HPE 3100 v2 Series User manual

HPE 3100 v2 Switch Series
A
CL and QoS
Configuration Guide
Part number: 5998-5995s
Software version: Release 5213 and Release 5213P02
Document version: 6W101-20160506

© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ACLs····························································································1
Overview····························································································································································1
Applications on the switch··························································································································1
ACL categories···········································································································································1
Numbering and naming ACLs····················································································································1
Match order················································································································································2
ACL rule comments and rule range remarks ·····························································································2
ACL rule numbering···································································································································3
Fragments filtering with ACLs····················································································································3
ACL configuration task list ·································································································································3
Configuring a time range····································································································································4
Configuring a basic ACL ····································································································································4
Configuring an IPv4 basic ACL··················································································································4
Configuring an IPv6 basic ACL··················································································································5
Configuring an advanced ACL···························································································································6
Configuring an IPv4 advanced ACL···········································································································6
Configuring an IPv6 advanced ACL···········································································································7
Configuring an Ethernet frame header ACL·······································································································8
Copying an ACL·················································································································································9
Copying an IPv4 ACL·································································································································9
Copying an IPv6 ACL·······························································································································10
Packet filtering with ACLs ································································································································10
Applying an IPv4 or Ethernet frame header ACL for packet filtering························································10
Applying an IPv6 ACL for packet filtering·································································································11
Displaying and maintaining ACLs ····················································································································11
Configuration example of using ACL for device management·········································································12
Network requirements······························································································································12
Configuration procedure···························································································································12
IPv4 packet filtering configuration example ·····································································································13
Network requirements······························································································································13
Configuration procedure···························································································································13
IPv6 packet filtering configuration example ·····································································································14
Network requirements······························································································································14
Configuration procedure···························································································································14
QoS overview································································································16
QoS service models·········································································································································16
Best-effort service model ·························································································································16
IntServ model···········································································································································16
DiffServ model··········································································································································16
QoS techniques ···············································································································································16
QoS configuration approaches ·····································································18
MQC approach·················································································································································18
Non-MQC approach·········································································································································18
Configuring a QoS policy (available only on the HPE 3100 v2 EI)················19
Overview··························································································································································19
Defining a class················································································································································19
Configuration restrictions and guidelines·································································································20
Configuration procedure···························································································································20
Defining a traffic behavior ································································································································21
Defining a policy···············································································································································21
Configuration restrictions and guidelines·································································································22
Configuration procedure···························································································································22
Applying the QoS policy···································································································································22
Applying the QoS policy to an interface···································································································22

ii
Applying the QoS policy to online users···································································································23
Applying the QoS policy to a VLAN··········································································································24
Applying the QoS policy globally··············································································································24
Displaying and maintaining QoS policies·········································································································24
Configuring priority mapping·········································································26
Overview··························································································································································26
Types of priorities·····································································································································26
Priority mapping tables·····························································································································26
Priority trust mode on a port·····················································································································27
Priority mapping procedure······················································································································28
Configuration guidelines ··································································································································29
Configuring a priority mapping table ················································································································29
Configuring a port to trust packet priority for priority mapping ·········································································30
Changing the port priority of an interface·········································································································30
Displaying priority mappings····························································································································30
Priority trust mode configuration example········································································································31
Network requirements······························································································································31
Configuration procedure···························································································································31
Priority mapping table and priority marking configuration example ·································································31
Network requirements······························································································································31
Configuration procedure···························································································································33
Configuring traffic policing, traffic shaping, and line rate·······························35
Overview··························································································································································35
Traffic evaluation and token buckets········································································································35
Traffic policing··········································································································································35
Traffic shaping··········································································································································36
Line rate···················································································································································37
Configuring traffic policing································································································································38
Configuration restrictions and guidelines·································································································38
Configuration procedure···························································································································38
Configuring GTS ··············································································································································39
Configuring the line rate···································································································································39
Displaying and maintaining traffic policing, GTS, and line rate········································································40
Traffic policing configuration example··············································································································40
Network requirements······························································································································40
Configuration procedures·························································································································41
Configuring congestion management ···························································43
Overview··························································································································································43
Congestion management techniques ··············································································································43
SP queuing···············································································································································43
WRR queuing···········································································································································44
SP+WRR queuing····································································································································45
Configuring SP queuing···································································································································45
Configuration procedure···························································································································45
Configuration example·····························································································································45
Configuring WRR queuing ·······························································································································46
Configuration procedure···························································································································46
Configuration example·····························································································································46
Configuring SP+WRR queuing ························································································································47
Configuration procedure···························································································································47
Configuration example·····························································································································47
Configuring traffic filtering (available only on the HPE 3100 v2 EI)···············48
Configuration procedure ··································································································································48
Traffic filtering configuration example ··············································································································49
Network requirements······························································································································49
Configuration procedure···························································································································49

iii
Configuring priority marking (available only on the HPE 3100 v2 EI) ···········50
Configuration procedure ··································································································································50
Local precedence re-marking configuration example ······················································································51
Network requirements······························································································································51
Configuration procedure···························································································································51
Configuring traffic redirecting (available only on the HPE 3100 v2 EI) ·········53
Configuration restrictions and guidelines·········································································································53
Configuration procedure ··································································································································53
Configuring class-based accounting (available only on the HPE 3100 v2 EI)54
Configuration procedure ··································································································································54
Displaying and maintaining traffic accounting··································································································54
Class-based accounting configuration example ······························································································55
Network requirements······························································································································55
Configuration procedure···························································································································55
Configuring burst···························································································57
Configuration prerequisites······························································································································57
Configuration procedure ··································································································································57
Burst configuration example ····························································································································57
Network requirements······························································································································57
Configuration procedure···························································································································58
Appendix A Default priority mapping tables··················································59
Priority mapping tables ····································································································································59
Appendix B Packet precedences··································································60
IP precedence and DSCP values ····················································································································60
802.1p priority ··················································································································································61
Document conventions and icons·································································63
Conventions·····················································································································································63
Network topology icons····································································································································64
Support and other resources ········································································65
Accessing Hewlett Packard Enterprise Support ······························································································65
Accessing updates···········································································································································65
Websites ··················································································································································66
Customer self repair·································································································································66
Remote support········································································································································66
Documentation feedback ·························································································································66
Index·············································································································68

1
Configuring ACLs
Unless otherwise stated,ACLs refer to both IPv4 and IPv6 ACLs throughout this document.
Overview
An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic
based on criteria such as source IP address, destination IP address, and port number.
ACLs are primarily used for packet filtering.Apacket filter drops packets that match a deny rule and
permits packets that match a permit rule.ACLs are also used by many modules, QoS and IProuting
for example, for traffic classification and identification.
Applications on the switch
An ACLis implemented in hardware orsoftware, depending on the module that uses it. If the module,
the packet filter or QoS module for example, is implemented in hardware, the ACL is applied to
hardware to process traffic. If the module, the routing or user interface access control module (Telnet,
SNMP, or web) for example, is implemented in software, the ACL is applied to software to process
traffic.
The user interface access control module denies packets that do not match any ACL. Some modules,
QoS for example, ignore the permit or deny action in ACL rules and do not base their drop or
forwarding decisions on the action set in ACL rules. See the specified module for information about
ACL application.
ACL categories
Category ACL
number IP version Match criteria
Basic ACLs 2000 to 2999 IPv4 Source IPv4 address
IPv6 Source IPv6 address
Advanced ACLs 3000 to 3999
IPv4 Source IPv4 address, destination IPv4 address, packet
priority, protocols over IPv4, and other Layer 3 and Layer
4 header fields
IPv6 Source IPv6 address, destination IPv6 address, packet priority, protocols over IPv6, and other Layer 3 and Layer
4 header fields
Ethernet frame
header ACLs 4000 to 4999 IPv4 and IPv6
Layer 2 header fields, such as source and destination
MAC addresses, 802.1p priority, and link layer protocol
type
Numbering and naming ACLs
Each ACL category has a unique range ofACL numbers. When creating an ACL, you must assign it
a number. In addition, you can assign the ACL a name for ease of identification. After creating an
ACL with a name, you cannot rename it or delete its name.
For an Ethernet frame headerACL, the ACLnumber and name must be globally unique. For an IPv4
basic or advanced ACLs, its ACLnumber and name must be unique among all IPv4 ACLs, and for an

2
IPv6 basic or advanced ACL, its ACL number and name must be unique among all IPv6 ACLs. You
can assign an IPv4ACL and an IPv6ACL the same number and name.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops
the match process and performs the action defined in the rule. If an ACL contains overlapping or
conflicting rules, the matching result and action to take depend on the rule order.
The followingACL match orders are available:
•config—SortsACL rules in ascending order of rule ID. Arule with a lower ID is matched before
a rule with a higher ID. If you use this approach, carefully check the rules and their order.
•auto—SortsACL rules in depth-first order. Depth-first ordering guarantees that any subset of a
rule is always matched before the rule. Table 1 lists the sequence of tie breakers that depth-first
ordering uses to sort rules for each type ofACL.
Table 1 Sort ACL rules in depth-first order
ACL category Sequence of tie breakers
IPv4 basic ACL 1. More 0s in the source IP address wildcard (more 0s means a narrower
IP address range).
2. Rule configured earlier.
IPv4 advanced ACL
1. Specific protocol type rather than IP (IPrepresents any protocol over IP).
2. More 0s in the source IP address wildcard mask.
3. More 0s in the destination IP address wildcard.
4. Narrower TCP/UDP service port number range.
5. Rule configured earlier.
IPv6 basic ACL 1. Longer prefix for the source IP address (a longer prefix means a
narrower IP address range).
2. Rule configured earlier.
IPv6 advanced ACL
1. Specific protocol type rather than IP (IP represents any protocol over
IPv6).
2. Longer prefix for the source IPv6 address.
3. Longer prefix for the destination IPv6 address.
4. Narrower TCP/UDP service port number range.
5. Rule configured earlier.
Ethernet frame header ACL
1. More 1s in the source MAC address mask (more 1s means a smaller
MAC address).
2. More 1s in the destination MAC address mask.
3. Rule configured earlier.
A wildcard mask, also called an inverse mask, is a 32-bit binary and represented in dotted decimal
notation. In contrast to a network mask, the 0 bits in awildcard mask represent "do care" bits, and the
1 bits represent "don’t care" bits. If the "do care" bits in an IP address are identical to the "do care"
bits in an IP address criterion, the IP address matches the criterion.All "don’t care" bits are ignored.
The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a valid
wildcard mask
ACL rule comments and rule range remarks
You can add a comment about an ACL rule to make it easy to understand. The rule comment
appears below the rule statement.

3
You can also add a rule range remark to indicate the start or end of a range of rules created for the
same purpose. A rule range remark always appears above the specified ACL rule. If the specified
rule has not been created yet, the position of the comment in theACL is as follows:
•If the match order is config, the remark is inserted into the ACL in descending order of rule ID.
•If the match order is auto, the remark is placed at the end of the ACL. After you create the rule,
the remark appears above the rule.
For more information about how to use rule range remarks, see the rule remark command in ACL
and QoS Command Reference for your device.
ACL rule numbering
What is the ACL rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID.
The rule numbering step sets the increment by which the system automatically numbers rules. For
example, the default ACLrule numbering step is 5. If you do not assign IDs to rules you are creating,
they are automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more
rules you can insert between two rules.
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility
of inserting rules in an ACL. This feature is important for a config order ACL, where ACL rules are
matched in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACLrule takes the nearest higher multiple of the numbering step
to the current highest rule ID, starting with 0.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9,
10, and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule
is numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five
rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be
renumbered 0, 2, 4, 6, and 8.
Fragments filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent
non-first fragments to pass through.Attackers can fabricate non-first fragments to attack networks.
To avoid the risks, the HPE ACL implementation:
•Filters all fragments by default, including non-first fragments.
•Allows for matching criteria modification, for example, filters non-first fragments only.
ACL configuration task list
Task Remarks
Configuring a time range Optional.
Applicable to IPv4 and IPv6 ACLs.
Configuring a basic ACL Required.
Configure at least one task.
Applicable to IPv4 and IPv6 except that simple ACLs
are for IPv6.
Configuring an advanced ACL
Configuring an Ethernet frame header ACL

4
Task Remarks
Copying an ACL Optional.
Applicable to IPv4 and IPv6.
Packet filtering with ACLs Optional.
Applicable to IPv4 and IPv6.
Configuring a time range
You can implement ACL rules based on the time of day by applying a time range to them. A
time-based ACL rule only takes effect in any time periods specified by the time range.
The following basic types of time range are available:
•Periodic time range—Recurs periodically on a day or days of the week.
•Absolute time range—Represents only a period of time and does not recur.
You can create a maximum of 256 time ranges, each with a maximum of 32 periodic statements and
12 absolute statements. The active period of a time range is calculated as follows:
1. Combining all periodic statements.
2. Combining all absolute statements.
3. Taking the intersection of the two statement sets as the active period of the time range.
To configure a time range:
Step Command Remarks
1. Enter system
view. system-view N/A
2. Configure a time
range.
time-range time-range-name
{ start-time to end-time days [ from
time1 date1 ] [ to time2 date2 ] |
from time1 date1 [ to time2 date2 ]
| to time2 date2 }
By default, no time range exists.
Repeat this command with the same time
range name to create multiple statements
for a time range.
Configuring a basic ACL
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based only on source IP addresses.
To configure an IPv4 basic ACL:
Step Command Remarks
3. Enter system
view. system-view N/A
4. Create an IPv4
basic ACL and
enter its view.
acl number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv4 basic ACLs are numbered in the range of 2000 to
2999.
You can use the acl name acl-name command to
enter the view of a named IPv4 ACL.

5
Step Command Remarks
5. Configure a
description for
the IPv4 basic
ACL. description text Optional.
By default, an IPv4 basic ACL has no ACL description.
6. Set the rule
numbering step. step step-value Optional.
The default setting is 5.
7. Create or edit a
rule.
rule [ rule-id ] { deny |
permit } [ counting |
fragment |logging |
source {sour-addr
sour-wildcard | any } |
time-range
time-range-name ] *
By default, an IPv4 basic ACL does not contain any
rule.
If the ACL is for QoS traffic classification, do not
specify the fragment keyword.
The counting and logging keywords take effect only
for an ACL used for packet filtering. Do not specify the
two keywords for an ACL used for other purposes.
8. Add or edit a rule
comment. rule rule-id comment
text Optional.
By default, no rule comments are configured.
9. Add or edit a rule
range remark. rule [ rule-id ] remark
text Optional.
By default, no rule range remarks are configured.
10. Enable counting
ACL rule
matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
This command is available only on the HPE 3100 v2
EI switches.
This command takes effect only for an ACL used for
packet filtering. Do not configure this command for an
ACL used for other purposes.
Configuring an IPv6 basic ACL
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an IPv6
basic ACL view
and enter its view.
acl ipv6 number
acl6-number [ name
acl6-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv6 basic ACLs are numbered in the range of 2000
to 2999.
You can use the acl ipv6 name acl6-name
command to enter the view of a named IPv6 ACL.
3. Configure a
description for the
IPv6 basic ACL. description text
Optional.
By default, an IPv6 basic ACL has no ACL
description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.

6
Step Command Remarks
5. Create or edit a
rule.
rule [ rule-id ] { deny |
permit } [ counting |
fragment |logging |
routing [ type
routing-type ] | source
{ipv6-address
prefix-length |
ipv6-address/prefix-length
| any } | time-range
time-range-name ] *
By default, an IPv6 basic ACL does not contain any
rule.
If the ACL is for QoS traffic classification, do not
specify the fragment keyword.
The counting and logging keywords take effect
only for an ACL used for packet filtering. Do not
specify the two keywords for an ACL used for other
purposes.
6. Add or edit a rule
comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a rule
range remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable counting
ACL rule matches
performed in
hardware. hardware-count enable
Optional.
Disabled by default.
This command is available only on the HPE 3100 v2
EI switches.
This command takes effect only for an ACL used for
packet filtering. Do not configure this command for
an ACL used for other purposes.
Configuring an advanced ACL
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on source IP addresses, destination IP addresses,
packet priorities, protocols over IP, and other protocol header information, such as TCP/UDP source
and destination port numbers, TCP flags, ICMP message types, and ICMP message codes.
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv4 advanced ACL:
Step Command Remarks
1. Enter system
view. system-view N/A
2. Create an IPv4
advanced ACL
and enter its
view.
acl number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv4 advanced ACLs are numbered in the range
of 3000 to 3999.
You can use the acl name acl-name command to
enter the view of a named IPv4 ACL.
3. Configure a
description for
the IPv4
advanced ACL. description text
Optional.
By default, an IPv4 advanced ACL has no ACL
description.
4. Set the rule
numbering step. step step-value Optional.
The default setting is 5.

7
Step Command Remarks
5. Create or edit a
rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination
{ dest-addr dest-wildcard |
any } | destination-port
operator port1 [ port2 ] | dscp
dscp |fragment | icmp-type
{icmp-type [ icmp-code ] |
icmp-message } | logging |
precedence precedence |
source {sour-addr
sour-wildcard | any } |
source-port operator port1
[port2 ] | time-range
time-range-name | tos tos ] *
By default, an IPv4 advanced ACL does not
contain any rule.
If an IPv4 advanced ACL is for QoS traffic
classification or packet filtering:
•Do not specifyneq for the operator
argument.
•Do not specify the fragment keyword.
The counting and logging keywords take effect
only for an ACL used for packet filtering. Do not
specify the two keywords for an ACL used for
other purposes.
6. Add or edit a
rule comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a
rule range
remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable counting
ACL rule
matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
This command is available only on the HPE 3100
v2 EI switches.
This command takes effect only for an ACL used
for packet filtering. Do not configure this
command for an ACL used for other purposes.
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the source IPv6 addresses, destination IPv6
addresses, packet priorities, protocols carried over IPv6, and other protocol header fields such as
the TCP/UDP source port number, TCP/UDP destination port number, ICMPv6 message type, and
ICMPv6 message code.
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
Configuration restrictions and guidelines
When the protocol argument takes 43, 44, 51, or 60, the ACL cannot function on for the outbound
QoS application.
Configuration procedure
To configure an IPv6 advanced ACL:
Step Command Remarks
1. Enter system
view. system-view N/A

8
Step Command Remarks
2. Create an IPv6
advanced ACL
and enter its
view.
acl ipv6 number acl6-number
[ name acl6-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
IPv6 advanced ACLs are numbered in the range of
3000 to 3999.
You can use the acl ipv6 name acl6-name
command to enter the view of a named IPv6 ACL.
3. Configure a
description for
the IPv6
advanced
ACL.
description text
Optional.
By default, an IPv6 advanced ACL has no ACL
description.
4. Set the rule
numbering
step. step step-value Optional.
5 by default.
5. Create or edit
a rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination { dest
dest-prefix |dest/dest-prefix |
any } | destination-port
operator port1 [ port2 ] | dscp
dscp |flow-label
flow-label-value | fragment |
icmp6-type { icmp6-type
icmp6-code | icmp6-message }
| logging | routing [ type
routing-type ] | source { source
source-prefix |
source/source-prefix | any } |
source-port operator port1
[port2 ] | time-range
time-range-name ] *
By default IPv6 advanced ACL does not contain
any rule.
If an IPv6 advanced ACL is for QoS traffic
classification or packet filtering:
•Do not specify the ack, dscp, fin, flow-label,
fragment, psh, rst, syn, or urg keyword.
•Do not specify gt, lt, neq, or range for the
operator argument.
The counting and logging keywords take effect
only for an ACL used for packet filtering. Do not
specify the two keywords for an ACL used for other
purposes.
6. Add or edit a
rule comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a
rule range
remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable
counting ACL
rule matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
This command is available only on the HPE 3100
v2 EI switches.
This command takes effect only for an ACL used
for packet filtering. Do not configure this command
for an ACL used for other purposes.
Configuring an Ethernet frame header ACL
Ethernet frame header ACLs, also called "Layer 2 ACLs," match packets based on Layer 2 protocol
header fields, such as source MAC address, destination MAC address, 802.1p priority (VLAN
priority), and link layer protocol type.
To configure an Ethernet frame headerACL:

9
Step Command Remarks
1. Enter system
view. system-view N/A
2. Create an
Ethernet frame
header ACL
and enter its
view.
acl number acl-number
[ name acl-name ]
[ match-order { auto |
config } ]
By default, no ACL exists.
Ethernet frame header ACLs are numbered in the
range of 4000 to 4999.
You can use the acl name acl-name command to
enter the view of a named Ethernet frame header
ACL.
3. Configure a
description for
the Ethernet
frame header
ACL.
description text
Optional.
By default, an Ethernet frame header ACL has no
ACL description.
4. Set the rule
numbering
step. step step-value Optional.
The default setting is 5.
5. Create or edit
a rule.
rule [ rule-id ] { deny |
permit } [ cos vlan-pri |
counting | dest-mac
dest-addr dest-mask | { lsap
lsap-type lsap-type-mask |
type protocol-type
protocol-type-mask } |
source-mac sour-addr
source-mask | time-range
time-range-name ] *
By default,an Ethernet frame header ACL does not
contain any rule.
The lsap keyword is not supported if the ACL is for
QoS traffic classification.
6. Add or edit a
rule comment. rule rule-id comment text Optional.
By default, no rule comments are configured.
7. Add or edit a
rule range
remark. rule [ rule-id ] remark text Optional.
By default, no rule range remarks are configured.
8. Enable
counting ACL
rule matches
performed in
hardware.
hardware-count enable
Optional.
Disabled by default.
This command is available only on the HPE 3100 v2
EI switches.
This command takes effect only for an ACL used for
packet filtering. Do not configure this command for an
ACL used for other purposes.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL)
has the same properties and content as the source ACL, but not the sameACL number and name.
To successfully copy an ACL, make sure that:
•The destinationACL number is from the same category as the sourceACL number.
•The source ACL already exists but the destination ACL does not.
Copying an IPv4 ACL

10
Step Command
1. Enter system view. system-view
2. Copy an existing IPv4 ACLto create a
new IPv4 ACL. acl copy { source-acl-number | name source-acl-name } to
{ dest-acl-number | name dest-acl-name }
Copying an IPv6 ACL
Step Command
1. Enter system view. system-view
2. Copy an existing IPv6 ACLto generate a
new one of the same category. acl ipv6 copy { source-acl6-number | name
source-acl6-name } to { dest-acl6-number | name
dest-acl6-name }
Packet filtering with ACLs
IMPORTANT:
This feature is available only on the HPE 3100 v2 EI switches.
You can use an ACLto filter incoming or outgoing IPv4 or IPv6 packets. You can apply one IPv4 ACL,
one IPv6 AL, and one Ethernet frame header ACL most to filter packets in the same direction of an
interface.
With a basic or advancedACL, you can log filtering events by specifying the logging keyword in the
ACL rules and enabling the counting function. To enable counting for rule matches performed in
hardware, configure the hardware-count enable command for the ACL or specify the counting
keyword in the ACL rules.
You can set the packet filter to periodically send packet filtering logs to the information center as
informational messages. The interval for generating and outputting packet filtering logs is
configurable. The log information includes the number of matching packets and the ACL rules used
in an interval. For more information about the information center, see Network Management and
Monitoring Configuration Guide.
Applying an IPv4 or Ethernet frame header ACL for packet
filtering
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number
N/A
3. Apply an IPv4 basic, IPv4
advanced, or Ethernet frame
header ACL to the interface
to filter packets.
packet-filter { acl-number |
name acl-name } inbound
By default, no ACL is applied to any
interface.
4. Exit to system view. quit N/A

11
Step Command Remarks
5. Set the interval for
generating and outputting
IPv4 packet filtering logs. acl logging frequence
frequence By default, the interval is 0. No IPv4
packet filtering logs are generated.
Applying an IPv6 ACL for packet filtering
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number
N/A
3. Apply an IPv6 basic or IPv6
advanced ACL to the
interface to filter IPv6
packets.
packet-filter ipv6 { acl6-number |
name acl6-name } inbound By default, no IPv6 ACL is applied
to the interface.
4. Exit to system view. quit N/A
5. Set the interval for
generating and outputting
IPv6 packet filtering logs. acl ipv6 logging frequence
frequence
The default interval is 0. No IPv6
packet filtering logs are
generated.
Displaying and maintaining ACLs
Task Command Remarks
Display configuration and match
statistics for one or all IPv4 ACLs.
display acl { acl-number | all | name
acl-name } [ slot slot-number ] [ |{ begin |
exclude | include } regular-expression ] Available in any view
Display configuration and match
statistics for one or all IPv6 ACLs.
display acl ipv6 { acl6-number | all | name
acl6-name } [ slot slot-number ] [ |{ begin |
exclude | include } regular-expression ] Available in any view
Display the usage of ACL rules. display acl resource [ slot slot-number ] [ |
{ begin | exclude | include }
regular-expression ]
Available in any view
This command is
available only on the
HPE 3100 v2 EI
switches.
Display the application status of
packet filtering ACLs on
interfaces.
display packet-filter { { all | interface
interface-type interface-number }
[ inbound ] } [ |{ begin | exclude | include }
regular-expression ]
Available in any view
This command is
available only on the
HPE 3100 v2 EI
switches.
Display the configuration and
status of one or all time ranges.
display time-range {time-range-name |
all } [ |{ begin | exclude | include }
regular-expression ] Available in any view
Clear statistics for one or all IPv4
ACLs. reset acl counter { acl-number | all | name
acl-name } Available in user view
Clear statistics for one or all IPv6
basic and advanced ACLs. reset acl ipv6 counter { acl6-number | all |
name acl6-name } Available in user view

12
Configuration example of using ACL for device
management
Network requirements
As shown in Figure 1, configure ACLs so that:
•Host A can telnet to the switch only during the working time (8:30 to 18:00 of every working
day).
•As a TFTP client, the switch can get files from only the server 11.1.1.100. This makes sure that
the switch saves only authorized files.
•As an FTP server, the switch accepts the login requests from only the NMS.
Figure 1 Network diagram
Configuration procedure
1. Limit the telnet login requests:
# Create a time range named telnet to cover 8:30 to 18:00 of every working day.
<Switch> system-view
[Switch] time-range telnet 8:30 to 18:00 working-day
# Create IPv4 basic ACL 2000, and configure a rule for the ACL to permit the packets sourced
from 10.1.3.1 during only the time specified by time range telnet.
[Switch] acl number 2000
[Switch-acl-basic-2000] rule permit source 10.1.3.1 0 time-range telnet
[Switch-acl-basic-2000] quit
# Apply ACL 2000 to the inbound traffic of all telnet user interfaces to limit the telnet login
requests.
[Switch] user-interface vty 0 15
[Switch-ui-vty0-15] acl 2000 inbound

13
2. Limit the access to the TFTP server:
# Create IPv4 basic ACL 2001, and configure a rule for the ACL to permit only the packets
sourced from 11.1.1.100.
[Switch] acl number 2001
[Switch-acl-basic-2001] rule permit source 11.1.1.100 0
[Switch-acl-basic-2001] quit
# Use ACL 2001 to control the switch's access to a specific TFTP server.
[Switch] tftp-server acl 2001
3. Limit the FTP login requests:
# Create IPv4 basic ACL 2002, and configure a rule for the ACL to permit only the packets
sourced from 10.1.3.1.
[Switch] acl number 2002
[Switch-acl-basic-2001] rule permit source 10.1.3.1 0
[Switch-acl-basic-2001] quit
# Enable the FTP server on the switch.
[Switch] ftp server enable
# Use ACL 2001 to control FTP clients' access to the FTP server.
[Switch] ftp server acl 2002
IPv4 packet filtering configuration example
IMPORTANT:
This example is available only on the HPE 3100 v2 EI switches.
Network requirements
As shown in Figure 2, apply anACL to the inbound direction of interface Ethernet 1/0/1 on Device A
so that every day from 08:00 to 18:00 the interface allows only packets sourced from Host Ato pass.
Configure DeviceA to output IPv4 packet filtering logs to the console at 10-minute intervals.
Figure 2 Network diagram
Configuration procedure
# Create a time range from 08:00 to 18:00 every day.
<DeviceA> system-view
[DeviceA] time-range study 8:00 to 18:00 daily

14
# Create IPv4 ACL2009, and configure two rules inthe ACL. One rule permits packets sourced from
Host A and the other denies packets sourced from any other host during the time range study.
Enable logging for the permit rule.
[DeviceA] acl number 2009
[DeviceA-acl-basic-2009] rule permit source 192.168.1.2 0 time-range study logging
[DeviceA-acl-basic-2009] rule deny source any time-range study
[DeviceA-acl-basic-2009] quit
# Enable the device to generate and output IPv4 packet filtering logs at 10-minute intervals.
[DeviceA] acl logging frequence 10
# Configure the device to output informational log messages to the console.
[DeviceA] info-center source default channel 0 log level informational
# Apply IPv4 ACL 2009 to filter incoming packets on Ethernet 1/0/1.
[DeviceA] interface ethernet 1/0/1
[DeviceA-Ethernet1/0/1] packet-filter 2009 inbound
[DeviceA-Ethernet1/0/1] quit
IPv6 packet filtering configuration example
IMPORTANT:
This example is available only on the HPE 3100 v2 EI switches.
Network requirements
As shown in Figure 3, apply an IPv6 ACLto the incoming traffic of Ethernet 1/0/1 on Device Aso that
every day from 08:00 to 18:00 the interface allows only packets from Host A to pass through.
Configure DeviceA to output IPv4 packet filtering logs to the console at 10-minute intervals.
Figure 3 Network diagram
Configuration procedure
# Create a time range from 08:00 to 18:00 every day.
<DeviceA> system-view
[DeviceA] time-range study 8:0 to 18:0 daily
# Create IPv6 ACL 2009, and configure two rules for the ACL. One permits packets sourced from
Host A and the other denies packets sourced from any other host during the time range study.
Enable logging for the permit rule.
[DeviceA] acl ipv6 number 2009
IPv6 network
Eth1/0/1
Host A
1001::2/64
Device A
Host B
1001::3/64

15
[DeviceA-acl6-basic-2009] rule permit source 1001::2 128 time-range study logging
[DeviceA-acl6-basic-2009] rule deny source any time-range study
[DeviceA-acl6-basic-2009] quit
# Configure the device to collect and output IPv6 packet filtering logs at 10-minute intervals.
[DeviceA] acl ipv6 logging frequence 10
# Configure the device to output informational log messages to the console.
[DeviceA] info-center source default channel 0 log level informational
# Apply IPv6 ACL 2009 to filter incoming packets on Ethernet 1/0/1.
[DeviceA] interface ethernet 1/0/1
[DeviceA-Ethernet1/0/1] packet-filter ipv6 2009 inbound
[DeviceA-Ethernet1/0/1] quit