HPE FlexNetwork 7500 Series User manual

HPE FlexNetwork 7500 Switch Series
ACL and QoS Configuration Guide
P
art number: 5200-1923a
Software
version: 7500-CMW710-R7557P01
Document version: 6W101-20171020

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ACLs···························································································1
Overview····························································································································································1
ACL types···················································································································································1
Numbering and naming ACLs····················································································································1
Match order················································································································································1
Rule numbering··········································································································································2
Fragment filtering with ACLs······················································································································3
Configuration task list·········································································································································3
Configuring a basic ACL ····································································································································3
Configuring an IPv4 basic ACL··················································································································3
Configuring an IPv6 basic ACL··················································································································4
Configuring an advanced ACL···························································································································5
Configuring an IPv4 advanced ACL···········································································································5
Configuring an IPv6 advanced ACL···········································································································6
Configuring a Layer 2 ACL·································································································································7
Configuring a user-defined ACL·························································································································8
Copying an ACL·················································································································································9
Configuring packet filtering with ACLs ···············································································································9
Applying an ACL to an interface for packet filtering·················································································10
Configuring the applicable scope of packet filtering on a VLAN interface ···············································10
Configuring logging and SNMP notifications for packet filtering ······························································10
Setting the packet filtering default action ·································································································11
Displaying and maintaining ACLs ····················································································································11
ACL configuration examples····························································································································12
Interface-based packet filtering configuration example············································································12
QoS overview······························································································14
QoS service models·········································································································································14
Best-effort service model ·························································································································14
IntServ model···········································································································································14
DiffServ model··········································································································································14
QoS techniques overview ································································································································14
Deploying QoS in a network·····················································································································15
QoS processing flow in a device··············································································································15
Configuring a QoS policy·············································································17
Non-MQC approach·········································································································································17
MQC approach·················································································································································17
Configuration procedure diagram·····················································································································17
Defining a traffic class······································································································································18
Defining a traffic behavior ································································································································18
Defining a QoS policy·······································································································································18
Applying the QoS policy···································································································································19
Applying the QoS policy to an interface···································································································19
Applying the QoS policy to a VLAN··········································································································19
Applying the QoS policy globally··············································································································20
Applying the QoS policy to a control plane ······························································································20
Displaying and maintaining QoS policies·········································································································21
Configuring priority mapping········································································23
Overview··························································································································································23
Introduction to priorities····························································································································23
Priority maps············································································································································23
Priority trust mode····································································································································24
Priority mapping process··························································································································24
Priority mapping configuration task list·············································································································26
Configuring a priority map································································································································26

ii
Configuring an interface to trust packet priority for priority mapping································································27
Changing the port priority of an interface·········································································································27
Displaying and maintaining priority mapping····································································································28
Priority mapping configuration examples·········································································································28
Port priority configuration example···········································································································28
Priority map and priority marking configuration example·········································································29
Configuring traffic policing, GTS, and rate limit············································32
Overview··························································································································································32
Traffic evaluation and token buckets········································································································32
Traffic policing··········································································································································33
GTS··························································································································································34
Rate limit··················································································································································35
Configuring traffic policing································································································································36
Configuring GTS ··············································································································································37
Configuring the rate limit··································································································································37
Displaying and maintaining traffic policing, GTS, and rate limit·······································································38
Traffic policing configuration example··············································································································38
Network requirements······························································································································38
Configuration procedure···························································································································39
Configuring congestion management ··························································41
Overview··························································································································································41
SP queuing···············································································································································41
WRR queuing···········································································································································42
WFQ queuing···········································································································································43
SP+WRR queuing····································································································································43
SP+WFQ queuing····································································································································44
Configuration approaches and task list············································································································44
Configuring per-queue congestion management·····························································································44
Configuring SP queuing···························································································································45
Configuring WRR queuing ·······················································································································45
Configuring WFQ queuing························································································································46
Configuring SP+WRR queuing ················································································································48
Configuring SP+WFQ queuing·················································································································50
Configuring a queue scheduling profile············································································································51
Configuration procedure···························································································································53
Queue scheduling profile configuration example for LSQ1QGS4SC0 (JC792A) and LSQM2TGS16SF0
(JH214A, JH222A) interface modules······································································································53
Queue scheduling profile configuration example for other interface modules·········································54
Displaying and maintaining queue statistics ····································································································55
Displaying and maintaining congestion management······················································································55
Configuring congestion avoidance·······························································57
Overview··························································································································································57
Tail drop···················································································································································57
RED and WRED·······································································································································57
ECN··························································································································································57
Configuration restrictions and guidelines·········································································································58
Configuring and applying a queue-based WRED table ···················································································58
Displaying and maintaining WRED··················································································································59
WRED configuration example··························································································································60
Network requirements······························································································································60
Configuration procedure···························································································································60
Configuring traffic filtering············································································62
Configuration procedure···································································································································62
Traffic filtering configuration example ··············································································································62
Network requirements······························································································································62
Configuration procedure···························································································································63

iii
Configuring priority marking·········································································64
Color-based priority marking····························································································································64
Packet coloring methods··························································································································64
Configuring color-based priority marking ·································································································64
Configuration procedure···································································································································65
Priority marking configuration example············································································································67
Network requirements······························································································································67
Configuration procedure···························································································································67
Configuring nesting······················································································70
Configuration procedure···································································································································70
Nesting configuration example·························································································································70
Network requirements······························································································································70
Configuration procedure···························································································································71
Configuring traffic redirecting·······································································73
Configuration procedure···································································································································73
Traffic redirecting configuration example·········································································································74
Network requirements······························································································································74
Configuration procedure···························································································································74
Configuring global CAR···············································································76
Overview··························································································································································76
Aggregate CAR········································································································································76
Hierarchical CAR······································································································································76
Configuring aggregate CAR·····························································································································77
Configuring hierarchical CAR···························································································································77
Displaying and maintaining global CAR···········································································································78
Aggregate CAR configuration example············································································································78
Network requirements······························································································································78
Configuration procedure···························································································································79
Configuring class-based accounting····························································81
Configuration procedure···································································································································81
Class-based accounting configuration example ······························································································82
Network requirements······························································································································82
Configuration procedure···························································································································82
Appendixes··································································································84
Appendix A Acronym········································································································································84
Appendix B Default priority maps·····················································································································84
Appendix C Introduction to packet precedence ·······························································································85
IP precedence and DSCP values·············································································································85
802.1p priority ··········································································································································87
EXP values···············································································································································87
Configuring time ranges···············································································89
Configuration procedure···································································································································89
Displaying and maintaining time ranges ··········································································································89
Time range configuration example···················································································································89
Document conventions and icons································································91
Conventions·····················································································································································91
Network topology icons····································································································································92
Support and other resources ·······································································93
Accessing Hewlett Packard Enterprise Support·······························································································93
Accessing updates···········································································································································93
Websites ··················································································································································94
Customer self repair·································································································································94
Remote support········································································································································94

iv
Documentation feedback ·························································································································94
Index············································································································96

1
Configuring ACLs
Overview
An access control list (ACL) is a set of rules for identifying traffic based on criteria such as source IP
address, destination IP address, and port number. The rules are also called permit or deny
statements.
ACLs are primarily used for packet filtering. "Configuring packet filtering with ACLs" provides an
example. You can use ACLs in QoS, security, routing, and other modules for identifying traffic. The
packet drop or forwarding decisions depend on the modules that use ACLs.
ACL types
Type
ACL number
IP version
Match criteria
Basic ACLs 2000 to 2999 IPv4 Source IPv4 address.
IPv6 Source IPv6 address.
Advanced ACLs 3000 to 3999
IPv4 Source IPv4 address, destination IPv4
address, packet priority, protocol number, and
other Layer 3 and Layer 4 header fields.
IPv6 Source IPv6 address, destination IPv6 address, packet priority, protocol number, and
other Layer 3 and Layer 4 header fields.
Layer 2 ACLs 4000 to 4999 IPv4 and IPv6 Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority,
and link layer protocol type.
User-defined ACLs 5000 to 5999 IPv4 and IPv6 User specified matching patterns in protocol
headers.
Numbering and naming ACLs
When creating an ACL, you must assign it a number or name for identification. You can specify an
existing ACL by its number or name. Each ACL type has a unique range of ACL numbers.
For an IPv4 basic or advanced ACL, its ACL number or name must be unique in IPv4. For an IPv6
basic or advanced ACL, its ACL number and name must be unique in IPv6. For a Layer 2 or
user-defined ACL, its number or name must be globally unique.
Match order
The rules in an ACL are sorted in a specific order. When a packet matches a rule, the device stops
the match process and performs the action defined in the rule. If an ACL contains overlapping or
conflicting rules, the matching result and action to take depend on the rule order.
The following ACL match orders are available:
•
config—Sorts ACL rules in ascending order of rule ID. Arule with a lower ID is matched before
a rule with a higher ID. If you use this method, check the rules and their order carefully.

2
NOTE:
The match order of user-defined ACLs can only be config.
•
auto—Sorts ACL rules in depth-first order. Depth-first ordering makes sure any subset of a rule
is always matched before the rule. Table 1lists the sequence of tie breakers that depth-first
ordering uses to sort rules for each type of ACL.
Table 1 Sort ACL rules in depth-first order
ACL type
Sequence of tie breakers
IPv4 basic ACL
1. VPN instance.
2. More 0s in the source IPv4 address wildcard (more 0s means a
narrower IPv4 address range).
3. Rule configured earlier.
IPv4 advanced ACL
4. VPN instance.
5. Specific protocol number.
6. More 0s in the source IPv4 address wildcard mask.
7. More 0s in the destination IPv4 address wildcard.
8. Narrower TCP/UDP service port number range.
9.
Rule configured earlier.
IPv6 basic ACL
10. VPN instance.
11. Longer prefix for the source IPv6 address (a longer prefix means a
narrower IPv6 address range).
12. Rule configured earlier.
IPv6 advanced ACL
13. VPN instance.
14. Specific protocol number.
15. Longer prefix for the source IPv6 address.
16. Longer prefix for the destination IPv6 address.
17. Narrower TCP/UDP service port number range.
18. Rule configured earlier.
Layer 2 ACL
19. More 1s in the source MACaddress mask (more 1s means a smaller
MAC address).
20. More 1s in the destination MAC address mask.
21. Rule configured earlier.
A wildcard mask, also called an inverse mask, is a 32-bit binary number represented in dotted
decimal notation. In contrast to a network mask, the 0 bits in a wildcard mask represent "do care" bits,
and the 1 bits represent "don't care" bits. If the "do care" bits in an IP address are identical to the "do
care" bits in an IP address criterion, the IP address matches the criterion. All "don't care" bits are
ignored. The 0s and 1s in a wildcard mask can be noncontiguous. For example, 0.255.0.255 is a
valid wildcard mask.
Rule numbering
ACL rules can be manually numbered or automatically numbered. This section describes how
automatic ACL rule numbering works.
Rule numbering step
If you do not assign an ID to the rule you are creating, the system automatically assigns it a rule ID.
The rule numbering step sets the increment by which the system automatically numbers rules. For
example, the default ACLrule numbering step is 5. If you do not assign IDs to rules you are creating,
they are automatically numbered 0, 5, 10, 15, and so on. The wider the numbering step, the more
rules you can insert between two rules.

3
By introducing a gap between rules rather than contiguously numbering rules, you have the flexibility
of inserting rules in an ACL. This feature is important for a config-order ACL, where ACL rules are
matched in ascending order of rule ID.
Automatic rule numbering and renumbering
The ID automatically assigned to an ACLrule takes the nearest higher multiple of the numbering step
to the current highest rule ID, starting with 0.
For example, if the step is 5, and there are five rules numbered 0, 5, 9, 10, and 12, the newly defined
rule is numbered 15. If the ACL does not contain a rule, the first rule is numbered 0.
Whenever the step changes, the rules are renumbered, starting from 0. For example, changing the
step from 5 to 2 renumbers rules 5, 10, 13, and 15 as rules 0, 2, 4, and 6.
Fragment filtering with ACLs
Traditional packet filtering matches only first fragments of packets, and allows all subsequent
non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid risks, the ACL feature is designed as follows:
•
Filters all fragments by default, including non-first fragments.
•
Allows for matching criteria modification for efficiency. For example, you can configure the ACL
to filter only non-first fragments.
Configuration task list
Tasks at a glance
(Required.) Configure ACLs according to the characteristics of the packets to be matched:
•Configuring a basic ACL
Configuring an IPv4 basic ACL
Configuring an IPv6 basic ACL
•Configuring an advanced ACL
Configuring an IPv4 advanced ACL
Configuring an IPv6 advancedACL
•Configuring a Layer 2 ACL
•Configuring a user-defined ACL
(Optional.) Copying an ACL
(Optional.) Configuring packet filtering with ACLs
Configuring a basic ACL
This section describes procedures for configuring IPv4 and IPv6 basic ACLs.
Configuring an IPv4 basic ACL
IPv4 basic ACLs match packets based only on source IP addresses.
To configure an IPv4 basic ACL:
Step
Command
Remarks
1. Enter system view.
system-view
N/A

4
Step
Command
Remarks
2. Create an IPv4 basic ACL
and enter its view.
acl basic { acl-number | name
acl-name } [ match-order { auto |
config } ]
acl number acl-number
[ match-order { auto | config } ]
By default, no ACLs exist.
The value range for a numbered
IPv4 basic ACL is 2000 to 2999.
Use the acl number acl-number
or acl basic acl-number
command to create a numbered
IPv4 basic ACL.
Use the acl number acl-number
or acl basic acl-number
command to enter the view of a
numbered IPv4 basic ACL.
Use the acl basic name acl-name
command to enter the view of a
named IPv4 basic ACL.
3. (Optional.) Configure a
description for the IPv4 basic
ACL. description text By default, an IPv4 basic ACL
does not have a description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ counting | fragment |logging |
source { source-address
source-wildcard | any } |
time-range time-range-name |
vpn-instance
vpn-instance-name ] *
By default, no IPv4 basic ACL
rules exist.
The logging keyword takes effect
only when the module (for
example, packet filtering) that
uses the ACL supports logging.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comment is
configured.
Configuring an IPv6 basic ACL
IPv6 basic ACLs match packets based only on source IP addresses.
To configure an IPv6 basic ACL:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Create an IPv6 basic ACL
view and enter its view.
acl ipv6 basic { acl-number |
name acl-name } [ match-order
{ auto | config } ]
acl ipv6 number acl-number
[ match-order { auto | config } ]
By default, no ACLs exist.
The value range for a numbered
IPv6 basic ACL is 2000 to 2999.
Use the acl ipv6 number
acl-number or acl ipv6 basic
acl-number command to create a
numbered IPv6 basic ACL.
Use the acl ipv6 number
acl-number or acl ipv6 basic
acl-number command to enter the
view of a numbered IPv6 basic
ACL.
Use the acl ipv6 basic name
acl-name command to enter the
view of a named IPv6 basic ACL.

5
Step
Command
Remarks
3. (Optional.) Configure a
description for the IPv6 basic
ACL. description text By default, an IPv6 basic ACL
does not have a description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ counting | logging | routing |
source { source-address
source-prefix |
source-address/source-prefix |
any } | time-range
time-range-name | vpn-instance
vpn-instance-name ] *
By default, no IPv6 basic ACL
rules exist.
The logging keyword takes effect
only when the module (for
example, packet filtering) that
uses the ACL supports logging.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comment is
configured.
Configuring an advanced ACL
This section describes procedures for configuring IPv4 and IPv6 advanced ACLs.
Configuring an IPv4 advanced ACL
IPv4 advanced ACLs match packets based on the following criteria:
•
Source IP addresses.
•
Destination IP addresses.
•
Packet priorities.
•
Protocol numbers.
•
Other protocol header information, such as TCP/UDP source and destination port numbers,
TCP flags, ICMP message types, and ICMP message codes.
Compared to IPv4 basic ACLs, IPv4 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv4 advanced ACL:
Step
Command
Remarks
1. Enter system view. system-view N/A

6
Step
Command
Remarks
2. Create an IPv4 advanced
ACL and enter its view.
acl advanced { acl-number |
name acl-name } [ match-order
{ auto | config } ]
acl number acl-number
[ match-order { auto | config } ]
By default, no ACLs exist.
The value range for a numbered
IPv4 advanced ACL is 3000 to
3999.
Use the acl number acl-number
or acl advanced acl-number
command to create a numbered
IPv4 advanced ACL.
Use the acl number acl-number
or acl advanced acl-number
command to enter the view of a
numbered IPv4 advanced ACL.
Use the acl advanced name
acl-name command to enter the
view of a named IPv4 advanced
ACL.
3. (Optional.) Configure a
description for the IPv4
advanced ACL. description text By default, an IPv4 advanced ACL
does not have a description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination
{ dest-address dest-wildcard |
any } | destination-port operator
port1 [ port2 ] | { dscp dscp |
{ precedence precedence | tos
tos } * } | fragment | icmp-type
{ icmp-type [ icmp-code ] |
icmp-message } | logging |
qos-local-id local-id-value |
source { source-address
source-wildcard | any } |
source-port operator port1
[ port2 ] | time-range
time-range-name | vpn-instance
vpn-instance-name ] *
By default, no IPv4 advancedACL
rules exist.
The logging keyword takes effect
only when the module (for
example, packet filtering) that
uses the ACL supports logging.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comment is
configured.
Configuring an IPv6 advanced ACL
IPv6 advanced ACLs match packets based on the following criteria:
•
Source IPv6 addresses.
•
Destination IPv6 addresses.
•
Packet priorities.
•
Protocol numbers.
•
Other protocol header fields such as the TCP/UDP source port number, TCP/UDP destination
port number, ICMPv6 message type, and ICMPv6 message code.

7
Compared to IPv6 basic ACLs, IPv6 advanced ACLs allow more flexible and accurate filtering.
To configure an IPv6 advanced ACL:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Create an IPv6 advanced
ACL and enter its view.
acl ipv6 advanced { acl-number |
name acl-name } [ match-order
{ auto | config } ]
acl ipv6 number acl-number
[ match-order { auto | config } ]
By default, no ACLs exist.
The value range for a numbered
IPv6 advanced ACL is 3000 to
3999.
Use the acl ipv6 number
acl-number or acl ipv6 advanced
acl-number command to create a
numbered IPv6 advanced ACL.
Use the acl ipv6 number
acl-number or acl ipv6 advanced
acl-number command to enter the
view of a numbered IPv6
advanced ACL.
Use the acl ipv6 advanced name
acl-name command to enter the
view of a named IPv6 advanced
ACL.
3. (Optional.) Configure a
description for the IPv6
advanced ACL. description text By default, an IPv6 advanced ACL
does not have a description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
protocol [ { { ack ack-value | fin
fin-value | psh psh-value | rst
rst-value | syn syn-value | urg
urg-value } * | established } |
counting | destination
{ dest-address dest-prefix |
dest-address/dest-prefix |any } |
destination-port operator port1
[port2 ] | dscp dscp |flow-label
flow-label-value | icmp6-type
{ icmp6-type icmp6-code |
icmp6-message } | logging |
qos-local-id local-id-value |
routing | hop-by-hop [ type
hop-type ] | source
{ source-address source-prefix |
source-address/source-prefix |
any } | source-port operatorport1
[port2 ] | time-range
time-range-name | vpn-instance
vpn-instance-name ] *
By default, no IPv6 advancedACL
rules exist.
The logging keyword takes effect
only when the module (for
example, packet filtering) that
uses the ACL supports logging.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comment is
configured.
Configuring a Layer 2 ACL
Layer 2 ACLs, also called Ethernet frame header ACLs, match packets based on Layer 2 Ethernet
header fields, such as:

8
•
Source MAC address.
•
Destination MAC address.
•
802.1p priority (VLAN priority).
•
Link layer protocol type.
To configure a Layer 2 ACL:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Create a Layer 2 ACL and
enter its view.
acl mac { acl-number | name
acl-name } [ match-order { auto |
config } ]
acl number acl-number
[ match-order { auto | config } ]
By default, no ACLs exist.
The value range for a numbered
Layer 2 ACL is 4000 to 4999.
Use the acl number acl-number
or acl mac acl-number command
to create a numbered Layer 2
ACL.
Use the acl number acl-number
or acl mac acl-number command
to enter the view of a numbered
Layer 2 ACL.
Use the acl mac name acl-name
command to enter the view of a
named Layer 2 ACL.
3. (Optional.) Configure a
description for the Layer 2
ACL. description text By default, a Layer 2 ACL does
not have a description.
4. (Optional.) Set the rule
numbering step. step step-value The default setting is 5.
5. Create or edit a rule.
rule [ rule-id ] { deny | permit }
[ cos dot1p | counting | dest-mac
dest-address dest-mask | { lsap
lsap-type lsap-type-mask | type
protocol-type
protocol-type-mask } |
source-mac source-address
source-mask | time-range
time-range-name ] *
By default,no Layer 2 ACL rules
exist.
6. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comment is
configured.
Configuring a user-defined ACL
User-defined ACLs allow you to customize rules based on information in protocol headers. You can
define a user-defined ACL to match packets. Aspecific number of bytes after an offset (relative to the
specified header) are compared against a match pattern after being ANDed with a match pattern
mask.
To configure a user-defined ACL:
Step
Command
Remarks
1. Enter system view. system-view N/A

9
Step
Command
Remarks
2. Create a user-defined ACL
and enter its view.
acl user-defined { acl-number |
name acl-name }
acl number acl-number
[ match-order { auto | config } ]
By default, no ACLs exist.
The value range for a numbered
user-defined ACL is 5000 to 5999.
Use the acl number acl-number
or acl user-defined acl-number
command to create a numbered
user-defined ACL.
Use the acl number acl-number
or acl user-defined acl-number
command to enter the view of a
numbered user-defined ACL.
Use the acl user-defined name
acl-name command to enter the
view of a named user-defined
ACL.
3. (Optional.) Configure a
description for the
user-defined ACL. description text By default, a user-defined ACL
does not have a description.
4. Create or edit a rule. rule [ rule-id ]{ deny | permit }
[ { l2 rule-string rule-mask
offset }&<1-8> ] [ counting |
time-range time-range-name ] *
By default, no user-defined ACL
rules exist.
5. (Optional.) Add or edit a rule
comment. rule rule-id comment text By default, no rule comment is
configured.
Copying an ACL
You can create an ACL by copying an existing ACL (source ACL). The new ACL (destination ACL)
has the same properties and content as the source ACL, but uses a different number or name than
the source ACL.
To successfully copy an ACL, make sure:
•
The destination ACL number is from the same type as the source ACL number.
•
The source ACL already exists, but the destination ACL does not.
To copy an ACL:
Step
Command
1. Enter system view.system-view
2. Copy an existingACL to create a newACL. acl [ ipv6 | mac | user-defined ] copy
{ source-acl-number | name source-acl-name } to
{ dest-acl-number | name dest-acl-name }
Configuring packet filtering with ACLs
This section describes procedures for using an ACL to filter packets. For example, you can apply an
ACL to an interface to filter incoming or outgoing packets.

10
Applying an ACL to an interface for packet filtering
Step
Command
Remarks
1. Enter system view.system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Apply an ACLto the interface
to filter packets.
packet-filter [ ipv6 | mac |
user-defined ] { acl-number |
name acl-name } { inbound |
outbound } [ hardware-count ]
By default, an interface does not
filter packets.
Configuring the applicable scope of packet filtering on a
VLAN interface
You can configure the packet filtering on a VLAN interface to filter the following packets:
•
Packets forwarded at Layer 3 by the VLAN interface.
•
All packets, including packets forwarded at Layer 3 by the VLAN interface and packets
forwarded at Layer 2 by the physical ports associated with the VLAN interface.
To configure the applicable scope of packet filtering on a VLAN interface:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Create a VLAN interface
and enter its view. interface vlan-interface
vlan-interface-id
If the VLAN interface already exists,
you directly enter its view.
By default, no VLAN interface exists.
3. Specify the applicable
scope of packet filtering on
the VLAN interface. packet-filter filter [ route | all ] By default, the packet filtering filters
all packets.
Configuring logging and SNMP notifications for packet
filtering
You can configure the ACL module to generate log entries or SNMP notifications for packet filtering
and output them to the information center or SNMP module at the output interval. The log entry or
notification records the number of matching packets and the matched ACL rules. If an ACL is
matched for the first time, the device immediately outputs a log entry or notification to record the
matching packet.
For more information about the information center and SNMP, see Network Management and
Monitoring Configuration Guide.
To configure logging and SNMP notifications for packet filtering:
Step
Command
Remarks
1. Enter system view.system-view N/A

11
Step
Command
Remarks
2. Set the interval for outputting
packet filtering logs or
notifications. acl { logging | trap } interval
interval
The default setting is 0 minutes.
By default, the device does not
generate log entries or SNMP
notifications for packet filtering.
Setting the packet filtering default action
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Set the packet filtering
default action to deny. packet-filter default deny By default, the packet filter
permits packets that do not match
any ACL rule to pass.
Displaying and maintaining ACLs
Execute display commands in any view and reset commands in user view.
Task
Command
Display ACL configuration and match
statistics. display acl [ ipv6 | mac | user-defined ] { acl-number | all |
name acl-name }
Display ACL application information for
packet filtering (in standalone mode).
display packet-filter { interface [ interface-type
interface-number ] [ inbound | outbound ] | interface
vlan-interface vlan-interface-number [ inbound | outbound ]
[ slot slot-number ] }
Display ACL application information for
packet filtering (in IRF mode).
display packet-filter { interface [ interface-type
interface-number ] [ inbound | outbound ] | interface
vlan-interface vlan-interface-number [ inbound | outbound ]
[ chassis chassis-number slot slot-number ] }
Display match statistics and default action
statistics for packet filtering ACLs.
display packet-filter statistics interface interface-type
interface-number { inbound | outbound } [ [ ipv6 | mac |
user-defined ] { acl-number | name acl-name } ] [ brief ]
Display the accumulated statistics for
packet filtering ACLs.
display packet-filter statistics sum { inbound | outbound }
[ ipv6 | mac | user-defined ] { acl-number | name acl-name }
[ brief ]
Display detailed ACL packet filtering
information (in standalone mode).
display packet-filter verbose interface interface-type
interface-number { inbound | outbound } [ [ ipv6 | mac |
user-defined ] { acl-number | name acl-name } ] [ slot
slot-number ]
Display detailed ACL packet filtering
information (in IRF mode).
display packet-filter verbose interface interface-type
interface-number { inbound | outbound } [ [ ipv6 | mac |
user-defined ] { acl-number | name acl-name } ] [ chassis
chassis-number slot slot-number ]
Display QoS and ACL resource usage (in
standalone mode). display qos-acl resource [ slot slot-number ]
Display QoS and ACL resource usage (in
IRF mode). display qos-acl resource [ chassis chassis-number slot
slot-number ]
Clear ACL statistics. reset acl [ ipv6 | mac | user-defined ] counter { acl-number |
all | name acl-name }

12
Task
Command
Clear match statistics, accumulated match
statistics, and default action statistics for
packet filtering ACLs.
reset packet-filter statistics interface [ interface-type
interface-number ] { inbound | outbound } [ [ ipv6 | mac |
user-defined ] { acl-number | name acl-name } ]
ACL configuration examples
Interface-based packet filtering configuration example
Network requirements
A company interconnects its departments through the device. Configure packet filtering to:
•
Permit access from the President's office at any time to the financial database server.
•
Permit access from the Finance department to the financial database server only during
working hours (from 8:00 to 18:00) on working days.
•
Deny access from any other department to the financial database server.
Figure 1 Network diagram
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<Device> system-view
[Device] time-range work 08:0 to 18:00 working-day
# Create an IPv4 advanced ACL numbered 3000.
[Device] acl advanced 3000
# Configure a rule to permit access from the President's office to the financial database server.
[Device-acl-ipv4-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination
192.168.0.100 0
# Configure a rule to permit access from the Finance department to the financial database server
during working hours.
[Device-acl-ipv4-adv-3000] rule permit ip source 192.168.2.0 0.0.0.255 destination
192.168.0.100 0 time-range work
President's office
192.168.1.0/24 Financial department 192.168.2.0/24 Marketing department 192.168.3.0/24
Device
GE1/0/1
GE1/0/4GE1/0/2
GE1/0/3
Financial database server
192.168.0.100/24

13
# Configure a rule to deny access to the financial database server.
[Device-acl-ipv4-adv-3000] rule deny ip source any destination 192.168.0.100 0
[Device-acl-ipv4-adv-3000] quit
# Apply IPv4 advanced ACL 3000 to filter outgoing packets on interface GigabitEthernet 1/0/1.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] packet-filter 3000 outbound
[Device-GigabitEthernet1/0/1] quit
Verifying the configuration
# Verify that a PC in the Finance department can ping the financial database server during working
hours. (All PCs in this example use Windows XP).
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Reply from 192.168.0.100: bytes=32 time=1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Reply from 192.168.0.100: bytes=32 time<1ms TTL=255
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
# Verify that a PC in the Marketing department cannot ping the financial database server during
working hours.
C:\> ping 192.168.0.100
Pinging 192.168.0.100 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.100:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
# Display configuration and match statistics for IPv4 advanced ACL 3000 on the device during
working hours.
[Device] display acl 3000
Advanced IPv4 ACL 3000, 3 rules,
ACL's step is 5
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.0.100 0
rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.100 0 time-range work
(Active)
rule 10 deny ip destination 192.168.0.100 0
The output shows that rule 5 is active.

14
QoS overview
In data communications, Quality of Service (QoS) provides differentiated service guarantees for
diversified traffic in terms of bandwidth, delay, jitter, and drop rate, all of which can affect QoS.
QoS manages network resources and prioritizes traffic to balance system resources.
The following section describes typical QoS service models and widely used QoS techniques.
QoS service models
This section describes several typical QoS service models.
Best-effort service model
The best-effort model is a single-service model. The best-effort model is not as reliable as other
models and does not guarantee delay-free delivery.
The best-effort service model is the default model for the Internet and applies to most network
applications. It uses the First In First Out (FIFO) queuing mechanism.
IntServ model
The integrated service (IntServ) model is a multiple-service model that can accommodate diverse
QoS requirements. This service model provides the most granularly differentiated QoS by identifying
and guaranteeing definite QoS for each data flow.
In the IntServ model, an application must request service from the network before it sends data.
IntServ signals the service request with the RSVP. All nodes receiving the request reserve resources
as requested and maintain state information for the application flow. For more information about
RSVP, see MPLS Configuration Guide.
The IntServ model demands high storage and processing capabilities because it requires all nodes
along the transmission path to maintain resource state information for each flow. This model is
suitable for small-sized or edge networks. However, it is not suitable for large-sized networks, for
example, the core layer of the Internet, where billions of flows are present.
DiffServ model
The differentiated service (DiffServ) model is a multiple-service model that can meet diverse QoS
requirements. It is easy to implement and extend. DiffServ does not signal the network to reserve
resources before sending data, as IntServ does.
QoS techniques overview
The QoS techniques include the following features:
•
Traffic classification.
•
Traffic policing.
•
Traffic shaping.
•
Rate limit.
•
Congestion management.