HP A5120 EI Series User manual

HP A5120 EI Switch Series
ACL and QoS
Configuration Guide
Abstract
This document describes the software features for the HP A Series products and guides you through the
software configuration procedures. These configuration guides also provide configuration examples to
help you apply software features to different network scenarios.
This documentation is intended for network planners, field technical support and servicing engineers, and
network administrators working with the HP A Series products.
Part number: 5998-1781
Software version: Release 2208
Document version: 5W100-20110530

Legal and notice information
© Copyright 2011 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or use
of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

iii
Contents
ACL configuration···························································································································································· 1
ACL overview ····································································································································································1
ACL applications on the switch·······························································································································1
ACL categories ·························································································································································1
ACL numbering and naming···································································································································2
Match order ······························································································································································2
ACL rule numbering ·················································································································································3
Implementing time-based ACL rules························································································································3
IPv4 fragment filtering with ACLs····························································································································3
ACL configuration task list················································································································································4
Configuring an ACL··························································································································································4
Configuring a time range········································································································································4
Configuring a basic ACL·········································································································································4
Configuring an advanced ACL·······························································································································6
Configuring an Ethernet frame header ACL··········································································································8
Copying an ACL·······················································································································································9
Packet filtering with ACLs ····································································································································· 10
Displaying and maintaining ACLs································································································································ 11
ACL configuration examples········································································································································· 12
IPv4 ACL application configuration example····································································································· 12
IPv6 ACL application configuration example····································································································· 13
QoS overview ································································································································································14
Introduction to QoS························································································································································ 14
QoS service models······················································································································································· 14
Best-effort service model ······································································································································· 14
IntServ model ························································································································································· 14
DiffServ model ······················································································································································· 14
QoS techniques overview ············································································································································· 15
Applying QoS techniques in a network·············································································································· 15
QoS configuration approaches····································································································································16
QoS configuration approach overview ······················································································································· 16
Non-policy approach············································································································································ 16
Policy approach ···················································································································································· 16
Configuring a QoS policy············································································································································· 16
Defining a class ····················································································································································· 17
Defining a traffic behavior ··································································································································· 19
Defining a policy··················································································································································· 19
Applying the QoS policy······································································································································ 20
Displaying and maintaining QoS policies ·················································································································· 22
Priority mapping configuration·····································································································································24
Priority mapping overview ············································································································································ 24
Introduction to priority mapping·························································································································· 24
Introduction to priorities········································································································································ 24
Priority mapping tables········································································································································· 24
Priority trust mode on a port································································································································· 25
Priority mapping procedure ································································································································· 25
Priority mapping configuration task list ······················································································································· 26
Configuring priority mapping······································································································································· 27

iv
Configuring a priority mapping table················································································································· 27
Configuring a port to trust packet priority for priority mapping ······································································ 27
Changing the port priority of an interface·········································································································· 28
Displaying and maintaining priority mapping············································································································ 28
Priority mapping configuration examples ··················································································································· 28
Priority trust mode and port priority configuration example············································································· 28
Priority mapping table and priority marking configuration example ······························································ 29
Traffic policing, traffic shaping, and line rate configuration ····················································································33
Traffic policing, traffic shaping, and line rate overview···························································································· 33
Traffic evaluation and token buckets··················································································································· 33
Traffic policing······················································································································································· 34
Traffic shaping······················································································································································· 35
Line rate·································································································································································· 36
Configuring traffic policing··········································································································································· 36
Configuring GTS ···························································································································································· 37
Configuring the line rate ··············································································································································· 38
Displaying and maintaining traffic policing, GTS, and line rate·············································································· 38
Congestion management configuration ······················································································································39
Congestion management overview······························································································································ 39
Causes, impacts, and countermeasures·············································································································· 39
Congestion management techniques ·················································································································· 39
Configuring SP queuing ················································································································································ 42
Configuration procedure ······································································································································ 42
Configuration example ········································································································································· 42
Configure WRR queuing ··············································································································································· 43
Configuration procedure ······································································································································ 43
Configuration examples ······································································································································· 43
Configuring WFQ queuing··········································································································································· 44
Configuration procedure ······································································································································ 44
Configuration example ········································································································································· 44
Configuring SP+WRR queues ······································································································································· 45
Configuration procedure ······································································································································ 45
Configuration examples ······································································································································· 45
Traffic filtering configuration ········································································································································47
Traffic filtering overview················································································································································ 47
Configuring traffic filtering············································································································································ 47
Traffic filtering configuration example ························································································································· 48
Traffic filtering configuration example ················································································································ 48
Priority marking configuration······································································································································50
Priority marking overview ············································································································································· 50
Configuring priority marking ········································································································································ 50
Priority marking configuration example ······················································································································ 51
Network requirements··········································································································································· 51
Configuration procedure ······································································································································ 52
Traffic redirecting configuration···································································································································54
Traffic redirecting overview ·········································································································································· 54
Configuring traffic redirecting ······································································································································ 54
Class-based accounting configuration·························································································································56
Class-based accounting overview ································································································································ 56
Configuring class-based accounting···························································································································· 56
Displaying and maintaining traffic accounting··········································································································· 56

v
Class-based accounting configuration example ········································································································· 57
Class-based accounting configuration example ································································································ 57
Data buffer configuration··············································································································································59
Introduction to the data buffer ······································································································································ 59
Data buffer ····························································································································································· 59
Data buffer allocation ··········································································································································· 59
Configuring the data buffer ·········································································································································· 60
Data buffer configuration approaches················································································································ 60
Using the burst function to configure the data buffer setup ·············································································· 61
Manually configuring the data buffer setup ······································································································· 61
Manual data buffer configuration task list ·················································································································· 61
Configuring the cell resource········································································································································ 61
Configure the shared resource area of the cell resource·················································································· 61
Configuring the minimum guaranteed cell resource size for a queue····························································· 62
Configuring the maximum shared cell resource size per port·········································································· 62
Configuring the packet resource ·································································································································· 63
Configuring the minimum guaranteed packet resource size for a queue ······················································· 63
Applying the data buffer settings ································································································································· 63
Appendix A Default priority mapping tables··············································································································64
Appendix B Introduction to packet precedences········································································································65
IP precedence and DSCP values ·································································································································· 65
802.1p priority ······························································································································································ 66
Support and other resources ········································································································································68
Contacting HP ································································································································································ 68
Subscription service ·············································································································································· 68
Related information························································································································································ 68
Documents······························································································································································ 68
Websites ································································································································································ 68
Conventions ···································································································································································· 69
Index················································································································································································71

1
ACL configuration
NOTE:
Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document..
ACL overview
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based on
criteria such as source IP address, destination IP address, and port number.
ACLs are primarily used for packet filtering. A packet filter drops packets that match a deny rule and
permits packets that match a permit rule. ACLs are also used by many modules, for example, QoS and IP
routing, for traffic classification and identification.
ACL applications on the switch
An ACL is implemented in hardware or software, depending on the module that uses it. If the module, the
packet filter or QoS module for example, is implemented in hardware, the ACL is applied to hardware to
process traffic. If the module, the routing or user interface access control module (Telnet, SNMP, or web)
for example, is implemented in software, the ACL is applied to software to process traffic.
The user interface access control module denies packets that do not match any ACL. Some modules, QoS
for example, ignore the permit or deny action in ACL rules and do not base their drop or forwarding
decisions on the action set in ACL rules. See the specific module for information about ACL application.
ACL categories
Category
ACL number
IP version
Match criteria
Basic ACLs
2000 to 2999
IPv4
Source IPv4 address
IPv6
Source IPv6 address
Advanced ACLs
3000 to 3999
IPv4
Source IPv4 address, destination IPv4 address,
protocols over IPv4, and other Layer 3 and
Layer 4 header fields
IPv6
Source IPv6 address, destination IPv6 address,
protocols over IPv6, and other Layer 3 and
Layer 4 header fields
Ethernet frame
header ACLs
4000 to 4999
IPv4 and IPv6
Layer 2 header fields, such as source and
destination MAC addresses, 802.1p priority,
and link layer protocol type

2
ACL numbering and naming
Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a
number for identification. In addition, you can assign the ACL a name for ease of identification. After
creating an ACL with a name, you cannot rename it or delete its name.
For an Ethernet frame header ACL, the ACL number and name must be globally unique. For an IPv4 basic
or advanced ACL, its ACL number and name must be unique among all IPv4 ACLs, and for an IPv6 basic
or advanced ACL, its ACL number and name must be unique among all IPv6 ACLs. You can assign an
IPv4 ACL and an IPv6 ACL the same number and name.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the
match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting
rules, the matching result and action to take depend on the rule order.
The following ACL match orders are available:
config—Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a
rule with a higher ID. If you use this approach, carefully check the rules and their order.
auto—Sorts ACL rules in depth-first order. Depth-first ordering ensures that any subset of a rule is
always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first ordering
uses to sort rules for each type of ACL.
Table 1 Sort ACL rules in depth-first order
ACL category
Sequence of tie breakers
IPv4 basic ACL
1. More 0s in the source IP address wildcard (more 0s means a narrower IP
address range)
2. Smaller rule ID
IPv4 advanced ACL
3. Specific protocol type rather than IP (IP represents any protocol over IP)
4. More 0s in the source IP address wildcard mask
5. More 0s in the destination IP address wildcard
6. Narrower TCP/UDP service port number range
7. Smaller ID
IPv6 basic ACL
8. Longer prefix for the source IP address (a longer prefix means a narrower
IP address range)
9. Smaller ID
IPv6 advanced ACL
10. Specific protocol type rather than IP (IP represents any protocol over IPv6)
11. Longer prefix for the source IPv6 address
12. Longer prefix for the destination IPv6 address
13. Narrower TCP/UDP service port number range
14. Smaller ID
Ethernet frame header ACL
15. More 1s in the source MAC address mask (more 1s means a smaller
MAC address)
16. More 1s in the destination MAC address mask
17. Smaller ID

3
NOTE:
A wildcard mask, also called an ”inverse mask,”is a 32-bit binary and is represented in dotted
decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent “do care”bits,
and the 1 bits represent ”don’t care" bits. If the “do care”bits in an IP address are identical to the “do
care”bits in an IP address criterion, the IP address matches the criterion. All “don’t care” bits are
ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a
valid wildcard mask.
ACL rule numbering
What is the ACL rule numbering step
If you do not assign an ID for the rule you are creating, the system automatically assigns it a rule ID. The
rule numbering step sets the increment by which the system automatically numbers rules. For example, the
default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are
automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can
insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of
inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are matched
in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to
the current highest rule ID, starting with 0.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10,
and 12, the newly defined rule will be numbered 15. If the ACL does not contain any rule, the first rule
will be numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules
numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2,
4, 6, and 8.
Implementing time-based ACL rules
You can implement ACL rules based on the time of day by applying a time range to them. A time-based
ACL rule only takes effect in any time periods specified by the time range.
The following basic types of time range are available:
Periodic time range—Recurs periodically on a day or days of the week.
Absolute time range—Represents only a period of time and does not recur.
You can apply a time range to ACL rules before or after you create the time range; however, the rules
using the time range can take effect only after you define the time range.
IPv4 fragment filtering with ACLs
By default, an ACL packet filter on the switch matches all fragments to prevent attackers from fabricating
fragments. To improve efficiency, you can configure the fragment keyword to apply an IPv4 ACL rule only
to non-first fragments.

4
ACL configuration task list
Complete the following tasks to configure an ACL:
Task
Remarks
Configuring a time range
Optional
Configuring an IPv4 basic ACL
Required
Configure at least one task.
Configuring an IPv6 basic ACL
Configuring an IPv4 advanced ACL
Configuring an IPv6 advanced ACL
Configuring an Ethernet frame header ACL
Copying an IPv4 ACL
Optional
Copying an IPv6 ACL
Applying an IPv4 ACL for Packet Filtering
Optional
Applying an IPv6 ACL for Packet Filtering
Configuring an ACL
Configuring a time range
Follow these steps to configure a time range:
To do…
Use the command…
Remarks
Enter system view
system-view
––
Configure a time range
time-range time-range-name {
start-time to end-time days [ from
time1 date1 ] [ to time2 date2 ] |
from time1 date1 [ to time2 date2
] | to time2 date2 }
Required
By default, no time range exists.
Repeat this command with the
same time range name to create
multiple statements for a time
range.
You can create multiple statements in a time range. The active period of a time range is calculated as
follows:
1. Combining all periodic statements
2. Combining all absolute statements
3. Taking the intersection of the two statement sets as the active period of the time range
You can create a maximum of 256 time ranges, each with a maximum of 32 periodic statements and 12
absolute statements.
Configuring a basic ACL
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based only on source IP address.

5
Follow these steps to configure an IPv4 basic ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
––
Create an IPv4 basic ACL and
enter its view
acl number acl-number [ name acl-
name ] [ match-order { auto |
config } ]
Required
By default, no ACL exists.
IPv4 basic ACLs are numbered in
the range 2000 to 2999.
You can use the acl name acl-
name command to enter the view
of a named IPv4 ACL.
Configure a description for the
IPv4 basic ACL
description text
Optional
By default, an IPv4 basic ACL has
no ACL description.
Set the rule numbering step
step step-value
Optional
5 by default.
Create or edit a rule
rule [ rule-id ] { deny | permit } [
counting | fragment |logging |
source {sour-addr sour-wildcard |
any } | time-range time-range-
name ] *
Required
By default, an IPv4 basic ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
The logging and counting
keywords (even if specified) do
not take effect for QoS policies.
Configure or edit a rule
description
rule rule-id comment text
Optional
By default, an IPv4 ACL rule has
no rule description.
Enable counting ACL rule matches
performed in hardware
hardware-count enable
Optional
Disabled by default.
When the ACL is referenced by a
QoS policy, this command does
not take effect.
Configuring an IPv6 basic ACL
Follow these steps to configure an IPv6 basic ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
––
Create an IPv6 basic ACL view
and enter its view
acl ipv6 number acl6-number [
name acl6-name ] [ match-order {
auto | config } ]
Required
By default, no ACL exists.
IPv6 basic ACLs are numbered in
the range 2000 to 2999.
You can use the acl ipv6 name
acl6-name command to enter the
view of a named IPv6 ACL.

6
To do…
Use the command…
Remarks
Configure a description for the
IPv6 basic ACL
description text
Optional
By default, an IPv6 basic ACL has
no ACL description.
Set the rule numbering step
step step-value
Optional
5 by default
Create or edit a rule
rule [ rule-id ] { deny | permit } [
counting | fragment |logging |
source { ipv6-address prefix-length
|ipv6-address/prefix-length |
any } | time-range time-range-
name ] *
Required
By default, an IPv6 basic ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
If the ACL is for QoS traffic
classification, do not specify the
fragment keyword. This keyword
can cause ACL application
failure.
The logging and counting
keywords (even if specified) do
not take effect for QoS policies.
Configure or edit a rule
description
rule rule-id comment text
Optional
By default, an IPv6 basic ACL rule
has no rule description.
Enable counting ACL rule matches
performed in hardware
hardware-count enable
Optional
Disabled by default.
When the ACL is referenced by a
QoS policy, this command does
not take effect.
Configuring an advanced ACL
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on source and destination IP addresses, protocols over IP, and
other protocol header information, such as TCP/UDP source and destination port numbers, TCP flags,
ICMP message types, and ICMP message codes.
IPv4 advanced ACLs also allow you to filter packets based on the following priority criteria: type of
service (ToS), IP precedence, and differentiated services codepoint (DSCP) priority.
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
Follow these steps to configure an IPv4 advanced ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
––

7
To do…
Use the command…
Remarks
Create an IPv4 advanced ACL
and enter its view
acl number acl-number [ name acl-
name ] [ match-order { auto |
config } ]
Required
By default, no ACL exists.
IPv4 advanced ACLs are
numbered in the range 3000 to
3999.
You can use the acl name acl-
name command to enter the view
of a named IPv4 ACL.
Configure a description for the
IPv4 advanced ACL
description text
Optional
By default, an IPv4 advanced ACL
has no ACL description.
Set the rule numbering step
step step-value
Optional
5 by default.
Create or edit a rule
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst rst-
value | syn syn-value | urg urg-
value } * | established } |
counting | destination { dest-addr
dest-wildcard | any } |
destination-port operator port1 [
port2 ] | dscp dscp |fragment |
icmp-type { icmp-type icmp-code |
icmp-message } | logging |
precedence precedence |
reflective | source {sour-addr
sour-wildcard | any } | source-
port operator port1 [ port2 ] |
time-range time-range-name | tos
tos ] *
Required
By default, an IPv4 advanced ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
The reflective keyword is not
supported.
If the ACL is for packet filtering,
the operator argument cannot be
neq.
If the ACL is for QoS traffic
classification, do not specify neq
for the operator argument. The
keywords can cause ACL
application failure.
The logging and counting
keywords (even if specified) do
not take effect for QoS policies.
Configure or edit a rule
description
rule rule-id comment text
Optional
By default, an IPv4 advanced ACL
rule has no rule description.
Enable counting ACL rule matches
performed in hardware
hardware-count enable
Optional
Disabled by default.
When the ACL is referenced by a
QoS policy, this command does
not take effect.
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the source IPv6 address, destination IPv6 address, protocol
carried over IPv6, and other protocol header fields such as the TCP/UDP source port number, TCP/UDP
destination port number, ICMP message type, and ICMP message code.
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
Follow these steps to configure an IPv6 advanced ACL:

8
To do…
Use the command…
Remarks
Enter system view
system-view
––
Create an IPv6 advanced ACL
and enter its view
acl ipv6 number acl6-number [ name
acl6-name ] [ match-order { auto |
config } ]
Required
By default, no ACL exists.
IPv6 advanced ACLs are
numbered in the range 3000 to
3999.
You can use the acl ipv6 name
acl6-name command to enter
the view of a named IPv6 ACL.
Configure a description for
the IPv6 advanced ACL
description text
Optional
By default, an IPv6 advanced
ACL has no ACL description.
Set the rule numbering step
step step-value
Optional
5 by default.
Create or edit a rule
rule [ rule-id ] { deny | permit } protocol
[ { { ack ack-value | fin fin-value | psh
psh-value | rst rst-value | syn syn-value
| urg urg-value } * | established } |
counting | destination { dest dest-prefix
|dest/dest-prefix |any } | destination-
port operator port1 [ port2 ] | dscp
dscp |flow-label flow-label-value |
fragment | icmp6-type { icmp6-type
icmp6-code | icmp6-message } |
logging | source { source source-prefix
|source/source-prefix | any } | source-
port operator port1 [ port2 ] | time-
range time-range-name ] *
Required
By default IPv6 advanced ACL
does not contain any rule.
To create or edit multiple rules,
repeat this step.
If the ACL is for packet filtering,
the operator argument cannot
be neq.
If the ACL is for QoS traffic
classification, do not specify the
fragment keyword or specify
neq for the operator argument.
The keywords can cause ACL
application failure.
The logging and counting
keywords (even if specified) do
not take effect for QoS.
Configure or edit a rule
description
rule rule-id comment text
Optional
By default, an IPv6 advanced
ACL rule has no rule
description.
Enable counting ACL rule
matches performed in
hardware
hardware-count enable
Optional
Disabled by default.
When the ACL is referenced by
a QoS policy, this command
does not take effect.
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol
header fields, such as source MAC address, destination MAC address, 802.1p priority (VLAN priority),
and link layer protocol type.

9
Follow these steps to configure an Ethernet frame header ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
––
Create an Ethernet frame header
ACL and enter its view
acl number acl-number [ name acl-
name ] [ match-order { auto |
config } ]
Required
By default, no ACL exists.
Ethernet frame header ACLs are
numbered in the range 4000 to
4999.
You can use the acl name acl-
name command to enter the view
of a named Ethernet frame
header ACL.
Configure a description for the
Ethernet frame header ACL
description text
Optional
By default, an Ethernet frame
header ACL has no ACL
description.
Set the rule numbering step
step step-value
Optional
5 by default.
Create or edit a rule
rule [ rule-id ] { deny | permit } [
cos vlan-pri | counting | dest-mac
dest-addr dest-mask | { lsap lsap-
type lsap-type-mask | type
protocol-type protocol-type-mask }
| source-mac sour-addr source-
mask | time-range time-range-
name ] *
Required
By default,an Ethernet frame
header ACL does not contain any
rule.
To create or edit multiple rules,
repeat this step.
The lsap keyword is not supported
if the ACL is to be referenced by
a QoS policy for traffic
classification.
Configure or edit a rule
description
rule rule-id comment text
Optional
By default, an Ethernet frame
header ACL rule has no rule
description.
Enable counting ACL rule matches
performed in hardware
hardware-count enable
Optional
Disabled by default.
When the ACL is referenced by a
QoS policy, this command does
not take effect.
Copying an ACL
You can create an ACL by copying an existing ACL. The new ACL has the same properties and content as
the source ACL, but not the same ACL number and name.
To copy an IPv4 or IPv6 ACL successfully, make sure the following:
The destination ACL number is from the same category as the source ACL number.
The source IPv4 or IPv6 ACL already exists, but the destination IPv4 or IPv6 ACL does not.

10
Copying an IPv4 ACL
Follow these steps to copy an IPv4 ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Copy an existing IPv4 ACL to
create a new IPv4 ACL
acl copy { source-acl-number |
name source-acl-name } to { dest-
acl-number | name dest-acl-name
}
Required
Copying an IPv6 ACL
Follow these steps to copy an IPv6 ACL:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Copy an existing IPv6 ACL to
generate a new one of the same
category
acl ipv6 copy { source-acl6-number
| name source-acl6-name } to {
dest-acl6-number | name dest-
acl6-name }
Required
Packet filtering with ACLs
You can apply an ACL to filter incoming or outgoing IPv4 or IPv6 packets.
With a basic or advanced ACL, you can log filtering events by specifying the logging keyword in the ACL
rules and enabling the counting function.
You can set the packet filter to periodically send packet filtering logs to the information center as
informational messages. The interval for generating and outputting packet filtering logs is configurable.
The log information includes the number of matching packets and the ACL rules used in an interval. For
more information about the information center, see the Network Management and Monitoring
Configuration Guide.
NOTE:
ACLs on VLAN interfaces filter only packets forwarded at Layer 3.
Applying an IPv4 ACL for Packet Filtering
Follow these steps to apply an IPv4 ACL for packets filtering:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter Layer 2 Ethernet interface
view or VLAN interface view
interface interface-type interface-
number
—
Apply an IPv4 ACL to the
interface to filter IPv4 packets
packet-filter { acl-number | name
acl-name } inbound
Required
By default, no IPv4 ACL is applied
to the interface.
Exit to system view
quit
—

11
To do…
Use the command…
Remarks
Set the interval for generating and
outputting IPv4 packet filtering
logs
acl logging frequence frequence
Required
By default, the interval is 0. No
IPv4 packet filtering logs are
generated.
Applying an IPv6 ACL for Packet Filtering
Follow these steps to apply an IPv6 ACL for packet filtering:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter Layer 2 Ethernet interface
view or VLAN interface view
interface interface-type interface-
number
—
Apply an IPv6 ACL to the
interface to filter IPv6 packets
packet-filter ipv6 { acl6-number |
name acl6-name } inbound
Required
By default, no IPv6 ACL is applied
to the interface.
Exit to system view
quit
—
Set the interval for generating and
outputting IPv6 packet filtering
logs
acl ipv6 logging frequence
frequence
Required
By default, the interval is 0. No
IPv6 packet filtering logs are
generated.
Displaying and maintaining ACLs
To do...
Use the command…
Remarks
Display configuration and match
statistics for one or all IPv4 ACLs
display acl { acl-number | all | name acl-
name } [ slot slot-number ] [ |{ begin |
exclude | include } regular-expression ]
Available in any view
Display configuration and match
statistics for one or all IPv6 ACLs
display acl ipv6 { acl6-number | all | name
acl6-name } [ slot slot-number ] [ |{ begin |
exclude | include } regular-expression ]
Available in any view
Display the usage of ACL
resources
display acl resource [ slot slot-number ] [ |{
begin | exclude | include } regular-
expression ]
Available in any view
Display the application status of
packet filtering ACLs on interfaces
display packet-filter { { all | interface
interface-type interface-number } [ inbound ]
| interface vlan-interface vlan-interface-
number [ inbound ] [ slot slot-number ] } [ |{
begin | exclude | include } regular-
expression ]
Available in any view
Display the configuration and
status of one or all time ranges
display time-range {time-range-name | all } [
|{ begin | exclude | include } regular-
expression ]
Available in any view
Clear statistics on one or all IPv4
ACLs
reset acl counter { acl-number | all | name
acl-name }
Available in user view

12
To do...
Use the command…
Remarks
Clear statistics on one or all IPv6
basic and advanced ACLs
reset acl ipv6 counter { acl6-number | all |
name acl6-name }
Available in user view
ACL configuration examples
IPv4 ACL application configuration example
Network requirements
As shown in Figure 1, apply an ACL to the inbound direction of interface GigabitEthernet 1/0/1 on
Device A so that every day from 08:00 to 18:00 the interface allows only packets sourced from Host A to
pass. Configure Device A to output packet filtering logs to the console at 10-minute intervals.
Figure 1 Network diagram for applying an IPv4 ACL to an interface for packet filtering
IP network
GE1/0/1
Host A
192.168.1.2/24
Device A
Host B
192.168.1.3/24
Configuration procedure
# Create a time range from 08:00 to 18:00 every day.
<DeviceA> system-view
[DeiceA] time-range study 8:00 to 18:00 daily
# Create IPv4 ACL 2009, and configure two rules in the ACL. One rule permits packets sourced from
Host A at 192.168.1.2 and the other rule denies packets sourced from any other host during the time
range study. Enable logging for both rules.
[DeviceA] acl number 2009
[DeviceA-acl-basic-2009] rule permit source 192.168.1.2 0 time-range study logging
[DeviceA-acl-basic-2009] rule deny source any time-range study logging
[DeviceA-acl-basic-2009] quit
# Apply IPv4 ACL 2009 to filter incoming packets on GigabitEthernet 1/0/1.
[DeviceA] interface gigabitethernet 1/0/1
[DeviceA-GigabitEthernet1/0/1] packet-filter 2009 inbound
[DeviceA-GigabitEthernet1/0/1] quit
# Enable the device to generate and output IPv4 packet filtering logs at 10-minute intervals.
[DeviceA] acl logging frequence 10
# Configure the device to output informational log messages to the console.
[DeviceA] info-center source default channel 0 log level informational

13
IPv6 ACL application configuration example
Network requirements
As shown in Figure 2, apply an IPv6 ACL to the incoming traffic of GigabitEthernet 1/0/1 on Device A
so that every day from 08:00 to 18:00 the interface allows only packets from Host A to pass through.
Configure Device A to output packet filtering logs to the console at an 10-minute intervals.
Figure 2 Network diagram for applying an IPv6 ACL to an interface for packet filtering
IPv6 network
GE1/0/1
Host A
1001::2/64
Device A
Host B
1001::3/64
Configuration procedure
# Create a time range from 08:00 to 18:00 every day.
<DeviceA> system-view
[DeviceA] time-range study 8:0 to 18:0 daily
# Create IPv6 ACL 2009, and configure two rules for the ACL. One rule permits packets sourced from
Host A with the IPv6 address 1001::2 and the other rule denies packets sourced from any other host
during the time range study. Enable logging for both rules.
[DeviceA] acl ipv6 number 2009
[DeviceA-acl6-basic-2009] rule permit source 1001::2 128 time-range study logging
[DeviceA-acl6-basic-2009] rule deny source any time-range study logging
[DeviceA-acl6-basic-2009] quit
# Apply IPv6 ACL 2009 to filter incoming packets on GigabitEthernet 1/0/1.
[DeviceA] interface gigabitethernet 1/0/1
[DeviceA-GigabitEthernet1/0/1] packet-filter ipv6 2009 inbound
[DeviceA-GigabitEthernet1/0/1] quit
# Configure the device to collect and output IPv6 packet filtering logs at 10-minute intervals.
[DeviceA] acl ipv6 logging frequence 10
# Configure the device to output informational log messages to the console.
[DeviceA] info-center source default channel 0 log level informational

14
QoS overview
Introduction to QoS
In data communications, Quality of Service (QoS) is a network’s ability to provide differentiated service
guarantees for diversified traffic in terms of bandwidth, delay, jitter, and drop rate.
Network resources are scarce. The contention for resources requires that QoS prioritize important traffic
flows over trivial ones. For example, in the case of fixed bandwidth, if a traffic flow gets more bandwidth,
the other traffic flows will get less bandwidth and may be affected. When making a QoS scheme, you
must consider the characteristics of various applications to balance the interests of diversified users and to
utilize network resources.
The following sections describe some typical QoS service models and widely used, mature QoS
techniques. By appropriately using these techniques, you can effectively improve QoS.
QoS service models
Best-effort service model
The best-effort model is a single-service model and is also the simplest service model. In this service
model, the network does its best to deliver packets, but does not guarantee delay or reliability.
The best-effort service model is the default model in the Internet and applies to most network applications.
It uses the first in first out (FIFO) queuing mechanism.
IntServ model
The integrated service (IntServ) model is a multiple-service model that can accommodate diverse QoS
requirements. This service model provides the most granularly differentiated QoS by identifying and
guaranteeing definite QoS for each data flow.
In the IntServ model, an application must request service from the network before it sends data. IntServ
signals the service request with the Resource Reservation Protocol (RSVP). All nodes receiving the request
reserve resources as requested and maintain state information for the application flow.
The IntServ model demands high storage and processing capabilities because it requires all nodes along
the transmission path to maintain resource state information for each flow. This model is suitable for small-
sized or edge networks, but not large-sized networks, for example, the core layer of the Internet, where
billions of flows are present.
DiffServ model
The differentiated service (DiffServ) model is a multiple-service model that can satisfy diverse QoS
requirements. Unlike IntServ, DiffServ does not require an application to signal the network to reserve
resources before sending data. DiffServ is easy to implement and extend.
All QoS techniques in this document are based on the DiffServ model.

15
QoS techniques overview
The QoS techniques include traffic classification, traffic policing, traffic shaping, line rate, congestion
management, and congestion avoidance. The following section briefly introduces these QoS techniques.
Applying QoS techniques in a network
Figure 3 Position of the QoS techniques in a network
WAN
Traffic classification
Traffic policing
Congestion management
Congestion avoidance
Traffic shaping
Traffic policing
Traffic policing
Traffic direction
Congestion management
Congestion avoidance
Traffic shaping
Traffic policing
As shown in Figure 3, traffic classification, traffic shaping, traffic policing, congestion management, and
congestion avoidance mainly implement the following functions:
Traffic classification uses certain match criteria to assign packets with the same characteristics to a
class. Based on classes, you can provide differentiated services.
Traffic policing polices flows entering or leaving a device, and imposes penalties on traffic flows that
exceed the pre-set threshold to prevent aggressive use of network resources. You can apply traffic
policing to both incoming and outgoing traffic of a port.
Traffic shaping proactively adapts the output rate of traffic to the network resources available on the
downstream device to eliminate packet drops. Traffic shaping usually applies to the outgoing traffic
of a port.
Congestion management provides a resource scheduling policy to determine the packet forwarding
sequence when congestion occurs. Congestion management usually applies to the outgoing traffic
of a port.
Congestion avoidance monitors the network resource usage and is usually applied to the outgoing
traffic of a port. When congestion worsens, congestion avoidance actively reduces the queue length
by dropping packets.