IPv4 basic ACLs if the ipv6 keyword is not specified and for IPv6 basic ACLs if
the ipv6 keyword is specified.
•3000 to 3999 for IPv4 advanced ACLs s if the ipv6 keyword is not specified and for IPv6 advanced
ACLs if the ipv6 keyword is specified.
•4000 to 4999 for Ethernet frame header ACLs. This entry is not displayed if the ipv6 keyword is
specified.
all: Clears statistics for all IPv4 basic, IPv4 advanced, Ethernet frame header, and user-defined ACLs if
you do not specify the ipv6 keyword, or clears statistics for all IPv6 basic and IPv6 advanced ACLs if you
specify the ipv6 keyword.
name acl-name: Clears statistics of an ACL specified by its name. The acl-name argument is a
case-insensitive string of 1 to 63 characters. It must start with an English letter. For a basic ACL or
advanced ACL, if you do not specify the ipv6 keyword, this option specifies the name of an IPv4 basic
ACL or advanced ACL. If you specify the ipv6 keyword, this option specifies the name of an IPv6 basic
ACL or advanced ACL.
Examples
# Clear statistics for IPv4 basic ACL 2001.
<Sysname> reset acl counter 2001