HPE FlexFabric 5940 SERIES Installation manual

HPE FlexFabric 5940 Switch Series
A
CL and QoS Command Reference
Part number: 5200-1001
Software version: Release 2508
Document version: 6W100-20160728

© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
ACL commands ······························································································1
acl·······························································································································································1
acl copy······················································································································································2
acl logging interval ·····································································································································3
acl trap interval···········································································································································4
description··················································································································································5
display acl ··················································································································································6
display packet-filter ····································································································································7
display packet-filter statistics······················································································································8
display packet-filter statistics sum············································································································11
display packet-filter verbose·····················································································································12
display qos-acl resource ··························································································································14
packet-filter···············································································································································15
packet-filter default deny··························································································································16
packet-filter filter·······································································································································17
reset acl counter·······································································································································17
reset packet-filter statistics·······················································································································18
rule (IPv4 advanced ACL view)················································································································19
rule (IPv4 basic ACL view)·······················································································································23
rule (IPv6 advanced ACL view)················································································································25
rule (IPv6 basic ACL view)·······················································································································30
rule (Layer 2 ACL view)····························································································································31
rule comment ···········································································································································33
step ··························································································································································34
QoS policy commands··················································································35
Traffic class commands ···································································································································35
display traffic classifier·····························································································································35
if-match ····················································································································································36
traffic classifier ·········································································································································41
Traffic behavior commands······························································································································42
accounting················································································································································42
car····························································································································································42
display traffic behavior ·····························································································································44
filter ··························································································································································45
nest top-most ···········································································································································46
redirect·····················································································································································46
remark customer-vlan-id ··························································································································47
remark dot1p············································································································································48
remark drop-precedence··························································································································49
remark dscp ·············································································································································49
remark ip-precedence······························································································································50
remark local-precedence··························································································································51
remark qos-local-id···································································································································52
remark service-vlan-id······························································································································52
traffic behavior··········································································································································53
QoS policy commands·····································································································································53
classifier behavior ····································································································································53
control-plane ············································································································································54
display qos policy·····································································································································55
display qos policy control-plane···············································································································56
display qos policy control-plane pre-defined····························································································57
display qos policy global ··························································································································58
display qos policy interface······················································································································60
display qos policy user-profile··················································································································63
display qos vlan-policy·····························································································································64
qos apply policy (interface view, control plane view) ···············································································66

ii
qos apply policy (user profile view)··········································································································67
qos apply policy global·····························································································································67
qos policy·················································································································································68
qos vlan-policy ·········································································································································69
reset qos policy control-plane ··················································································································69
reset qos policy global······························································································································70
reset qos vlan-policy ································································································································70
Priority mapping commands ·········································································72
Priority map commands ···································································································································72
display qos map-table······························································································································72
import·······················································································································································73
qos map-table ··········································································································································73
Priority trust mode commands ·························································································································74
display qos trust interface ························································································································74
qos trust ···················································································································································75
Port priority commands····································································································································75
qos priority················································································································································75
Traffic policing, GTS, and rate limit commands ············································77
Traffic policing commands ·······························································································································77
qos car ·····················································································································································77
GTS commands···············································································································································78
display qos gts interface···························································································································78
qos gts······················································································································································79
Rate limit commands ·······································································································································80
display qos lr interface ·····························································································································80
qos lr ························································································································································81
Congestion management commands ···························································83
Common commands········································································································································83
display qos queue interface ·····················································································································83
SP commands··················································································································································84
display qos queue sp interface·················································································································84
qos sp·······················································································································································84
WRR commands··············································································································································85
display qos queue wrr interface ···············································································································85
qos wrr ·····················································································································································86
qos wrr { byte-count | weight }··················································································································87
qos wrr group sp ······································································································································87
WFQ commands··············································································································································88
display qos queue wfq interface···············································································································88
qos bandwidth queue·······························································································································89
qos wfq·····················································································································································90
qos wfq { byte-count | weight }·················································································································91
qos wfq group sp······································································································································92
Queue-based accounting commands ··············································································································92
display qos queue-statistics interface outbound ······················································································92
Queue scheduling profile commands···············································································································94
bandwidth queue······································································································································94
display qos qmprofile configuration··········································································································95
display qos qmprofile interface·················································································································96
qos apply qmprofile··································································································································96
qos qmprofile············································································································································97
queue·······················································································································································98
Congestion avoidance commands······························································100
WRED commands ·········································································································································100
display qos wred interface······················································································································100
display qos wred table····························································································································100
qos wred apply·······································································································································101
qos wred queue table·····························································································································102

iii
queue·····················································································································································103
queue ecn ··············································································································································104
queue weighting-constant······················································································································105
Aggregate CAR commands ········································································106
car name················································································································································106
display qos car name·····························································································································106
qos car ···················································································································································107
reset qos car name ································································································································109
Time range commands···············································································110
display time-range··································································································································110
time-range··············································································································································110
Data buffer commands················································································113
buffer apply ············································································································································113
buffer queue guaranteed························································································································113
buffer queue shared·······························································································································114
buffer total-shared··································································································································115
burst-mode enable·································································································································116
display buffer··········································································································································116
display buffer usage·······························································································································117
QCN commands ·························································································119
display qcn cp interface··························································································································119
display qcn global···································································································································120
display qcn interface ······························································································································121
display qcn profile ··································································································································122
qcn enable··············································································································································122
qcn port priority ······································································································································123
qcn priority··············································································································································124
qcn priority profile···································································································································125
qcn profile···············································································································································126
reset qcn cp interface·····························································································································126
Document conventions and icons·······························································128
Conventions···················································································································································128
Network topology icons··································································································································129
Support and other resources ······································································130
Accessing Hewlett Packard Enterprise Support ····························································································130
Accessing updates·········································································································································130
Websites ················································································································································131
Customer self repair·······························································································································131
Remote support······································································································································131
Documentation feedback ·······················································································································131
Index···········································································································133

1
ACL commands
acl
Use acl to create an ACL and enter its view, or enter the view of an existing ACL.
Use undo acl to delete the specified or allACLs.
Syntax
acl [ ipv6 ] { advanced |basic } { acl-number | name acl-name } [ match-order { auto | config } ]
acl mac { acl-number | name acl-name } [ match-order { auto | config } ]
undo acl [ ipv6 ] { all | { advanced |basic } { acl-number | name acl-name } }
undo acl mac { all | acl-number | name acl-name }
Default
No ACLs exist.
Views
System view
Predefined user roles
network-admin
Parameters
ipv6: Specifies the IPv6 ACL type. To specify the IPv4 ACL type, do not use this keyword.
basic: Specifies the basicACL type.
advanced: Specifies the advancedACL type.
mac: Specifies the Layer 2 ACL type.
number acl-number: Assigns a number to the ACL.
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
•4000 to 4999 for Layer 2ACLs.
name acl-name: Assigns a name to the ACL. The acl-name argument is a case-insensitive string of
1 to 63 characters. It must start with an English letter and to avoid confusion, it cannot be all.
match-order: Specifies the order in which ACL rules are compared against packets.
•auto: Compares ACL rules in depth-first order.
•config: ComparesACL rules in ascending order of rule ID. The rule with a smaller ID has a
higher priority. If you do not specify a match order, the config order applies by default.
all: Specifies all ACLs of the specified type.
Usage guidelines
You can change the match order only forACLs that do not contain any rules.
Matching packets are forwarded through slow forwarding if an ACL rule contains match criteria or
has functions enabled in addition to the following match criteria and functions:
•Source and destination IP addresses.
•Source and destination ports.
•Transport layer protocol.

2
•ICMP or ICMPv6 message type, message code, and message name.
•VPN instance.
•Logging.
•Time range.
Slow forwarding requires packets to be sent to the control plane for forwarding entry calculation,
which affects the device forwarding performance.
Examples
# Create IPv4 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000]
# Create IPv4 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl basic name flow
[Sysname-acl-ipv4-basic-flow]
# Create IPv4 advanced ACL 3000 and enter its view.
<Sysname> system-view
[Sysname] acl advanced 3000
[Sysname-acl-ipv4-adv-3000]
# Create IPv6 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic 2000
[Sysname-acl-ipv6-basic-2000]
# Create IPv6 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic name flow
[Sysname-acl-ipv6-basic-flow]
# Create IPv6 advanced ACL abc and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 advanced name abc
[Sysname-acl-ipv6-adv-abc]
# Create Layer 2ACL 4000 and enter its view.
<Sysname> system-view
[Sysname] acl mac 4000
[Sysname-acl-mac-4000]
# Create Layer 2ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl mac name flow
[Sysname-acl-mac-flow]
Related commands
display acl
acl copy
Use acl copy to create an ACL by copying anACL that already exists.

3
Syntax
acl [ ipv6 | mac ] copy { source-acl-number | name source-acl-name } to { dest-acl-number | name
dest-acl-name }
Views
System view
Predefined user roles
network-admin
Parameters
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
source-acl-number: Specifies an existing sourceACL by its number.
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
•4000 to 4999 for Layer 2ACLs.
name source-acl-name: Specifies an existing source ACL by its name. The source-acl-name
argument is a case-insensitive string of 1 to 63 characters.
dest-acl-number:Assigns a unique number to the new ACL. Available value ranges include:
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
•4000 to 4999 for Layer 2ACLs.
name dest-acl-name: Assigns a unique name to the new ACL. The dest-acl-name argument is a
case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid
confusion, it cannot be all.
Usage guidelines
The new ACL and the sourceACL must be the same type.
The new ACL has the same properties and content as the source ACL, but uses a different number
or name from the sourceACL.
To specify the IPv4 ACL type, do not specify the ipv6 or mac keyword.
Examples
# Create IPv4 basic ACL 2002 by copying IPv4 basicACL 2001.
<Sysname> system-view
[Sysname] acl copy 2001 to 2002
# Create IPv4 basic ACL paste by copying IPv4 basicACL test.
<Sysname> system-view
[Sysname] acl copy name test to name paste
acl logging interval
Use acl logging interval to enable logging for packet filtering and set the interval.
Use undo acl logging interval to restore the default.
Syntax
acl logging interval interval

4
undo acl logging interval
Default
The interval is 0. The device does not generate log entries for packet filtering.
Views
System view
Predefined user roles
network-admin
Parameters
interval: Specifies the interval at which log entries are generated and output. It must be a multiple of
5, in the range of 0 to 1440 minutes. To disable the logging, set the value to 0.
Usage guidelines
The logging feature is available for IPv4 or IPv6ACL rules that have the logging keyword.
You can configure theACL module to generate log entries for packet filtering and output them to the
information center at the output interval. The log entry records the number of matching packets and
the matched ACL rules. If an ACL is matched for the first time, the device immediately outputs a log
entry to record the matching packet. For more information about theinformation center, see Network
Management and Monitoring Configuration Guide.
Examples
# Configure the device to generate and output packet filtering log entries every 10 minutes.
<Sysname> system-view
[Sysname] acl logging interval 10
Related commands
rule (IPv4 advanced ACL view)
rule (IPv4 basic ACL view)
rule (IPv6 advanced ACL view)
rule (IPv6 basic ACL view)
acl trap interval
Use acl trap interval to enable SNMP notifications for packet filtering and set the interval.
Use undo acl interval to restore the default.
Syntax
acl trap interval interval
undo acl trap interval
Default
The interval is 0. The device does not generate SNMP notifications for packet filtering.
Views
System view
Predefined user roles
network-admin

5
Parameters
interval: Specifies the interval at which SNMP notifications are generated and output. It must be a
multiple of 5, in the range of 0 to 1440 minutes. To disable SNMP notifications, set the value to 0.
Usage guidelines
The SNMP notifications feature is available for IPv4 or IPv6 ACL rules that have the logging
keyword.
You can configure the ACL module to generate SNMP notifications for packet filtering and output
them to the SNMP module at the output interval. The notification records the number of matching
packets and the matched ACL rules. If an ACL is matched for the first time, the device immediately
outputs a notification to record the matching packet. For more information about SNMP, seeNetwork
Management and Monitoring Configuration Guide.
Examples
# Configure the device to generate and output packet filtering SNMP notifications every 10 minutes.
<Sysname> system-view
[Sysname] acl trap interval 10
Related commands
rule (IPv4 advanced ACL view)
rule (IPv4 basic ACL view)
rule (IPv6 advanced ACL view)
rule (IPv6 basic ACL view)
description
Use description to configure a description for an ACL.
Use undo description to delete an ACL description.
Syntax
description text
undo description
Default
An ACL does not have a description.
Views
IPv4 basic/advancedACL view
IPv6 basic/advancedACL view
Layer 2 ACL view
Predefined user roles
network-admin
Parameters
text: Specifies a description, a case-sensitive string of 1 to 127 characters.
Examples
# Configure a description for IPv4 basicACL 2000.
<Sysname> system-view
[Sysname] acl basic 2000

6
[Sysname-acl-ipv4-basic-2000] description This is an IPv4 basic ACL.
Related commands
display acl
display acl
Use display acl to display ACL configuration and match statistics.
Syntax
display acl [ ipv6 | mac ] { acl-number | all | name acl-name }
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
acl-number: Specifies anACL by its number.
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
•4000 to 4999 for Layer 2ACLs.
all: Specifies all ACLs of the specified type.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
Usage guidelines
This command displays ACL rules in config or auto order, whichever is configured.
To specify the IPv4 ACL type, do not specify the ipv6 or mac keyword.
Examples
# Display configuration and match statistics for IPv4 basic ACL 2001.
<Sysname> display acl 2001
Basic IPv4 ACL 2001, 1 rules, match-order is auto,
This is an IPv4 basic ACL.
ACL's step is 5
rule 5 permit source 1.1.1.1 0
rule 5 comment This rule is used on Ten-GigabitEthernet1/0/1.
Table 1 Command output
Field Description
Basic IPv4 ACL 2001 Type and number of the ACL. The following field information is about IPv4
basic ACL 2000.
1 rules The ACL contains two rules.
match-order is auto The match order for the ACL is auto, which sorts ACL rules in depth-first
order. This field is not displayed when the match order is config.

7
Field Description
This is an IPv4 basic ACL. Description of the ACL.
ACL's step is 5 The rule numbering step is 5.
rule 5 permit source 1.1.1.1 0 Content of rule 5. The rule permits packets sourced from the IP address
1.1.1.1.
rule 5 comment This rule is
used on
Ten-GigabitEthernet1/0/1. Comment of rule 5.
display packet-filter
Use display packet-filter to display ACL application information for packet filtering.
Syntax
display packet-filter { interface [ interface-type interface-number ] [ inbound | outbound ] |
interface vlan-interface vlan-interface-number [ inbound | outbound ] [ slot slot-number ] }
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface [ interface-type interface-number ]: Specifies an interface by its type and number. VLAN
interfaces are not supported. If you do not specify an interface, this command displays ACL
application information for packet filtering on all interfaces except VLAN interfaces.
interface vlan-interface vlan-interface-number: Specifies a VLAN interface by its number.
vlan [ vlan-id ]: Specifies a VLAN by its ID. If you do not specify a VLAN, this command displays ACL
application information for packet filtering in all VLANs.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member
device, this command displaysACL application information for packet filtering for the master device.
Usage guidelines
If neither the inbound keyword nor the outbound keyword is specified, this command displays ACL
application information for packet filtering in both directions.
Examples
# Display ACL application information for inbound packet filtering on interface Ten-GigabitEthernet
1/0/1.
<Sysname> display packet-filter interface ten-gigabitethernet 1/0/1 inbound
Interface: Ten-GigabitEthernet1/0/1
Inbound policy:
IPv4 ACL 2001
IPv6 ACL 2002 (Failed)
MAC ACL 4003, Hardware-count (Failed)
IPv4 ACL 2004, Hardware-count (Failed)

8
IPv4 default action: Deny
Table 2 Command output
Field Description
Interface Interface to which the ACL applies.
Inbound policy ACL used for filtering incoming traffic.
Outbound policy ACL used for filtering outgoing traffic.
IPv4 ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
IPv6 ACL 2002 (Failed) The device has failed to apply IPv6 basic ACL 2002.
Hardware-count ACL rule match counting has been successfully enabled.
Hardware-count (Failed) The device has failed to enable counting ACL rule matches.
IPv4 default action
Packet filter default action for packets that do not match any IPv4
ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
IPv6 default action
Packet filter default action for packets that do not match any IPv6
ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
MAC default action
Packet filter default action for packets that do not match any Layer
2 ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
display packet-filter statistics
Use display packet-filter statistics to display packet filtering statistics.
Syntax
display packet-filter statistics interface interface-type interface-number { inbound | outbound }
[ [ ipv6 | mac ] { acl-number | name acl-name } ] [ brief ]
Views
Any view

9
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
acl-number: Specifies anACL by its number.
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
•4000 to 4999 for Layer 2ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
brief: Displays brief statistics.
Usage guidelines
If acl-number, name acl-name, ipv6, or mac is not specified, this command displays packet filtering
statistics for all ACLs.
To specify the IPv4 ACL type, do not specify the ipv6 or mac keyword.
Examples
# Display packet filtering statistics for allACLs on incoming packets of Ten-GigabitEthernet 1/0/1.
<Sysname> display packet-filter statistics interface ten-gigabitethernet 1/0/1 inbound
Interface: Ten-GigabitEthernet1/0/1
Inbound policy:
IPv4 ACL 2001, Hardware-count
From 2011-06-04 10:25:21 to 2011-06-04 10:35:57
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (No resource)
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
IPv4 ACL 2002 (Failed)
MAC ACL 4000
From 2011-06-04 10:25:34 to 2011-06-04 10:35:57
rule 0 permit
IPv6 ACL 2000
IPv4 default action: Deny
MAC default action: Deny

10
Table 3 Command output
Field Description
Interface Interface to which the ACL applies.
Inbound policy ACL used for filtering incoming traffic.
Outbound policy ACL used for filtering outgoing traffic.
IPv4 ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
IPv4 ACL 2002 (Failed) The device has failed to apply IPv4 basic ACL 2002.
Hardware-count ACL rule match counting has been successfully enabled.
Hardware-count (Failed) The device has failed to enable counting ACL rule matches.
From 2011-06-04 10:25:21 to
2011-06-04 10:35:57 Start time and end time of the statistics.
2 packets Two packets matched the rule.
This field is not displayed when no packets matched the rule.
No resource Resources are not enough for counting matches for the rule. In packet filtering statistics, this field is displayed for a rule when resources are
not sufficient for rule match counting.
rule 5 permit source 1.1.1.1 0
(Failed) The device has failed to apply rule 5.
Totally 2 packets permitted, 0
packets denied Number of packets permitted and denied by the ACL.
Totally 100% permitted, 0%
denied Ratios of permitted and denied packets to all packets.
IPv4 default action
Packet filter default action for packets that do not match any IPv4
ACLs:
•Deny—The default action deny has been successfully applied for
packet filtering.
•Deny (Failed)—The device has failed to apply the default action
deny for packet filtering. The action permit still functions.
•Permit—The default action permit has been successfully applied
for packet filtering.
IPv6 default action
Packet filter default action for packets that do not match any IPv6
ACLs:
•Deny—The default action deny has been successfully applied for
packet filtering.
•Deny (Failed)—The device has failed to apply the default action
deny for packet filtering. The action permit still functions.
•Permit—The default action permit has been successfully applied
for packet filtering.
MAC default action
Packet filter default action for packets that do not match any Layer 2
ACLs:
•Deny—The default action deny has been successfully applied for
packet filtering.
•Deny (Failed)—The device has failed to apply the default action
deny for packet filtering. The action permit still functions.
•Permit—The default action permit has been successfully applied
for packet filtering.
Totally 7 packets The default action has been executed on seven packets.

11
Related commands
reset packet-filter statistics
display packet-filter statistics sum
Use display packet-filter statistics sum to display accumulated packet filtering statistics for an
ACL.
Syntax
display packet-filter statistics sum { inbound | outbound } [ ipv6 | mac ] { acl-number | name
acl-name } [ brief ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
acl-number: Specifies anACL by its number.
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
•4000 to 4999 for Layer 2ACLs.
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
brief: Displays brief statistics.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 or mac keyword.
Examples
# Display accumulated packet filtering statistics for IPv4 basicACL 2001 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2001
Sum:
Inbound policy:
IPv4 ACL 2001
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0
rule 10 permit vpn-instance test
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
# Display brief accumulated packet filtering statistics for IPv4 basic ACL 2000 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2000 brief
Sum:

12
Inbound policy:
IPv4 ACL 2000
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
Table 4 Command output
Field Description
Sum Accumulated packet filtering statistics.
Inbound policy Accumulated packet filtering statistics in the inbound direction.
Outbound policy Accumulated packet filtering statistics in the outbound direction.
IPv4 ACL 2001 Accumulated packet filtering statistics of IPv4 basic ACL 2001.
2 packets Two packets matched the rule.
This field is not displayed when no packets matched the rule.
Totally 2 packets permitted, 0 packets
denied Number of packets permitted and denied by the ACL.
Totally 100% permitted, 0% denied Ratios of permitted and denied packets to all packets.
Related commands
reset packet-filter statistics
display packet-filter verbose
Use display packet-filter verbose to displayACL application details for packet filtering.
Syntax
display packet-filter verbose interface interface-type interface-number { inbound | outbound }
[ [ ipv6 |mac ] { acl-number | name acl-name } ] [ slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies an interface by its type and number. The slot
slot-number option is not available for an Ethernet interface.
inbound: Specifies the inbound direction.
outbound: Specifies the outbound direction.
ipv6: Specifies the IPv6 ACL type.
mac: Specifies the Layer 2 ACL type.
acl-number: Specifies anACL by its number.
•2000 to 2999 for basicACLs.
•3000 to 3999 for advancedACLs.
•4000 to 4999 for Layer 2ACLs.

13
name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string
of 1 to 63 characters.
slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member
device, this command displaysACL application details for packet filtering for the master device.
Usage guidelines
If acl-number, name acl-name, ipv6, or mac is not specified, this command displays application
details of all ACLs for packet filtering.
To specify the IPv4 ACL type, do not specify the ipv6 or mac keyword.
Examples
# Display application details of all ACLs for inbound packet filtering on Ten-GigabitEthernet 1/0/1.
<Sysname> display packet-filter verbose interface ten-gigabitethernet 1/0/1 inbound
Interface: Ten-GigabitEthernet1/0/1
Inbound policy:
IPv4 ACL 2001
rule 0 permit
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (Failed)
IPv4 ACL 2002 (Failed)
IPv6 ACL 2000
rule 0 permit
MAC ACL 4000
IPv4 default action: Deny
IPv6 default action: Deny
MAC default action: Deny
Table 5 Command output
Field Description
Interface Interface to which the ACL applies.
Inbound policy ACL used for filtering incoming traffic.
Outbound policy ACL used for filtering outgoing traffic.
IPv4 ACL 2001 IPv4 basic ACL 2001 has been successfully applied.
IPv4 ACL 2002 (Failed) The device has failed to apply IPv4 basic ACL 2002.
Hardware-count ACL rule match counting has been successfully enabled.
Hardware-count (Failed) The device has failed to enable counting ACL rule matches.
rule 5 permit source 1.1.1.1 0 (Failed) The device has failed to apply rule 5.
IPv4 default action
Packet filter default action for packets that do not match any
IPv4 ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default

14
Field Description
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
IPv6 default action
Packet filter default action for packets that do not match any
IPv6 ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
MAC default action
Packet filter default action for packets that do not match any
Layer 2 ACLs:
•Deny—The default action deny has been successfully
applied for packet filtering.
•Deny (Failed)—The device has failed to apply the default
action deny for packet filtering. The action permit still
functions.
•Permit—The default action permit has been successfully
applied for packet filtering.
display qos-acl resource
Use display qos-acl resource to display QoS and ACL resource usage.
Syntax
display qos-acl resource [ slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member
device, this command displays QoS andACL resource usage for all member devices.
Examples
# Display QoS and ACL resource usage.
<Sysname> display qos-acl resource
Interfaces: FGE9/0/1 to FGE9/0/19, XGE9/0/20:1 to XGE9/0/20:4
XGE9/0/21:1 to XGE9/0/21:4, XGE9/0/22:1 to XGE9/0/22:4
XGE9/0/23:1 to XGE9/0/23:4, XGE9/0/24:1 to XGE9/0/24:4
XGE9/0/25:1 to XGE9/0/25:4, XGE9/0/26:1 to XGE9/0/26:4
XGE9/0/27:1 to XGE9/0/27:4, XGE9/0/28:1 to XGE9/0/28:4
FGE9/0/29 to FGE9/0/32 (slot 9)
---------------------------------------------------------------------
Type Total Reserved Configured Remaining Usage

15
---------------------------------------------------------------------
VFP ACL 1024 261 0 763 25%
IFP ACL 16384 14336 8 2040 87%
IFP Meter 8192 7168 0 1024 87%
IFP Counter 8192 7168 2 1022 87%
EFP ACL 1024 0 3 1021 0%
EFP Meter 512 0 0 512 0%
EFP Counter 512 0 0 512 0%
Table 6 Command output
Field Description
Interfaces Interface range for the resources.
Type
Resource type:
•ACL—ACL rule resources.
•Meter—Traffic policing resources.
•Counter—Traffic accounting resources.
•VFP—Resources for marking local QoS ID before Layer 2 forwarding.
•IFP—Inbound resources.
•EFP—Outbound resources.
Total Total number of resources.
Reserved Number of reserved resources.
Configured Number of resources that has been applied.
Remaining Number of resources that you can apply.
Usage Configured and reserved resources as a percentage of total resources. If the percentage is not an integer, this field displays the integer part. For
example, if the actual usage is 50.8%, this field displays 50%.
packet-filter
Use packet-filter to apply anACL to an interface to filter packets.
Use undo packet-filter to remove anACL from an interface.
Syntax
packet-filter [ ipv6 | mac ] { acl-number | name acl-name } { inbound | outbound }
[ hardware-count ]
undo packet-filter [ ipv6 | mac ] { acl-number | name acl-name } { inbound | outbound }
Default
No ACL is applied to an interface to filter packets.
Views
Layer 2/Layer 3 Ethernet interface view
Layer 2/Layer 3 aggregate interface view
VLAN interface view
Predefined user roles
network-admin