HP FlexFabric 5700 series User manual
HP FlexFabric 5700 Switch Series
A
CL and QoS
Configuration Guide
Part number: 5998-6661
Software version: Release 2416
Document version: 6W100-20150130
Legal and notice information
© Copyright 2015 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
i
Contents
Configuring ACLs························································································································································· 1
Overview············································································································································································1
Applications on the switch ······································································································································1
ACL categories ·························································································································································1
Numbering and naming ACLs ································································································································2
Match order ······························································································································································2
Rule numbering·························································································································································3
Fragments filtering with ACLs··································································································································3
Configuration task list ·······················································································································································4
Configuring a basic ACL··················································································································································4
Configuring an IPv4 basic ACL ······························································································································4
Configuring an IPv6 basic ACL ······························································································································5
Configuring an advanced ACL········································································································································5
Configuring an IPv4 advanced ACL·······················································································································6
Configuring an IPv6 advanced ACL·······················································································································7
Configuring an Ethernet frame header ACL···················································································································8
Configuring a user-defined ACL ······································································································································9
Copying an ACL ···························································································································································· 10
Configuring packet filtering with ACLs ························································································································ 10
Applying an ACL to an interface for packet filtering························································································· 11
Configuring the applicable scope of packet filtering on a VLAN interface···················································· 11
Setting the interval for generating and outputting packet filtering logs··························································· 11
Setting the packet filtering default action ··········································································································· 12
Displaying and maintaining ACLs································································································································ 12
ACL configuration example ·········································································································································· 12
Network requirements··········································································································································· 12
Configuration procedure ······································································································································ 13
Verifying the configuration··································································································································· 13
QoS overview·····························································································································································15
QoS service models ······················································································································································· 15
Best-effort service model ······································································································································· 15
IntServ model ························································································································································· 15
DiffServ model ······················································································································································· 15
QoS techniques overview ············································································································································· 16
Deploying QoS in a network········································································································································ 16
Configuring a QoS policy·········································································································································18
Non-MQC approach ····················································································································································· 18
MQC approach ····························································································································································· 18
Configuration procedure diagram ······························································································································· 18
Defining a traffic class··················································································································································· 19
Configuration guidelines ······································································································································ 19
Configuration procedure ······································································································································ 19
Defining a traffic behavior ············································································································································ 20
Defining a QoS policy··················································································································································· 21
Applying the QoS policy··············································································································································· 21
Applying the QoS policy to an interface············································································································ 22
Applying the QoS policy to a VLAN··················································································································· 22
Applying the QoS policy globally······················································································································· 23
ii
Applying the QoS policy to a control plane ······································································································ 23
Applying the QoS policy to a user profile·········································································································· 24
Displaying and maintaining QoS policies ·················································································································· 24
Configuring priority mapping ···································································································································26
Overview········································································································································································· 26
Introduction to priorities········································································································································ 26
Priority maps ·························································································································································· 26
Priority trust mode on a port································································································································· 27
Priority mapping process······································································································································ 28
Priority mapping configuration tasks ··························································································································· 29
Configuring a priority map ··········································································································································· 30
Configuring an interface to trust packet priority for priority mapping ····································································· 30
Changing the port priority of an interface ·················································································································· 31
Displaying and maintaining priority mapping············································································································ 31
Priority trust mode configuration example··················································································································· 31
Network requirements··········································································································································· 31
Configuration procedure ······································································································································ 32
Priority mapping table and priority marking configuration example ······································································· 32
Network requirements··········································································································································· 32
Configuration procedure ······································································································································ 33
Configuring traffic policing, GTS, and rate limit ·····································································································36
Overview········································································································································································· 36
Traffic evaluation and token buckets··················································································································· 36
Traffic policing······················································································································································· 37
GTS ········································································································································································· 38
Rate limit································································································································································· 39
Configuring traffic policing··········································································································································· 40
Configuring GTS ···························································································································································· 41
Configuring the rate limit ·············································································································································· 42
Displaying and maintaining traffic policing, GTS, and rate limit············································································· 42
Traffic policing configuration example ························································································································ 42
Network requirements··········································································································································· 42
Configuration procedures····································································································································· 43
Configuring congestion management ······················································································································46
Overview········································································································································································· 46
SP queuing ····························································································································································· 46
WRR queuing························································································································································· 47
WFQ queuing························································································································································ 49
SP+WRR queuing ·················································································································································· 49
SP+WFQ queuing ················································································································································· 49
Congestion management configuration task list········································································································· 50
Configuring queuing······················································································································································ 50
Configuring SP queuing········································································································································ 50
Configuring WRR queuing ··································································································································· 50
Configuring WFQ queuing ·································································································································· 51
Configuring SP+WRR queuing····························································································································· 52
Configuring SP+WFQ queuing···························································································································· 53
Displaying and maintaining queuing·················································································································· 55
Configuring queue scheduling profiles························································································································ 55
Configuring a queue scheduling profile ············································································································· 56
Displaying and maintaining queue scheduling profiles ···················································································· 56
Queue scheduling profile configuration example······························································································ 57
Setting the queue aging time ········································································································································ 57
iii
Configuring congestion avoidance···························································································································58
Overview········································································································································································· 58
Tail drop································································································································································· 58
RED and WRED ····················································································································································· 58
ECN ········································································································································································ 59
Configuring and applying a WRED table··················································································································· 59
Configuration procedure ······································································································································ 60
Configuration example ········································································································································· 60
Displaying and maintaining WRED ····························································································································· 61
Configuring traffic filtering ········································································································································62
Configuration procedure··············································································································································· 62
Configuration example·················································································································································· 63
Network requirements··········································································································································· 63
Configuration procedure ······································································································································ 63
Configuring priority marking·····································································································································64
Overview········································································································································································· 64
Color-based priority marking········································································································································ 64
Packet coloring methods······································································································································· 64
Configuring color-based priority marking ·········································································································· 65
Configuration procedure··············································································································································· 65
Priority marking configuration examples····················································································································· 66
Local precedence marking configuration example···························································································· 66
Local QoS ID marking configuration example ··································································································· 68
Configuring nesting····················································································································································72
Configuration procedure··············································································································································· 72
Configuration example·················································································································································· 73
Network requirements··········································································································································· 73
Configuration procedure ······································································································································ 73
Configuring traffic redirecting···································································································································75
Configuration procedure··············································································································································· 75
Configuration example·················································································································································· 76
Network requirements··········································································································································· 76
Configuration procedure ······································································································································ 77
Configuring aggregate CAR ·····································································································································79
Configuration procedure··············································································································································· 79
Displaying and maintaining aggregate CAR·············································································································· 79
Aggregate CAR configuration example ······················································································································ 79
Network requirements··········································································································································· 79
Configuration procedure ······································································································································ 80
Configuring class-based accounting·························································································································82
Configuration procedure··············································································································································· 82
Configuration example·················································································································································· 83
Network requirements··········································································································································· 83
Configuration procedure ······································································································································ 83
Appendixes·································································································································································85
Appendix A Default priority maps ······························································································································· 85
Appendix B Introduction to packet precedences········································································································ 86
IP precedence and DSCP values·························································································································· 86
802.1p priority······················································································································································ 87
iv
Configuring time ranges············································································································································89
Configuration procedure··············································································································································· 89
Displaying and maintaining time ranges····················································································································· 89
Time range configuration example ······························································································································ 89
Configuring data buffers ···········································································································································91
Configuration task list ···················································································································································· 91
Enabling the Burst function············································································································································ 92
Configuring data buffers manually ······························································································································ 92
Configuring the total shared-area ratio··············································································································· 93
Setting the maximum shared-area ratio for a queue ························································································· 93
Setting the fixed-area ratio for a queue ·············································································································· 94
Applying data buffer configuration····················································································································· 94
Displaying and maintaining data buffers ···················································································································· 94
Configuring QCN······················································································································································95
Basic concepts································································································································································ 95
QCN message format ··················································································································································· 95
Data flow format···················································································································································· 95
CNM format··························································································································································· 96
How QCN works ··························································································································································· 97
QCN algorithm ······························································································································································ 98
CP algorithm ·························································································································································· 98
RP algorithm··························································································································································· 98
CND ················································································································································································ 99
CND defense mode ·············································································································································· 99
Priority mapping ···················································································································································· 99
Protocols and standards ················································································································································ 99
QCN configuration task list ········································································································································100
Enabling QCN globally ··············································································································································100
Configuration prerequisites ································································································································100
Configuration procedure ····································································································································100
Configuring CND settings ···········································································································································100
Configuring global CND settings ······················································································································101
Configuring CND settings for an interface·······································································································101
Configuring congestion detection parameters ··········································································································102
Displaying and maintaining QCN·····························································································································102
QCN configuration examples ····································································································································102
Basic QCN configuration example ···················································································································102
MultiCND QCN configuration example···········································································································105
Support and other resources ·································································································································· 111
Contacting HP ······························································································································································111
Subscription service ············································································································································111
Related information······················································································································································111
Documents····························································································································································111
Websites·······························································································································································111
Conventions ··································································································································································112
Index ········································································································································································ 114
1
Configuring ACLs
Overview
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based on
criteria such as source IP address, destination IP address, and port number.
ACLs are primarily used for packet filtering. "Configuring packet filtering with ACLs" provides an
example. You can use ACLs in QoS, security, routing, and other feature modules for identifying traffic.
The packet drop or forwarding decisions depend on the modules that use ACLs.
Applications on the switch
An ACL is implemented in hardware or software, depending on the module that uses it.
•If the module is implemented in hardware (for example, the packet filter or QoS module), the ACL
is applied to hardware to process traffic.
•If the module is implemented in software (for example, the routing module or the user interface
access control module such as Telnet, or SNMP), the ACL is applied to software to process traffic.
The user interface access control module denies packets that do not match any ACL. Some modules (QoS
for example) ignore the permit or deny action in ACL rules and do not base their drop or forwarding
decisions on the action set in ACL rules. See the specified module for information about ACL application.
ACL categories
Cate
g
or
y
ACL number IP version
Match criteria
Basic ACLs 2000 to 2999 IPv4 Source IPv4 address.
IPv6 Source IPv6 address.
Advanced ACLs 3000 to 3999
IPv4
Source IPv4 address, destination IPv4 address,
packet priority, protocol number, and other
Layer 3 and Layer 4 header fields.
IPv6
Source IPv6 address, destination IPv6 address,
packet priority, protocol number, and other
Layer 3 and Layer 4 header fields.
Ethernet frame
header ACLs 4000 to 4999 IPv4 and IPv6
Layer 2 header fields, such as source and
destination MAC addresses, 802.1p priority,
and link layer protocol type.
User-defined
ACLs 5000 to 5999 IPv4 and IPv6 User specified matching patterns in protocol
headers.
2
Numbering and naming ACLs
Each ACL category has a unique range of ACL numbers. When creating an ACL, you must assign it a
number. In addition, you can assign the ACL a name for ease of identification. After creating an ACL with
a name, you cannot rename it or delete its name.
For an IPv4 basic or advanced ACLs, its ACL number and name must be unique in IPv4. For an IPv6 basic
or advanced ACL, its ACL number and name must be unique in IPv6.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops the
match process and performs the action defined in the rule. If an ACL contains overlapping or conflicting
rules, the matching result and action to take depend on the rule order.
The following ACL match orders are available:
•config—Sorts ACL rules in ascending order of rule ID. A rule with a lower ID is matched before a
rule with a higher ID. If you use this method, check the rules and their order carefully.
NOTE:
The match order of user-defined ACLs can only be config.
•auto—Sorts ACL rules in depth-first order. Depth-first ordering makes sure any subset of a rule is
always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first ordering
uses to sort rules for each type of ACL.
Table 1 Sort ACL rules in depth-first order
ACL cate
g
or
y
Se
q
uence of tie breakers
IPv4 basic ACL
1. More 0s in the source IPv4 address wildcard (more 0s means a narrower IPv4
address range).
2. Rule configured earlier.
IPv4 advanced ACL
1. Specific protocol number.
2. More 0s in the source IPv4 address wildcard mask.
3. More 0s in the destination IPv4 address wildcard.
4. Narrower TCP/UDP service port number range.
5. Rule configured earlier.
IPv6 basic ACL
1. Longer prefix for the source IPv6 address (a longer prefix means a narrower
IPv6 address range).
2. Rule configured earlier.
IPv6 advanced ACL
1. Specific protocol number.
2. Longer prefix for the source IPv6 address.
3. Longer prefix for the destination IPv6 address.
4. Narrower TCP/UDP service port number range.
5. Rule configured earlier.
Ethernet frame
header ACL
1. More 1s in the source MAC address mask (more 1s means a smaller MAC
address).
2. More 1s in the destination MAC address mask.
3. Rule configured earlier.
3
A wildcard mask, also called an inverse mask, is a 32-bit binary number represented in dotted
decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent "do care"
bits, and the 1 bits represent "don't care" bits. If the "do care" bits in an IP address are identical
to the "do care" bits in an IP address criterion, the IP address matches the criterion. All "don't care"
bits are ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example,
0.255.0.255 is a valid wildcard mask.
Rule numbering
ACL rules can be manually numbered or automatically numbered. This section describes how automatic
ACL rule numbering works.
Rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID. The
rule numbering step sets the increment by which the system automatically numbers rules. For example, the
default ACL rule numbering step is 5. If you do not assign IDs to rules you are creating, they are
automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more rules you can
insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility of
inserting rules in an ACL. This feature is important for a config-order ACL, where ACL rules are matched
in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to
the current highest rule ID, starting with 0.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10,
and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule is
numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules
numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2,
4, 6, and 8.
Fragments filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent non-first
fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid the risks, the HP ACL implementation does the following:
•Filters all fragments by default, including non-first fragments.
•Allows for matching criteria modification for efficiency. For example, you can configure the ACL to
filter only non-first fragments.
4
Configuration task list
Tasks at a
g
lance
(Required.) Perform at least one of the following tasks:
•Configuring a basic ACL
{Configuring an IPv4 basic ACL
{Configuring an IPv6 basic ACL
•Configuring an advanced ACL
{Configuring an IPv4 advanced ACL
{Configuring an IPv6 advanced ACL
•Configuring an Ethernet frame header ACL
•Configuring a user-defined ACL
(Optional.) Copying an ACL
(Optional.) Configuring packet filtering with ACLs
Configuring a basic ACL
This section describes procedures for configuring IPv4 and IPv6 basic ACLs.
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based only on source IP addresses.
To configure an IPv4 basic ACL:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an IPv4 basic ACL and
enter its view.
acl number acl-number [ name
acl-name ] [ match-order { auto |
config } ]
By default, no ACL exists.
IPv4 basic ACLs are numbered in
the range of 2000 to 2999.
You can use the acl name acl-name
command to enter the view of a
named ACL.
3. (Optional.) Configure a
description for the IPv4 basic
ACL.
description text By default, an IPv4 basic ACL has
no ACL description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ counting | fragment |logging |
source {source-address
source-wildcard | any } |
time-range time-range-name ] *
By default, an IPv4 basic ACL does
not contain any rule.
The logging keyword takes effect
only when the module (for
example, packet filtering) that uses
the ACL supports logging.
5
Ste
p
Command Remarks
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comments are
configured.
Configuring an IPv6 basic ACL
IPv6 basic ACLs match packets based only on source IP addresses.
To configure an IPv6 basic ACL:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an IPv6 basic ACL
view and enter its view.
acl ipv6 number acl-number
[ name acl-name ] [ match-order
{ auto | config } ]
By default, no ACL exists.
IPv6 basic ACLs are numbered in
the range of 2000 to 2999.
You can use the acl ipv6 name
acl-name command to enter the
view of a named ACL.
3. (Optional.) Configure a
description for the IPv6 basic
ACL.
description text By default, an IPv6 basic ACL has
no ACL description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ counting | fragment |logging |
routing [ type routing-type ] |
source { source-address
source-prefix |
source-address/source-prefix |
any } | time-range
time-range-name ] *
By default, an IPv6 basic ACL does
not contain any rule.
The logging keyword takes effect
only when the module (for
example, packet filtering) that uses
the ACL supports logging.
If an ACL is for QoS traffic
classification or packet filtering:
•Do not specify the fragment
keywords.
•Do not specify the routing
keyword if the ACL is for
outbound QoS traffic
classification or outbound
packet filtering.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comments are
configured.
Configuring an advanced ACL
This section describes procedures for configuring IPv4 and IPv6 advanced ACLs.
6
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on the following criteria:
•Source IP addresses.
•Destination IP addresses.
•Packet priorities.
•Protocol numbers.
•Other protocol header information, such as TCP/UDP source and destination port numbers, TCP
flags, ICMP message types, and ICMP message codes.
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv4 advanced ACL:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an IPv4 advanced ACL
and enter its view.
acl number acl-number [ name
acl-name ] [ match-order { auto |
config } ]
By default, no ACL exists.
IPv4 advanced ACLs are
numbered in the range of 3000 to
3999.
You can use the acl name acl-name
command to enter the view of a
named ACL.
3. (Optional.) Configure a
description for the IPv4
advanced ACL.
description text By default, an IPv4 advanced ACL
has no ACL description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination
{ dest-address dest-wildcard |
any } | destination-port operator
port1 [ port2 ] | { dscp dscp |
{ precedence precedence | tos tos }
* } | fragment | icmp-type
{ icmp-type [ icmp-code ] |
icmp-message } | logging | source
{ source-address source-wildcard |
any } | source-port operator port1
[ port2 ] | time-range
time-range-name ] *
By default, an IPv4 advanced ACL
does not contain any rule.
The logging keyword takes effect
only when the module (for
example, packet filtering) that uses
the ACL supports logging.
If an ACL is for QoS traffic
classification or packet filtering, do
not specify neq for the operator
argument.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comments are
configured.
7
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the following criteria:
•Source IPv6 addresses.
•Destination IPv6 addresses.
•Packet priorities.
•Protocol numbers.
•Other protocol header fields such as the TCP/UDP source port number, TCP/UDP destination port
number, ICMPv6 message type, and ICMPv6 message code.
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv6 advanced ACL:
Ste
p
Command Remarks
1. Enter system
view. system-view N/A
2. Create an IPv6
advanced ACL
and enter its
view.
acl ipv6 number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv6 advanced ACLs are numbered in the range of
3000 to 3999.
You can use the acl ipv6 name acl-name command
to enter the view of a named ACL.
3. (Optional.)
Configure a
description for
the IPv6
advanced ACL.
description text By default, an IPv6 advanced ACL has no ACL
description.
4. (Optional.) Set
the rule
numbering step.
step step-value The default setting is 5.
8
Ste
p
Command Remarks
5. Create or edit a
rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value |
fin fin-value | psh psh-value |
rst rst-value | syn syn-value |
urg urg-value } * |
established } | counting |
destination { dest-address
dest-prefix |
dest-address/dest-prefix |
any } | destination-port
operator port1 [ port2 ] | dscp
dscp |flow-label
flow-label-value | fragment |
icmp6-type { icmp6-type
icmp6-code |
icmp6-message } | logging |
routing [ type routing-type ] |
hop-by-hop [ type hop-type ] |
source { source-address
source-prefix |
source-address/source-prefix
| any } | source-port operator
port1 [ port2 ] | time-range
time-range-name ] *
By default, IPv6 advanced ACL does not contain any
rule.
The logging keyword takes effect only when the
module (for example, packet filtering) that uses the
ACL supports logging.
If an ACL is for QoS traffic classification or packet
filtering:
•Do not specify the fragment keyword.
•Do not specify neq for the operator argument.
•Do not specify the routing, hop-by-hop, or
flow-label keyword if the ACL is for outbound
QoS traffic classification or outbound packet
filtering.
•Do not specify ipv6-ah for the protocol argument,
nor set its value to 0, 43, 44, 51, or 60, if the ACL
is for outbound QoS traffic classification or
outbound packet filtering.
6. (Optional.) Add
or edit a rule
comment. rule rule-id comment text By default, no rule comments are configured.
NOTE:
If an ACL is to match information in the IPv6 packet payload, it can only match packets with one extension
header. It cannot match packets with two or more extension headers or with the Encapsulating Security
Payload Header.
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol
header fields, such as:
•Source MAC address.
•Destination MAC address.
•802.1p priority (VLAN priority).
•Link layer protocol type.
To configure an Ethernet frame header ACL:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
9
Ste
p
Command Remarks
2. Create an Ethernet frame
header ACL and enter its
view.
acl number acl-number [ name
acl-name ] [ match-order { auto |
config } ]
By default, no ACL exists.
Ethernet frame header ACLs are
numbered in the range of 4000 to
4999.
You can use the acl name acl-name
command to enter the view of a
named ACL.
3. (Optional.) Configure a
description for the Ethernet
frame header ACL.
description text
By default, an Ethernet frame
header ACL has no ACL
description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit } [ cos
vlan-pri | counting | dest-mac
dest-address dest-mask | { lsap
lsap-type lsap-type-mask | type
protocol-type protocol-type-mask }
| source-mac source-address
source-mask | time-range
time-range-name ] *
By default,an Ethernet frame
header ACL does not contain any
rule.
If an Ethernet frame header ACL is
used for packet filtering or QoS
traffic classification and the lsap
keyword is used, the lsap-type
argument value must be AAAA,
and the lsap-type-mask argument
value must be FFFF. Otherwise, the
ACL does not take effect.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comments are
configured.
Configuring a user-defined ACL
User-defined ACLs allow you to customize rules based on information in protocol headers. You can
define a user-defined ACL to match packets. A specific number of bytes after an offset (relative to the
specified header) are compared against a match pattern after being ANDed with a match pattern mask.
To configure a user-defined ACL:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create a user-defined ACL
and enter its view. acl number acl-number [ name
acl-name ]
By default, no ACL exists.
User-defined ACLs are numbered
in the range of 5000 to 5999.
You can use the acl name acl-name
command to enter the view of a
named ACL.
3. (Optional.) Configure a
description for the
user-defined ACL.
description text By default, a user-defined ACL has
no ACL description.
10
Ste
p
Command Remarks
4. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ { l2 rule-string rule-mask
offset }&<1-8> ] [ counting |
time-range time-range-name ] *
By default, a user-defined ACL
does not contain any rule.
A user-defined ACL cannot be used
for outbound QoS traffic
classification or outbound packet
filtering.
5. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comments are
configured.
NOTE:
If a user-defined ACL is to match packets with VLAN ta
g
s, the offset must include the len
g
th of the VLAN
tags. Each VLAN tag is 4 bytes long.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL) has the
same properties and content as the source ACL, but not the same ACL number and name.
To successfully copy an ACL, make sure:
•The destination ACL number is from the same category as the source ACL number.
•The source ACL already exists, but the destination ACL does not.
To copy an ACL:
Ste
p
Command
1. Enter system view. system-view
2. Copy an existing ACL to create a new ACL.
acl [ ipv6 ] copy { source-acl-number | name
source-acl-name } to { dest-acl-number | name
dest-acl-name }
Configuring packet filtering with ACLs
This section describes procedures for applying an ACL to filter incoming or outgoing IPv4 or IPv6 packets
on the specified interface.
NOTE:
The ACL-based packet filter function is available on Ethernet interfaces, VLAN interfaces, S-channel
interfaces, S-channel aggregate interfaces, VSI interfaces, and VSI aggregate interfaces. For more
information about S-channel interfaces, S-channel aggregate interfaces, VSI interfaces, and VSI
aggregate interfaces, see
EVB Configuration Guide
.
11
Applying an ACL to an interface for packet filtering
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number
N/A
3. Apply an ACL to the interface
to filter packets.
packet-filter [ ipv6 ] { acl-number |
name acl-name } { inbound |
outbound } [ hardware-count ]
By default, an interface does not
filter packets.
You can apply only one ACL to the
same direction of an interface.
Configuring the applicable scope of packet filtering on a VLAN
interface
You can configure the packet filtering on a VLAN interface to filter the following packets:
•Packets forwarded at Layer 3 by the VLAN interface.
•All packets, including packets forwarded at Layer 3 by the VLAN interface and packets forwarded
at Layer 2 by the physical ports associated with the VLAN interface.
To configure the applicable scope of packet filtering on a VLAN interface:
Ste
p
Command
Remarks
1. Enter system view.
system-view N/A
2. Create a VLAN interface
and enter its view.
interface vlan-interface
vlan-interface-id
If the VLAN interface already exists,
you directly enter its view.
By default, no VLAN interface exists.
3. Specify the applicable
scope of packet filtering on
the VLAN interface.
packet-filter filter [ route | all ] By default, the packet filtering filters
packets forwarded at Layer 3.
Setting the interval for generating and outputting packet
filtering logs
After you set the interval, the device periodically generates and outputs the packet filtering logs to the
information center, including the number of matching packets and the matched ACL rules. For more
information about information center, see Network Management and Monitoring Configuration Guide.
To set the interval for generating and outputting packet filtering logs:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Set the interval for generating
and outputting packet filtering
logs.
acl [ ipv6 ] logging interval interval
The default setting is 0 minutes,
which mean that no packet filtering
logs are generated.
12
Setting the packet filtering default action
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Set the packet filtering default
action to deny. packet-filter default deny
By default, the packet filter permits
packets that do not match any ACL
rule to pass.
Displaying and maintaining ACLs
Execute display commands in any view and reset commands in user view.
Task Command
Display ACL configuration and match statistics. display acl [ ipv6 ] { acl-number | all | name
acl-name }
Display whether an ACL has been successfully applied
to an interface for packet filtering.
display packet-filter { interface [ interface-type
interface-number ] [ inbound | outbound ] | interface
vlan-interface vlan-interface-number [ inbound |
outbound ] [ slot slot-number ] }
Display match statistics for packet filtering ACLs.
display packet-filter statistics interface interface-type
interface-number { inbound | outbound } [ [ ipv6 ]
{ acl-number | name acl-name } ] [ brief ]
Display the accumulated statistics for packet filtering
ACLs.
display packet-filter statistics sum { inbound |
outbound } [ ipv6 ] { acl-number | name acl-name }
[ brief ]
Display detailed ACL packet filtering information.
display packet-filter verbose interface interface-type
interface-number { inbound | outbound } [ [ ipv6 ]
{ acl-number | name acl-name } ] [ slot slot-number ]
Display QoS and ACL resource usage. display qos-acl resource [ slot slot-number ]
Clear ACL statistics. reset acl [ ipv6 ] counter { acl-number | all | name
acl-name }
Clear match statistics (including the accumulated
statistics) for packet filtering ACLs.
reset packet-filter statistics interface [ interface-type
interface-number ] { inbound | outbound } [ [ ipv6 ]
{ acl-number | name acl-name } ]
ACL configuration example
Network requirements
A company interconnects its departments through Device A. Configure an ACL to:
•Permit access from the President's office at any time to the financial database server.
13
•Permit access from the Financial department to the database server only during working hours (from
8:00 to 18:00) on working days.
•Deny access from any other department to the database server.
Figure 1 Network diagram
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<DeviceA> system-view
[DeviceA] time-range work 08:0 to 18:00 working-day
# Create an IPv4 advanced ACL numbered 3000 and configure three rules in the ACL. One rule permits
access from the President's office to the financial database server, one rule permits access from the
Financial department to the database server during working hours, and one rule denies access from any
other department to the database server.
[DeviceA] acl number 3000
[DeviceA-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination
192.168.0.100 0
[DeviceA-acl-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination
192.168.0.100 0 time-range work
[DeviceA-acl-adv-3000] rule deny ip source any destination 192.168.0.100 0
[DeviceA-acl-adv-3000] quit
# Apply IPv4 advanced ACL 3000 to filter outgoing packets on interface Ten-GigabitEthernet 1/0/1.
[DeviceA] interface ten-gigabitethernet 1/0/1
[DeviceA-Ten-GigabitEthernet1/0/1] packet-filter 3000 outbound
[DeviceA-Ten-GigabitEthernet1/0/1] quit
Verifying the configuration
# Ping the database server from a PC in the Financial department during the working hours. (All PCs in
this example use Windows XP).
C:\> ping 192.168.0.100
14
Pinging 192.168.0.100 with 32 bytes of data:
Reply from 192.168.0.100: bytes=32 time=1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
The output shows that the database server can be pinged.
# Ping the database server from a PC in the Marketing department during the working hours.
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
The output shows the database server cannot be pinged.
# Display configuration and match statistics for IPv4 advanced ACL 3000 on Device A during the
working hours.
[DeviceA] display acl 3000
Advanced ACL 3000, named -none-, 3 rules,
ACL's step is 5
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100 0
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100 0 time-range work
(Active)
rule 10 deny ip destination 192.168.0.100 0
The output shows that rule 5 is active.
Other manuals for FlexFabric 5700 series
4
Table of contents
Other HP Switch manuals
HP
HP StorageWorks Brocade User manual
HP
HP StorageWorks 2/140 - Director Switch Instruction Manual
HP
HP 2/8q Fibre Channel User manual
HP
HP 409054-003 User manual
HP
HP Deskjet 870 Instruction Manual
HP
HP ProCurve 5400zl Series User manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 User manual
HP
HP E5400 zl Series User manual
HP
HP A7500 Series Installation manual
HP
HP PROCURVE 2610-PWR Series User manual
HP
HP FlexNetwork 5130 HI series Installation manual
HP
HP FlexFabric 12900 series User manual
HP
HP 316095-B21 - StorageWorks Edge Switch 2/24 User manual
HP
HP 6125XLG Installation manual
HP
HP 2520-8 User manual
HP
HP S5830V2 Series Installation manual
HP
HP 201723-B21 - HP StorageWorks Modular SAN Array 1000 Hard... Instruction Manual
HP
HP 409366-B21 - Voltaire DDR Switch Instruction sheet
HP
HP StorageWorks 2/140 - Director Switch User manual
HP
HP 8/20q User manual
Popular Switch manuals by other brands
Vivotek
Vivotek AW-FET-053C-120 Quick installation guide
CommScope
CommScope MRJ21 instruction sheet
Net Optics
Net Optics iBYPASS 40G Quick install guide
LevelOne
LevelOne GES-2450 user manual
Cable Electronics
Cable Electronics e labs CAT5TX/RX Specification sheet
Milestone pro
Milestone pro MP-SUH41MV user manual