HPE FlexNetwork HSR6800 series Installation manual

HPE FlexNetwork HSR6800 Routers
Comware 7 ACL and QoS Command Reference
Part number: 5200-3491
Software version: HSR6800-CMW710-R7607
Document version: 6W100-20170412

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
ACL commands···············································································1
accelerate··························································································································1
acl····································································································································1
acl copy·····························································································································3
acl logging interval···············································································································4
acl trap interval ···················································································································5
description·························································································································5
display acl··························································································································6
display acl accelerate···········································································································7
display packet-filter··············································································································8
display packet-filter statistics································································································10
display packet-filter statistics sum ·························································································11
display packet-filter verbose ································································································13
packet-filter (interface view)·································································································15
packet-filter (zone pair view)································································································16
packet-filter default deny·····································································································17
packet-filter default hardware-count·······················································································17
reset acl counter ···············································································································18
reset packet-filter statistics ··································································································19
rule (IPv4 advanced ACL view) ····························································································19
rule (IPv4 basic ACL view) ··································································································24
rule (IPv6 advanced ACL view) ····························································································26
rule (IPv6 basic ACL view) ··································································································30
rule comment ···················································································································32
step································································································································33
QoS policy commands ····································································35
Traffic class commands·············································································································35
display traffic classifier········································································································35
if-match···························································································································36
traffic classifier··················································································································41
Traffic behavior commands········································································································41
car ·································································································································41
car percent·······················································································································43
display traffic behavior········································································································44
filter································································································································47
gts··································································································································47
gts percent·······················································································································48
remark dot1p····················································································································49
remark dscp·····················································································································50
remark ip-precedence ········································································································51
remark local-precedence·····································································································51
remark qos-local-id············································································································52
remark service-class··········································································································52
traffic behavior··················································································································53
traffic-policy······················································································································54
QoS policy commands ··············································································································55
classifier behavior··············································································································55
display qos policy··············································································································56
display qos policy advpn·····································································································57
display qos policy interface··································································································59
display qos policy l2vpn-pw ·································································································62
display qos policy user-profile ······························································································63
qos apply policy (interface view, PW view)··············································································68
qos apply policy (user profile view)························································································69
qos policy ························································································································69
reset qos policy advpn········································································································70

ii
QoS policy-based traffic rate statistics collection period commands ····················································71
qos flow-interval················································································································71
Traffic policing, GTS, and rate limit commands·····································72
Traffic policing commands ·········································································································72
display qos car interface ·····································································································72
display qos carl·················································································································73
qos car (interface view)·······································································································74
qos car (user profile view) ···································································································76
qos carl···························································································································77
GTS commands ······················································································································78
display qos gts interface ·····································································································78
qos gts····························································································································80
Rate limit commands ················································································································81
display qos lr····················································································································81
qos lr ······························································································································82
Congestion management commands ·················································84
Common commands·················································································································84
display qos queue interface ·································································································84
display qos queue l2vpn-pw·································································································85
reset qos statistics l2vpn-pw································································································86
FIFO queuing commands ··········································································································86
display qos queue fifo·········································································································86
qos fifo queue-length··········································································································87
PQ commands ························································································································88
display qos queue pq interface·····························································································88
display qos pql··················································································································89
qos pq·····························································································································90
qos pql default-queue·········································································································90
qos pql inbound-interface····································································································91
qos pql local-precedence ····································································································92
qos pql protocol ················································································································92
qos pql protocol mpls exp····································································································93
qos pql queue···················································································································94
CQ commands ························································································································95
display qos queue cq interface ·····························································································95
display qos cql··················································································································96
qos cq·····························································································································96
qos cql default-queue·········································································································97
qos cql inbound-interface····································································································98
qos cql local-precedence ····································································································98
qos cql protocol·················································································································99
qos cql protocol mpls exp·································································································· 100
qos cql queue················································································································· 101
qos cql queue serving ······································································································ 101
WFQ commands···················································································································· 102
display qos queue wfq······································································································ 102
qos wfq ························································································································· 103
RTPQ commands ·················································································································· 104
display qos queue rtpq interface ························································································· 104
qos rtpq························································································································· 105
CBQ commands ···················································································································· 106
display qos queue cbq······································································································ 106
qos reserved-bandwidth···································································································· 107
queue af························································································································ 108
queue ef························································································································ 109
queue sp ······················································································································· 110
queue wfq······················································································································ 110
queue-length·················································································································· 111
wred····························································································································· 112
wred dscp······················································································································ 113

iii
wred ip-precedence ········································································································· 114
wred weighting-constant ··································································································· 115
Packet information pre-extraction commands··············································································· 115
qos pre-classify··············································································································· 115
Congestion avoidance commands ··················································· 117
display qos wred interface································································································· 117
qos wred enable·············································································································· 118
qos wred dscp ················································································································ 118
qos wred ip-precedence···································································································· 119
qos wred weighting-constant······························································································ 120
MPLS QoS commands·································································· 122
if-match mpls-exp············································································································ 122
if-match second-mpls-exp ································································································· 122
remark mpls-exp ············································································································· 123
remark second-mpls-exp··································································································· 123
FR QoS commands······································································ 125
cbs······························································································································· 125
cir ································································································································ 125
cir allow························································································································· 126
display fr class-map········································································································· 127
ebs······························································································································· 128
fifo queue-length ············································································································· 129
fragment enable·············································································································· 129
fragment size·················································································································· 130
fr class·························································································································· 130
fr de del························································································································· 131
fr del inbound-interface····································································································· 132
fr del protocol ················································································································· 133
fr traffic-policing ·············································································································· 135
fr traffic-shaping·············································································································· 136
fr-class·························································································································· 136
traffic-shaping adaptation·································································································· 137
traffic-shaping adaptation percentage ·················································································· 138
Time range commands·································································· 139
display time-range··········································································································· 139
time-range ····················································································································· 139
Document conventions and icons ···················································· 142
Conventions ························································································································· 142
Network topology icons ··········································································································· 143
Support and other resources ·························································· 144
Accessing Hewlett Packard Enterprise Support ············································································ 144
Accessing updates················································································································· 144
Websites ······················································································································· 145
Customer self repair········································································································· 145
Remote support ·············································································································· 145
Documentation feedback ·································································································· 145
Index························································································· 147

1
ACL commands
accelerate
Use accelerate to enableACL acceleration.
Use undo accelerate to disable ACL acceleration.
Syntax
accelerate
undo accelerate
Default
ACL acceleration is disabled.
Views
IPv4 basic/advancedACL view
IPv6 basic/advancedACL view
Predefined user roles
network-admin
Usage guidelines
This command does not take effect if the hardware resources are insufficient. When the hardware
resources become sufficient, the following operations will make ACL acceleration take effect:
•Execute the accelerate command again.
•Modify, add, or delete rules for the ACL.
You can modify, add, or delete rules for an accelerated ACL. The rule adding or modification
operation fails if the hardware resources are insufficient. The failure does not affect the accelerated
ACL.
Examples
# Enable ACL acceleration for ACL 2000.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] accelerate
Related commands
display acl accelerate
acl
Use acl to create an ACL and enter its view, or enter the view of an existing ACL.
Use undo acl to delete the specified or allACLs.
Syntax
acl [ ipv6 ] { advanced | basic } { acl-number | name acl-name } [ match-order { auto | config } ]
undo acl [ ipv6 ] { all | { advanced | basic } { acl-number | name acl-name } }

2
Default
No ACLs exist.
Views
System view
Predefined user roles
network-admin
Parameters
ipv6: Specifies the IPv6 ACL type. To specify the IPv4 ACL type, do not provide this keyword.
basic: Specifies the basicACL type.
advanced: Specifies the advancedACL type.
acl-number:Assigns a number to theACL. The following are available value ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name acl-name: Assigns a name to the ACL. The acl-name argument is a case-insensitive string of
1 to 63 characters. It must start with an English letter and to avoid confusion, it cannot be all.
match-order: Specifies the order in which ACL rules are compared against packets.
•auto: Compares ACL rules in depth-first order.
•config: ComparesACL rules in ascending order of rule ID. The rule with a smaller ID has a
higher priority. If you do not specify a match order, the config order applies by default.
all: Specifies all ACLs of the specified type.
Usage guidelines
You can change the match order only forACLs that do not contain any rules.
If a packet matches an ACL rule that contains criteria except for the following ones, the device uses
the slow forwarding process for the packet:
•Source IP address, source port number, destination IP address, destination port number, or
transport layer protocol.
•ICMP message type or ICMP message code.
•VPN instance.
•Logging operation.
•Time range.
During the slow forwarding process, the device sends the matching packets to thecontrol plane. The
forwarding performance is downgraded.
Examples
# Create IPv4 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000]
# Create IPv4 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl basic name flow
[Sysname-acl-ipv4-basic-flow]
# Create IPv4 advanced ACL 3000 and enter its view.
<Sysname> system-view

3
[Sysname] acl advanced 3000
[Sysname-acl-ipv4-adv-3000]
# Create IPv6 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic 2000
[Sysname-acl-ipv6-basic-2000]
# Create IPv6 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic name flow
[Sysname-acl-ipv6-basic-flow]
# Create IPv6 advanced ACL abc and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 advanced name abc
[Sysname-acl-ipv6-adv-abc]
Related commands
display acl
acl copy
Use acl copy to create an ACL by copying anACL that already exists.
Syntax
acl [ ipv6 ] copy { source-acl-number | name source-acl-name } to { dest-acl-number | name
dest-acl-name }
Views
System view
Predefined user roles
network-admin
Parameters
ipv6: Specifies the IPv6 ACL type.
source-acl-number: Specifies an existing source ACL by its number. The following are available
value ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name source-acl-name: Specifies an existing source ACL by its name. The source-acl-name
argument is a case-insensitive string of 1 to 63 characters.
dest-acl-number: Assigns a unique number to the new ACL. The following are available value
ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name dest-acl-name: Assigns a unique name to the new ACL. The dest-acl-name argument is a
case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid
confusion, it cannot be all.
Usage guidelines
The new ACL and the sourceACL must be the same type.

4
The new ACL has the same properties and content as the source ACL, but uses a different number
or name from the sourceACL.
To specify the IPv4 ACL type, do not specify the ipv6 keyword.
Examples
# Create IPv4 basic ACL 2002 by copying IPv4 basicACL 2001.
<Sysname> system-view
[Sysname] acl copy 2001 to 2002
# Create IPv4 basic ACL paste by copying IPv4 basicACL test.
<Sysname> system-view
[Sysname] acl copy name test to name paste
acl logging interval
Use acl logging interval to enable logging for packet filtering and set the interval.
Use undo acl logging interval to restore the default.
Syntax
acl logging interval interval
undo acl logging interval
Default
The interval is 0. The device does not generate log entries for packet filtering.
Views
System view
Predefined user roles
network-admin
Parameters
interval: Specifies the interval at which log entries are generated and output. It must be a multiple of
5, in the range of 0 to 1440 minutes. To disable the logging, set the value to 0.
Usage guidelines
The logging feature is available for the followingACL rules that have the logging keyword:
•IPv4 basic ACL rules.
•IPv4 advanced ACL rules.
•IPv6 basic ACL rules.
•IPv6 advanced ACL rules.
If an ACL is matched for the first time, the device immediately outputs a log entry to record the
matching packet.
Examples
# Configure the device to generate and output packet filtering log entries every 10 minutes.
<Sysname> system-view
[Sysname] acl logging interval 10
Related commands
rule (IPv4 advanced ACL view)
rule (IPv4 basic ACL view)

5
rule (IPv6 advanced ACL view)
rule (IPv6 basic ACL view)
acl trap interval
Use acl trap interval to enable SNMP notifications for packet filtering and set the interval.
Use undo acl interval to restore the default.
Syntax
acl trap interval interval
undo acl trap interval
Default
The interval is 0. The device does not generate SNMP notifications for packet filtering.
Views
System view
Predefined user roles
network-admin
Parameters
interval: Specifies the interval at which SNMP notifications are generated and output. It must be a
multiple of 5, in the range of 0 to 1440 minutes. To disable SNMP notifications, set the value to 0.
Usage guidelines
The SNMP notifications feature is available for the following ACL rules that have the logging
keyword:
•IPv4 basic ACL rules.
•IPv4 advanced ACL rules.
•IPv6 basic ACL rules.
•IPv6 advanced ACL rules.
If an ACL is matched for the first time, the device immediately outputs a notification to record the
matching packet.
Examples
# Configure the device to generate and output packet filtering SNMP notifications every 10 minutes.
<Sysname> system-view
[Sysname] acl trap interval 10
Related commands
rule (IPv4 advanced ACL view)
rule (IPv4 basic ACL view)
rule (IPv6 advanced ACL view)
rule (IPv6 basic ACL view)
description
Use description to configure a description for an ACL.
Use undo description to delete an ACL description.

6
Syntax
description text
undo description
Default
An ACL does not have a description.
Views
IPv4 basic/advancedACL view
IPv6 basic/advancedACL view
Predefined user roles
network-admin
Parameters
text: Specifies a description, a case-sensitive string of 1 to 127 characters.
Examples
# Configure a description for IPv4 basicACL 2000.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] description This is an IPv4 basic ACL.
Related commands
display acl
display acl
Use display acl to display ACL configuration and match statistics.
Syntax
display acl [ ipv6 ] { acl-number | all | name acl-name }
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
ipv6: Specifies the IPv6 ACL type.
acl-number: Specifies anACL by its number. The following are available value ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
all: Specifies all ACLs of the specified type.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
Usage guidelines
This command displays ACL rules in config or auto order, whichever is configured.

7
To specify the IPv4 ACL type, do not specify the ipv6 keyword.
Examples
# Display configuration and match statistics for IPv4 basic ACL 2001.
<Sysname> display acl 2001
Basic IPv4 ACL 2001, 2 rules, match-order is auto,
This is an IPv4 basic ACL.
ACL's step is 5
ACL accelerated
rule 5 permit source 1.1.1.1 0
rule 5 comment This rule is used on GigabitEthernet 2/1/1.
rule 10 permit source object-group permit
Table 1 Command output
Field Description
Basic IPv4 ACL 2001 Type and number of the ACL. The following field information is about IPv4
basic ACL 2001.
2 rules The ACL contains two rules.
match-order is auto The match order for the ACL is auto, which sorts ACL rules in depth-first
order. This field is not displayed when the match order is config.
This is an IPv4 basic ACL. Description of the ACL.
ACL's step is 5 The rule numbering step is 5.
ACL accelerated ACL acceleration is enabled for the ACL.
rule 5 permit source 1.1.1.1 0 Content of rule 5. The rule permits packets sourced from the IP address
1.1.1.1.
rule 10 permit source
object-group permit Content of rule 10. The rule permits packets sourced from the object group
permit.
rule 5 comment This rule is
used on GigabitEthernet 2/1/1. Comment of rule 5.
display acl accelerate
Use display acl accelerate to display ACL acceleration status.
Syntax
In standalone mode:
display acl accelerate { summary [ ipv6 ] | verbose [ ipv6 ] { acl-number | name acl-name } slot
slot-number }
In IRF mode:
display acl accelerate { summary [ ipv6 ] | verbose [ ipv6 ] { acl-number | name acl-name }
chassis chassis-number slot slot-number }
Views
Any view
Predefined user roles
network-admin
network-operator

8
Parameters
summary: Displays summary information about ACL acceleration status.
verbose: Displays detailed information about ACL acceleration status.
ipv6: Specifies the IPv6 ACL type.
acl-number: Specifies anACL by its number. The following are available value ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
slot slot-number: Specifies a card by its slot number. The specified card must be the card where the
acceleration chip resides. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The
chassis-number argument represents the ID of the IRF member device. The slot-number argument
represents the slot number of the card. The specified card must be the card where the acceleration
chip resides. (In IRF mode.)
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 keyword.
Examples
# Display summary information aboutACL acceleration status.
<Sysname> display acl accelerate summary
Basic IPv4 ACL 2000
# Display detailed information aboutACL acceleration status.
<Sysname> display acl accelerate verbose 2000
Basic IPv4 ACL 2000.
rule 0 permit
rule 1 deny (failed)
Table 2 Command output
Field Description
failed ACL acceleration for the rule failed, and the rule is not effective.
display packet-filter
Use display packet-filter to display ACL application information for packet filtering.
Syntax
In standalone mode:
display packet-filter interface [ interface-type interface-number ] [ inbound | outbound ] [ slot
slot-number ]
In IRF mode:
display packet-filter interface [ interface-type interface-number ] [ inbound | outbound ] [ chassis
chassis-number slot slot-number ]
Views
Any view

9
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number. VLAN
interfaces are not supported. If you do not specify an interface, this command displays ACL
application information for packet filtering on all interfaces except VLAN interfaces.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command
displays ACL application information for packet filtering for the active MPU. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The
chassis-number argument represents the member ID of the IRF member device. The slot-number
argument represents the slot number of the card. If you do not specify a card, this command displays
ACL application information for packet filtering for the global active MPU. (In IRF mode.)
Usage guidelines
This command displays ACL application information for interface-based packet filtering in both
directions if neither the inbound keyword nor the outbound keyword is specified.
Examples
# Display ACL application information for inbound packet filtering on interface GigabitEthernet 2/1/1.
<Sysname> display packet-filter interface gigabitethernet 2/1/1 inbound
Interface: GigabitEthernet2/1/1
Inbound policy:
IPv4 ACL 2001
IPv6 ACL 2002 (Failed)
IPv4 ACL 2004
IPv4 default action: Deny
Table 3 Command output
Field Description
Interface Interface to which the ACL applies.
Inbound policy ACL used for filtering incoming traffic.
Outbound policy ACL used for filtering outgoing traffic.
IPv4 ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
IPv6 ACL 2002 (Failed) The device has failed to apply IPv6 basic ACL 2002.

10
Field Description
IPv4 default action
Packet filter default action for packets that do not match any IPv4
ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
•Hardware-count—The hardware-count feature has been
successfully applied for the default action for packet filtering.
•Hardware-count (Failed)—The device has failed to apply
the hardware-count feature for the packet filtering default
action.
IPv6 default action
Packet filter default action for packets that do not match any IPv6
ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
•Hardware-count—The hardware-count feature has been
successfully applied for the default action for packet filtering.
•Hardware-count (Failed)—The device has failed to apply
the hardware-count feature for the packet filtering default
action.
display packet-filter statistics
Use display packet-filter statistics to display packet filtering statistics and default action statistics.
Syntax
display packet-filter statistics interface interface-type interface-number { inbound | outbound }
[ default | [ ipv6 ] { acl-number | name acl-name } ] [ brief ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
default: Displays the default action statistics for packet filtering.
ipv6: Specifies the IPv6 ACL type.
acl-number: Specifies anACL by its number. The following are available value ranges:

11
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
brief: Displays brief statistics.
Usage guidelines
If default, acl-number, name acl-name, or ipv6 is not specified, this command displays packet
filtering statistics for allACLs and default action statistics.
To specify the IPv4 ACL type, do not specify the ipv6 keyword.
Examples
# Display packet filtering statistics for all ACLs and default action statistics on incoming packets of
GigabitEthernet 2/1/1.
<Sysname> display packet-filter statistics interface gigabitethernet 2/1/1 inbound
Interface: GigabitEthernet2/1/1
Inbound policy:
IPv4 ACL 2001
rule 0 permit source 2.2.2.2 0
rule 5 permit source 1.1.1.1 0
rule 10 permit vpn-instance test
Table 4 Command output
Field Description
Interface Interface to which the ACL applies.
Inbound policy ACL used for filtering incoming traffic.
Outbound policy ACL used for filtering outgoing traffic.
IPv4 ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
rule 5 permit source 1.1.1.1 0 Rule configuration.
Related commands
reset packet-filter statistics
display packet-filter statistics sum
Use display packet-filter statistics sum to display accumulated packet filtering statistics for an
ACL.
Syntax
display packet-filter statistics sum { inbound | outbound } [ ipv6 ] { acl-number | name acl-name }
[ brief ]
Views
Any view
Predefined user roles
network-admin
network-operator

12
Parameters
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
acl-number: Specifies anACL by its number. The following are available value ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
brief: Displays brief statistics.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 keyword.
Examples
# Display accumulated packet filtering statistics for IPv4 basicACL 2001 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2001
Sum:
Inbound policy:
IPv4 ACL 2001
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0
rule 10 permit vpn-instance test
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
# Display brief accumulated packet filtering statistics for IPv4 basic ACL 2000 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2000 brief
Sum:
Inbound policy:
IPv4 ACL 2000
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
Table 5 Command output
Field Description
Sum Accumulated packet filtering statistics.
Inbound policy Accumulated packet filtering statistics in the inbound direction.
Outbound policy Accumulated packet filtering statistics in the outbound direction.
IPv4 ACL 2001 Accumulated packet filtering statistics of IPv4 basic ACL 2001.
2 packets Two packets matched the rule.
This field is not displayed when no packets matched the rule.
Totally 2 packets permitted, 0 packets
denied Number of packets permitted and denied by the ACL.
Totally 100% permitted, 0% denied Ratios of permitted and denied packets to all packets.

13
Related commands
reset packet-filter statistics
display packet-filter verbose
Use display packet-filter verbose to displayACL application details for packet filtering.
Syntax
In standalone mode:
display packet-filter verbose interface interface-type interface-number { inbound | outbound }
[ [ ipv6 ] { acl-number | name acl-name } ] [ slot slot-number ]
In IRF mode:
display packet-filter verbose interface interface-type interface-number { inbound | outbound }
[ [ ipv6 ] { acl-number | name acl-name } ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
acl-number: Specifies anACL by its number. The following are available value ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command
displays ACL application details for packet filtering for the active MPU. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The
chassis-number argument represents the member ID of the IRF member device. The slot-number
argument represents the slot number of the card. If you do not specify a card, this command displays
ACL application details for packet filtering for the global active MPU. (In IRF mode.)
Usage guidelines
If you do not specify acl-number, name acl-name, or ipv6, this command displays application details
of IPv4 ACLs for packet filtering.
To specify the IPv4 ACL type, do not specify the ipv6 keyword.
Examples
# Display application details of all ACLs for inbound packet filtering on GigabitEthernet 2/1/1.
<Sysname> display packet-filter verbose interface gigabitethernet 2/1/1 inbound
Interface: GigabitEthernet2/1/1
Inbound policy:

14
IPv4 ACL 2001
rule 0 permit
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (Failed)
IPv4 ACL 2002 (Failed), Hardware-count (Failed)
IPv6 ACL 2000
rule 0 permit
IPv4 default action: Deny
IPv6 default action: Deny
Table 6 Command output
Field Description
Interface Interface to which the ACL applies.
Inbound policy ACL used for filtering incoming traffic.
Outbound policy ACL used for filtering outgoing traffic.
IPv4 ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
IPv4 ACL 2002 (Failed) The device has failed to apply IPv4 basic ACL 2002.
Hardware-count ACL rule match counting has been successfully enabled.
Hardware-count (Failed) The device has failed to enable counting ACL rule matches.
rule 5 permit source 1.1.1.1 0 (Failed) The device has failed to apply rule 5.
IPv4 default action
Packet filter default action for packets that do not match any
IPv4 ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
•Hardware-count—The hardware-count feature has
been successfully applied for the default action for packet
filtering.
•Hardware-count (Failed)—The device has failed to
apply the hardware-count feature for the packet filtering
default action.

15
Field Description
IPv6 default action
Packet filter default action for packets that do not match any
IPv6 ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
•Hardware-count—The hardware-count feature has
been successfully applied for the default action for packet
filtering.
•Hardware-count (Failed)—The device has failed to
apply the hardware-count feature for the packet filtering
default action.
packet-filter (interface view)
Use packet-filter to apply anACL to an interface to filter packets.
Use undo packet-filter to remove anACL from an interface.
Syntax
packet-filter [ ipv6 ] { acl-number | name acl-name } { inbound | outbound } [ hardware-count ]
undo packet-filter [ ipv6 ] { acl-number | name acl-name } { inbound | outbound }
Default
No ACL is applied to an interface to filter packets.
Views
Interface view
Predefined user roles
network-admin
Parameters
ipv6: Specifies the IPv6 ACL type.
acl-number: Specifies anACL by its number. The following are available value ranges:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
inbound: Filters incoming packets.
outbound: Filters outgoing packets.
hardware-count: Enables counting ACL rule matches performed in hardware. If you do not specify
this keyword, rule matches for theACL are not counted.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 keyword.
The hardware-count keyword in this command enables match counting for all rules in anACL, and
the counting keyword in the rule command enables match counting specific to rules.