Aruba JG632A HPE DataCenter Switch User Guide
Werbung
Werbung
HPE FlexFabric
12900E & 12900 & 7900 Switch Series
ACL and QoS Command Reference
HPE FlexFabric 12900E Switch Series
HPE FlexFabric 12900 Switch Series
HPE FlexFabric 7900 Switch Series
Part number: 5200-4924d
Software version: Release 2710 and later
Document version: 6W103-20200408
© Copyright 2020 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.
Contents
ACL commands ··············································································· 1
QoS policy commands ···································································· 56
i
Priority mapping commands ··························································· 101
GTS and rate limit commands ························································· 107
Congestion management commands ··············································· 112
ii
Congestion avoidance commands ··················································· 128
Aggregate CAR commands ···························································· 134
Queue-based accounting commands ··············································· 138
QPPB commands ········································································· 143
Time range commands ·································································· 145
Data buffer commands ·································································· 148
Document conventions and icons ···················································· 153
Support and other resources ·························································· 155
Index ························································································· 158
iii
ACL commands
acl
Use acl to create an ACL and enter its view, or enter the view of an existing ACL.
Use undo acl to delete the specified or all ACLs.
Syntax
Command set 1: acl [ ipv6 ] { name acl-name | number acl-number [ name acl-name ]
[ match-order { auto | config } ] } undo acl [ ipv6 ] { all | name acl-name | number acl-number }
Command set 2: acl [ ipv6 ] { advanced | basic } { acl-number | name acl-name } [ match-order
{ auto | config } ] acl mac { acl-number | name acl-name } [ match-order { auto | config } ] acl user-defined { acl-number | name acl-name } undo acl [ ipv6 ] { all | { advanced | basic } { acl-number | name acl-name } } undo acl mac { all | acl-number | name acl-name } undo acl user-defined { all | acl-number | name acl-name }
Default
No ACLs exist.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters ipv6 : Specifies the IPv6 ACL type. To specify the IPv4 ACL type, do not use this keyword. basic : Specifies the basic ACL type. advanced : Specifies the advanced ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Assigns a number to the ACL. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs.
1
name acl-name : Assigns a name to the ACL. The acl-name argument is a case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid confusion, it cannot be all . match-order : Specifies the order in which ACL rules are compared against packets.
• auto : Compares ACL rules in depth-first order.
• config : Compares ACL rules in ascending order of rule ID. The rule with a smaller ID has a higher priority. If you do not specify a match order, the config order applies by default. The match order for the user-defined ACL can only be config . all : Specifies all ACLs of the specified type.
Usage guidelines
If you create a numbered ACL, you can enter the view of the ACL by using the following commands:
• acl [ ipv6 ] number acl-number .
• acl { [ ipv6 ] { advanced | basic } | mac | user-defined } acl-number .
If you create a ACL by using the acl [ ipv6 ] number acl-number name acl-name command, you can enter the view of the ACL by using the following commands:
• acl [ ipv6 ] name acl-name (for basic ACLs and advanced ACLs only).
• acl [ ipv6 ] number acl-number [ name acl-name ] .
• acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name .
If you create a named ACL by using the acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name command, you can enter the view of the ACL by using the following commands:
• acl [ ipv6 ] name acl-name (for basic ACLs and advanced ACLs only).
• acl { [ ipv6 ] { advanced | basic } | mac | user-defined } name acl-name .
You can change the match order only for ACLs that do not contain any rules.
Matching packets are forwarded through slow forwarding if an ACL rule contains match criteria or has functions enabled in addition to the following match criteria and functions:
•
Source and destination IP addresses.
•
Source and destination ports.
•
Transport layer protocol.
•
ICMP or ICMPv6 message type, message code, and message name.
•
VPN instance.
•
Logging.
•
Time range.
Slow forwarding requires packets to be sent to the control plane for forwarding entry calculation, which affects the device forwarding performance.
Examples
# Create IPv4 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000]
# Create IPv4 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl basic name flow
2
[Sysname-acl-ipv4-basic-flow]
# Create IPv4 advanced ACL 3000 and enter its view.
<Sysname> system-view
[Sysname] acl advanced 3000
[Sysname-acl-ipv4-adv-3000]
# Create IPv6 basic ACL 2000 and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic 2000
[Sysname-acl-ipv6-basic-2000]
# Create IPv6 basic ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 basic name flow
[Sysname-acl-ipv6-basic-flow]
# Create IPv6 advanced ACL abc and enter its view.
<Sysname> system-view
[Sysname] acl ipv6 advanced name abc
[Sysname-acl-ipv6-adv-abc]
# Create Layer 2 ACL 4000 and enter its view.
<Sysname> system-view
[Sysname] acl mac 4000
[Sysname-acl-mac-4000]
# Create Layer 2 ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl mac name flow
[Sysname-acl-mac-flow]
# Create user-defined ACL 5000 and enter its view.
<Sysname> system-view
[Sysname] acl user-defined 5000
[Sysname-acl-user-5000]
# Create user-defined ACL flow and enter its view.
<Sysname> system-view
[Sysname] acl user-defined name flow
[Sysname-acl-user-flow]
Related commands display acl
acl copy
Use acl copy to create an ACL by copying an ACL that already exists.
Syntax acl [ ipv6 | mac | user-defined ] copy { source-acl-number | name source-acl-name } to { dest-acl-number | name dest-acl-name }
Views
System view
3
Predefined user roles network-admin mdc-admin
Parameters ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. source-acl-number : Specifies an existing source ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs.
name source-acl-name : Specifies an existing source ACL by its name. The source-acl-name argument is a case-insensitive string of 1 to 63 characters. dest-acl-number : Assigns a unique number to the new ACL. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs.
name dest-acl-name : Assigns a unique name to the new ACL. The dest-acl-name argument is a case-insensitive string of 1 to 63 characters. It must start with an English letter and to avoid confusion, it cannot be all .
Usage guidelines
The new ACL and the source ACL must be the same type.
The new ACL has the same properties and content as the source ACL, but uses a different number or name from the source ACL.
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
Examples
# Create IPv4 basic ACL 2002 by copying IPv4 basic ACL 2001.
<Sysname> system-view
[Sysname] acl copy 2001 to 2002
# Create IPv4 basic ACL paste by copying IPv4 basic ACL test .
<Sysname> system-view
[Sysname] acl copy name test to name paste
acl-outbound-enhance enable
Use acl-outbound-enhance enable to enable outbound packet matching for rules with the established keyword.
Use undo acl-outbound-enhance enable to restore the default.
4
Syntax acl-outbound-enhance enable undo acl-outbound-enhance enable
Default
Outbound packet matching for rules with the established keyword is disabled.
Views
System view
Predefined user roles network-admin mdc-admin
Usage guidelines
Rules with the established keyword matches TCP packets with the ACK or RST flag bit set. If such rules are configured for outbound packet filtering, you must execute this command before configuring the packet-filter command.
This command is applicable only to IPv4 networks.
Examples
# Enable outbound packet matching for rules with the established keyword.
<Sysname> system-view
[Sysname] acl-outbound-enhance enable
Related commands acl packet-filter rule (IPv4 advanced ACL view)
acl logging interval
Use acl logging interval to enable logging for packet filtering and set the interval.
Use undo acl logging interval to restore the default.
Syntax acl logging interval interval undo acl logging interval
Default
The interval is 0. The device does not generate log entries for packet filtering.
Views
System view
Predefined user roles network-admin mdc-admin
5
Parameters interval : Specifies the interval at which log entries are generated and output. It must be a multiple of 5, in the range of 0 to 1440 minutes. To disable the logging, set the value to 0.
Usage guidelines
The logging feature is available for IPv4 or IPv6 ACL rules that have the logging keyword.
You can configure the ACL module to generate log entries for packet filtering and output them to the information center at the output interval. The log entry records the number of matching packets and the matched ACL rules. When the first packet of a flow matches an ACL rule, the output interval starts, and the device immediately outputs a log entry for this packet. When the output interval ends, the device outputs a log entry for subsequent matching packets of the flow. For more information about the information center, see Network Management and Monitoring Configuration Guide .
Examples
# Configure the device to generate and output packet filtering log entries every 10 minutes.
<Sysname> system-view
[Sysname] acl logging interval 10
Related commands rule (IPv4 advanced ACL view) rule (IPv4 basic ACL view) rule (IPv6 advanced ACL view) rule (IPv6 basic ACL view)
acl resource log interval
Use acl resource log interval to set the interval for checking the ternary content addressable memory (TCAM) usage.
Use undo acl resource log interval to restore the default.
Syntax acl resource log interval interval undo acl resource log interval
Default
The device checks the TCAM usage every 5 minutes.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters interval interval : Specifies the check interval in the range of 1 to 60 minutes.
Usage guidelines
This command is supported only for H-series cards.
The device checks the TCAM usage regularly. If the usage reaches or exceeds the threshold, the device sends a log message and a trap.
6
Examples
# Set the TCAM usage check interval to 10 minutes.
<Sysname> system-view
[Sysname] acl resource log interval 10
Related commands acl resource threshold percent
acl resource threshold percent
Use acl resource threshold percent to set the TCAM usage alarm threshold.
Use undo acl resource threshold percent to restore the default.
Syntax acl resource threshold percent percent undo acl resource threshold percent
Default
The TCAM usage alarm threshold is 0. TCAM usage alarm is disabled.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters percent : Specifies the threshold in percentage in the range of 1 to 100.
Usage guidelines
This command is supported only for H-series cards.
The device checks the TCAM usage regularly. If the usage reaches or exceeds the threshold, the device sends a log message and a trap. If you change the threshold, the device restarts the TCAM usage check from the time the threshold is changed.
Examples
# Set the TCAM usage alarm threshold to 50%.
<Sysname> system-view
[Sysname] acl resource threshold percent 50
Related commands acl resource log interval
acl trap interval
Use acl trap interval to enable SNMP notifications for packet filtering and set the interval.
Use undo acl interval to restore the default.
Syntax acl trap interval interval
7
undo acl trap interval
Default
The interval is 0. The device does not generate SNMP notifications for packet filtering.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters interval : Specifies the interval at which SNMP notifications are generated and output. It must be a multiple of 5, in the range of 0 to 1440 minutes. To disable SNMP notifications, set the value to 0.
Usage guidelines
The SNMP notifications feature is available for IPv4 or IPv6 ACL rules that have the logging keyword.
You can configure the ACL module to generate SNMP notifications for packet filtering and output them to the SNMP module at the output interval. The notification records the number of matching packets and the matched ACL rules. When the first packet of a flow matches an ACL rule, the output interval starts, and the device immediately outputs a notification for this packet. When the output interval ends, the device outputs a notification for subsequent matching packets of the flow. For more information about SNMP, see Network Management and Monitoring Configuration Guide .
Examples
# Configure the device to generate and output packet filtering SNMP notifications every 10 minutes.
<Sysname> system-view
[Sysname] acl trap interval 10
Related commands rule (IPv4 advanced ACL view) rule (IPv4 basic ACL view) rule (IPv6 advanced ACL view) rule (IPv6 basic ACL view)
description
Use description to configure a description for an ACL.
Use undo description to delete an ACL description.
Syntax description text undo description
Default
An ACL does not have a description.
Views
IPv4 basic/advanced ACL view
IPv6 basic/advanced ACL view
8
Layer 2 ACL view
User-defined ACL view
Predefined user roles network-admin mdc-admin
Parameters text : Specifies a description, a case-sensitive string of 1 to 127 characters.
Examples
# Configure a description for IPv4 basic ACL 2000.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] description This is an IPv4 basic ACL.
Related commands display acl
display acl
Use display acl to display ACL configuration and match statistics.
Syntax display acl [ ipv6 | mac | user-defined ] { acl-number | all | name acl-name }
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs. all : Specifies all ACLs of the specified type.
name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
9
Usage guidelines
This command displays ACL rules in config or auto order, whichever is configured.
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
Examples
# Display configuration and match statistics for IPv4 basic ACL 2001.
<Sysname> display acl 2001
Basic IPv4 ACL 2001, 1 rule, match-order is auto,
This is an IPv4 basic ACL.
ACL's step is 5, start ID is 0
rule 5 permit source 1.1.1.1 0
rule 5 comment This rule is used on FortyGigE1/0/1.
# Display configuration and match statistics for IPv4 advanced ACL acl1_L3_IN .
<Sysname> display acl name acl1_L3_IN
Advanced IPv4 ACL named acl1_L3_IN, 1 rule
ACL's step is 5, start ID is 0
rule 0 permit tcp (Stateful)
# Display configuration and match statistics for IPv4 advanced ACL acl1_L3_OUT .
<Sysname> display acl name acl1_L3_OUT
Advanced IPv4 ACL named acl1_L3_OUT, 1 rule
ACL's step is 5, start ID is 0
rule 0 permit tcp source 2.2.2.2 0 destination 1.1.1.1 0 source-port eq 1000 destination-port eq 2000 (Dynamic)
Table 1 Command output
Field Description
Basic IPv4 ACL 2001
Type and number of the ACL. The following field information is about IPv4 basic ACL 2001.
1 rule match-order is auto
This is an IPv4 basic ACL.
ACL's step is 5 start ID is 0 rule 5 permit source 1.1.1.1 0
The ACL contains one rule.
The match order for the ACL is auto , which sorts ACL rules in depth-first order. This field is not displayed when the match order is config .
Description of the ACL.
The rule numbering step is 5.
The start rule ID is 0.
Content of rule 5. The rule permits packets sourced from the IP address
1.1.1.1. rule 5 comment This rule is used on FortyGigE1/0/1.
Comment of rule 5.
10
Field Description
Stateful
A stateful rule is deployed by the controller.
After a controller deploys a stateful ACL to an interface, the switch applies the stateful ACL to filter packets on the interface. When the first packet of a flow matches a rule in the stateful ACL, the switch creates a dynamic ACL and installs a rule into the dynamic ACL as follows:
•
Uses the same source and destination IP addresses as the first matching packet, except that the addresses are swapped.
•
Uses the same source and destination port numbers as the first matching packet, except that the port numbers are swapped.
The dynamic ACL is applied to the reverse direction of the stateful ACL on the interface. The stateful ACL works with the dynamic ACL to allow two-way communication between network entities.
Dynamic A dynamic rule is added dynamically by an application module.
display packet-filter
Use display packet-filter to display ACL application information for packet filtering.
Syntax
In standalone mode: display packet-filter { global | interface [ interface-type interface-number ] | vlan-interface } [ inbound | outbound ] [ slot slot-number ]
In IRF mode: display packet-filter { global | interface [ interface-type interface-number ] | vlan-interface } [ inbound | outbound ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters global : Specifies all physical interfaces. interface [ interface-type interface-number ] : Specifies an interface by its type and number. If you do not specify an interface, this command displays ACL application information for packet filtering on all interfaces. If you specify an Ethernet interface, you do not need to specify the slot slot-number or chassis chassis-number slot slot-number option. vlan-interface : Specifies the list of VLAN interfaces specified in the packet-filter vlan-interface command. inbound : Specifies the inbound direction. outbound : Specifies the outbound direction.
11
slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays ACL application information for packet filtering for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays ACL application information for packet filtering for the global active MPU. (In IRF mode.)
Usage guidelines
If neither the inbound keyword nor the outbound keyword is specified, this command displays
ACL application information for packet filtering in both directions.
Examples
# Display ACL application information for inbound packet filtering on interface FortyGigE 1/0/1.
<Sysname> display packet-filter interface fortygige 1/0/1 inbound
Interface: FortyGigE1/0/1
Inbound policy:
IPv4 ACL 2001 Vxlan-inner, Share-mode
IPv6 ACL 2002 (Failed)
MAC ACL 4003
# Display ACL application information for inbound and outbound packet filtering on all physical interfaces.
<Sysname> display packet-filter global
Global:
Inbound policy:
IPv4 ACL 2001
IPv6 ACL 2001
MAC ACL 4001
IPv4 default action: Deny (Failed)
IPv6 default action: Deny (Failed)
MAC default action: Deny
Outbound policy:
MAC ACL 4001
MAC default action: Deny
# Display ACL application information for inbound and outbound packet filtering on the list of VLAN interfaces.
<Sysname> display packet-filter vlan-interface
VLAN interface : 2 to 5
Inbound policy:
IPv4 ACL 2001
IPv4 default action: Deny (Failed)
VLAN interface : 2 to 5
Outbound policy:
MAC ACL 4001, Hardware-count
MAC default action: Deny
Table 2 Command output
Field Description
Interface Interface to which the ACL applies.
12
Field Description
Global ACL application for packet filtering on all physical interfaces.
VLAN interface
Inbound policy
Outbound policy
IPv4 ACL 2001
IPv6 ACL 2002 (Failed)
Vxlan-inner
Share-mode
Hardware-count
Hardware-count (Failed)
IPv4 default action
IPv6 default action
MAC default action
List of VLAN interfaces specified in the packet-filter vlan-interface command.
ACL used for filtering incoming traffic.
ACL used for filtering outgoing traffic.
IPv4 basic ACL 2001 has been successfully applied.
The device has failed to apply IPv6 basic ACL 2002.
Inner header match criterion for VXLAN packets.
Sharing mode for QoS and ACL resources.
This field appears in the command output only if an ACL is applied with the share-mode keyword.
ACL rule match counting in hardware has been successfully enabled.
The device has failed to enable counting ACL rule matches in hardware.
Packet filter default action for packets that do not match any IPv4
ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
Packet filter default action for packets that do not match any IPv6
ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
Packet filter default action for packets that do not match any Layer
2 ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
display packet-filter statistics
Use display packet-filter statistics to display packet filtering statistics.
13
Syntax display packet-filter statistics { global | interface interface-type interface-number | vlan-interface } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ brief ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters global : Displays the statistics for all physical interfaces. interface interface-type interface-number : Specifies an interface by its type and number. vlan-interface : Specifies the list of VLAN interfaces specified in the packet-filter vlan-interface command. inbound : Specifies the inbound direction. outbound : Specifies the outbound direction. ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs. name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters. brief : Displays brief statistics.
Usage guidelines
If acl-number , name acl-name , ipv6 , mac , or user-defined is not specified, this command displays packet filtering statistics for all ACLs.
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
Examples
# Display packet filtering statistics for all ACLs on incoming packets of FortyGigE 1/0/1.
<Sysname> display packet-filter statistics interface fortygige 1/0/1 inbound
Interface: FortyGigE1/0/1
Inbound policy:
IPv4 ACL 2001, Hardware-count
From 2011-06-04 10:25:21 to 2011-06-04 10:35:57
14
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (No resource)
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
IPv6 ACL 2000
MAC ACL 4000
rule 0 permit
# Display packet filtering statistics for ACL 3000 on incoming packets of the list of VLAN interfaces.
<Sysname> display packet-filter statistics vlan-interface inbound 3000
VLAN interface: 2 to 10
Inbound policy:
IPv4 ACL 3000, Hardware-count (Failed)
From 2011-06-04 10:25:34 to 2011-06-04 10:35:57
rule 0 permit source 2.2.2.2 0
rule 5 permit source 1.1.1.1 0 counting (2 packets)
rule 10 permit vpn-instance test
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
Table 3 Command output
Field Description
Interface Interface to which the ACL applies.
VLAN interface
List of VLAN interfaces specified in the packet-filter vlan-interface command.
Inbound policy
Outbound policy
IPv4 ACL 2001
IPv4 ACL 2002 (Failed)
Hardware-count
Hardware-count (Failed)
ACL used for filtering incoming traffic.
ACL used for filtering outgoing traffic.
IPv4 basic ACL 2001 has been successfully applied.
The device has failed to apply IPv4 basic ACL 2002.
ACL rule match counting in hardware has been successfully enabled.
The device has failed to enable counting ACL rule matches in hardware.
From 2011-06-04 10:25:21 to
2011-06-04 10:35:57
Start time and end time of the statistics.
2 packets
No resource
Two packets matched the rule.
This field is not displayed when no packets matched the rule.
Resources are not enough for counting matches for the rule. In packet filtering statistics, this field is displayed for a rule when resources are not sufficient for rule match counting. rule 5 permit source 1.1.1.1 0
(Failed)
Totally 2 packets permitted, 0 packets denied
The device has failed to apply rule 5.
Number of packets permitted and denied by the ACL.
15
Field Description
Totally 100% permitted, 0% denied
Ratios of permitted and denied packets to all packets.
IPv4 default action
Packet filter default action for packets that do not match any IPv4
ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
IPv6 default action
Packet filter default action for packets that do not match any IPv6
ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
MAC default action
Packet filter default action for packets that do not match any Layer 2
ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
Related commands reset packet-filter statistics
display packet-filter statistics sum
Use display packet-filter statistics sum to display accumulated packet filtering statistics for an ACL.
Syntax display packet-filter statistics sum { inbound | outbound } [ ipv6 | mac | user-defined ] { acl-number | name acl-name } [ brief ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters inbound : Specifies the inbound direction. outbound : Specifies the outbound direction.
16
ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs. name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters. brief : Displays brief statistics.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
Examples
# Display accumulated packet filtering statistics for IPv4 basic ACL 2001 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2001
Sum:
Inbound policy:
IPv4 ACL 2001
rule 0 permit source 2.2.2.2 0 (2 packets)
rule 5 permit source 1.1.1.1 0
rule 10 permit vpn-instance test
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
# Display brief accumulated packet filtering statistics for IPv4 basic ACL 2000 on incoming packets.
<Sysname> display packet-filter statistics sum inbound 2000 brief
Sum:
Inbound policy:
IPv4 ACL 2000
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
Table 4 Command output
Field Description
Sum Accumulated packet filtering statistics.
Inbound policy
Outbound policy
IPv4 ACL 2001
2 packets
Accumulated packet filtering statistics in the inbound direction.
Accumulated packet filtering statistics in the outbound direction.
Accumulated packet filtering statistics of IPv4 basic ACL 2001.
Two packets matched the rule.
This field is not displayed when no packets matched the rule.
Totally 2 packets permitted, 0 packets denied
Totally 100% permitted, 0% denied
Number of packets permitted and denied by the ACL.
Ratios of permitted and denied packets to all packets.
17
Related commands reset packet-filter statistics
display packet-filter verbose
Use display packet-filter verbose to display ACL application details for packet filtering.
Syntax
In standalone mode: display packet-filter verbose { global | interface interface-type interface-number | vlan-interface } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ slot slot-number ]
In IRF mode: display packet-filter verbose { global | interface interface-type interface-number | vlan-interface } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters global : Specifies all physical interfaces.
interface interface-type interface-number : Specifies an interface by its type and number. The chassis chassis-number and slot slot-number options are not available for an Ethernet interface. vlan-interface : Specifies the list of VLAN interfaces specified in the packet-filter vlan-interface command. inbound : Specifies the inbound direction. outbound : Specifies the outbound direction.
ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs.
name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
18
slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays ACL application details for packet filtering for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays ACL application details for packet filtering for the global active MPU. (In IRF mode.)
Usage guidelines
If acl-number , name acl-name , ipv6 , mac , or user-defined is not specified, this command displays application details of all ACLs for packet filtering.
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
Examples
# Display application details of all ACLs for inbound packet filtering on FortyGigE 1/0/1.
<Sysname> display packet-filter verbose interface fortygige 1/0/1 inbound
Interface: FortyGigE1/0/1
Inbound policy:
IPv4 ACL 2001
rule 0 permit
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (Failed)
IPv6 ACL 2000
rule 0 permit
MAC ACL 4000
IPv4 default action: Deny
IPv6 default action: Deny
MAC default action: Deny
# Display application details of all ACLs for inbound packet filtering on all physical interfaces.
<Sysname> display packet-filter verbose global inbound
Global:
Inbound policy:
IPv4 ACL 2001
rule 0 permit
rule 5 permit source 1.1.1.1 0 (Failed)
rule 10 permit vpn-instance test (Failed)
IPv4 ACL 2002 (Failed)
IPv6 ACL 2000, Hardware-count
MAC ACL 4000, Hardware-count
rule 0 permit
19
IPv4 default action: Deny
IPv6 default action: Deny
MAC default action: Deny
# Display application details of the ACL for inbound packet filtering on the list of VLAN interfaces.
<Sysname> display packet-filter verbose vlan-interface inbound
VLAN interface: 2 to 10
Inbound policy:
IPv4 ACL 2001, Hardware-count
rule 0 permit
rule 5 permit source 1.1.1.1 0
rule 10 permit vpn-instance test
Table 5 Command output
Field Description
Interface Interface to which the ACL applies.
VLAN interface
List of VLAN interfaces specified in the packet-filter vlan-interface command.
Global
Inbound policy
Outbound policy
IPv4 ACL 2001
IPv4 ACL 2002 (Failed)
Hardware-count
Hardware-count (Failed) rule 5 permit source 1.1.1.1 0 (Failed)
IPv4 default action
IPv6 default action
ACL application details for packet filtering on all physical interfaces.
ACL used for filtering incoming traffic.
ACL used for filtering outgoing traffic.
IPv4 basic ACL 2001 has been successfully applied.
The device has failed to apply IPv4 basic ACL 2002.
ACL rule match counting in hardware has been successfully enabled.
The device has failed to enable counting ACL rule matches in hardware.
The device has failed to apply rule 5.
Packet filter default action for packets that do not match any
IPv4 ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
Packet filter default action for packets that do not match any
IPv6 ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
20
Field Description
MAC default action
Packet filter default action for packets that do not match any
Layer 2 ACLs:
•
Deny —The default action deny has been successfully applied for packet filtering.
•
Deny (Failed) —The device has failed to apply the default action deny for packet filtering. The action permit still functions.
•
Permit —The default action permit has been successfully applied for packet filtering.
display qos-acl resource
Use display qos-acl resource to display QoS and ACL resource usage.
Syntax
In standalone mode: display qos-acl resource [ advanced-mode ] [ slot slot-number ]
In IRF mode: display qos-acl resource [ advanced-mode ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters advanced-mode : Displays QoS and ACL resource usage in advanced mode. If you do not specify this keyword, the command displays QoS and ACL resource usage in common mode. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays ACL QoS and ACL resource usage for all cards. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays QoS and ACL resource usage for all cards. (In IRF mode.)
Usage guidelines
This command does not display any usage data if the specified card does not support counting QoS and ACL resources.
Some features such as packet filtering and device login cannot work correctly when QoS and ACL resources are insufficient. For these features to work correctly, reserve enough QoS and ACL resources.
Examples
# Display QoS and ACL resource usage in common mode.
21
<Sysname> display qos-acl resource
Interfaces: HGE1/3/0/1 to HGE1/3/0/2, XGE1/3/0/3 to XGE1/3/0/50 (chassis 1 slot3)
---------------------------------------------------------------------
Type Total Reserved Configured Remaining Usage
---------------------------------------------------------------------
VFP ACL 41728 0 0 41728 0%
IFP ACL 50176 8194 2 41980 16%
IFP Meter 30720 80 0 30640 0%
IFP Counter 8175 90 0 8085 1%
EFP ACL 20864 0 0 20864 0%
EFP Counter 4094 0 0 4094 0%
Table 6 Command output
Field Description
Interfaces Interface range for the resources.
Type
Total
Reserved
Configured
Remaining
Resource type:
•
VFP ACL —ACL resources for marking the local QoS ID before Layer 2 forwarding.
•
IFP ACL —Inbound ACL resources.
•
IFP Meter —Inbound traffic policing resources.
•
IFP Counter —Inbound traffic accounting resources.
•
EFP ACL —Outbound ACL resources.
•
EFP Counter —Outbound traffic accounting resources.
Total number of resources.
Number of reserved resources.
Number of resources that has been applied.
Number of resources that you can apply.
Usage
Configured and reserved resources as a percentage of total resources. If the percentage is not an integer, this field displays the integer part. For example, if the actual usage is 50.8%, this field displays 50%.
# Display QoS and ACL resource usage in advanced mode.
<Sysname> display qos-acl resource advanced-mode
====================
(Slot 3 Chip 0)
----------------------------------------------------------------------
Slice Stage Total Configured Remaining Usage
----------------------------------------------------------------------
0/1 IFP 8192 540 7652 6%
2 IFP 4096 1 4095 0%
3 -- 4096 0 4096 0%
4 IFP 8192 8 8184 0%
5 IFP 8192 0 8192 0%
6 -- 4096 0 4096 0%
7 -- 4096 0 4096 0%
8 -- 4096 0 4096 0%
9 -- 4096 0 4096 0%
10 -- 4096 0 4096 0%
22
11 -- 4096 0 4096 0%
12 IFP 256 2 254 0%
13 -- 256 0 256 0%
14 -- 256 0 256 0%
15 -- 256 0 256 0%
----------------------------------------------------------------------
Table 7 Command output
Field Description
Chip Chip for the resources.
Stage
Processing stage:
•
VFP —Layer 2 forwarding.
•
IFP —Receiving.
•
EFP —Sending.
Total
Configured
Remaining
Usage
Total number of resources.
Number of resources that has been applied.
Number of resources that can be applied.
Applied resources as a percentage of total resources. If the percentage is not an integer, this field displays the integer part. For example, if the actual usage is 50.8%, this field displays 50%.
packet-filter
Use packet-filter to apply an ACL to an interface to filter packets.
Use undo packet-filter to remove an ACL from an interface.
Syntax packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name }
{ inbound [ extension ] | outbound } [ hardware-count ] [ share-mode ]
[ vxlan-inner ] undo packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name }
{ inbound | outbound }
Default
No ACL is applied to an interface to filter packets.
Views
Layer 2 Ethernet interface view
Layer 2 aggregate interface view
Layer 3 Ethernet interface view
Layer 3 Ethernet subinterface view
Layer 3 aggregate interface view
VLAN interface view
VSI interface view
23
Predefined user roles network-admin mdc-admin
Parameters ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs. name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters. inbound : Filters incoming packets. extension : Applies the packet filter in extended mode to a Layer 2 Ethernet interface, Layer 3
Ethernet interface, or VLAN interface. This keyword is available only on FE cards and HF cards.
Before using this keyword, you must set the TCAM operating mode to acl by using the hardware-resource tcam command. For information about this command, see device management commands in Fundamentals Command Reference . outbound : Filters outgoing packets. hardware-count : Enables counting ACL rule matches performed in hardware. If you do not specify this keyword, rule matches for the ACL are not counted in hardware. share-mode : Applies the ACL in sharing mode. This keyword is supported only on Layer 2
Ethernet interfaces, Layer 3 Ethernet interfaces, VSI interfaces, and VLAN interfaces. In this mode, all Ethernet interfaces, VSI interfaces, or VLAN interfaces on an interface card with the same ACL applied in one direction share one QoS and ACL resource. For Ethernet interfaces, the device has four QoS and ACL resources that can be shared in each direction separately.
For VSI interfaces and
VLAN interfaces, the device has three QoS and ACL resources for each interface type that can be shared in the inbound direction. If all QoS and ACL resources that can be shared are used, they can be reused after they are released.
vxlan-inner : Matches the inner header information of VXLAN packets. This keyword is supported only in the inbound direction of Ethernet interfaces and VSI interfaces.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
The hardware-count keyword in this command enables match counting in hardware for all rules in an ACL, and the counting keyword in the rule command enables match counting specific to rules.
To make sure all interfaces on an interface card with the same ACL applied in one direction share one QoS and ACL resource, do not configure both the hardware-count and share-mode keywords.
To disable the extended mode or ACL rule match counting in hardware when resources are insufficient, you must execute the undo packet-filter command and then reconfigure the packet-filter command without specifying the extension or hardware-count keyword.
24
To disable the extended mode or ACL rule match counting in hardware when resources are sufficient, you can directly reconfigure the packet-filter command without specifying the extension or hardware-count keyword.
To the same direction of an interface, you can apply a maximum of four ACLs: one IPv4 ACL, one
IPv6 ACL, one Layer 2 ACL, and one user-defined ACL.
You can use the packet-filter command in VLAN interface view or the packet-filter vlan-interface command in system view to configure packet filtering in one direction of a VLAN interface. You cannot configure both of them in one direction of a VLAN interface.
If you specify the share-mode keyword when applying an ACL to an interface, follow these restrictions and guidelines:
•
You can apply multiple ACLs to one direction of an interface. However, you can apply only one
ACL with the share-mode keyword specified to one direction of an interface.
•
You cannot change the sharing mode dynamically after an ACL is applied to an interface. To change the sharing mode for an applied ACL, you must remove the ACL from the interface, and then reapply the ACL with or without the share-mode keyword specified.
If packet filtering is configured on Ethernet interfaces, on VLAN interfaces, VSI interfaces, and globally on the device, the packet filtering priority is as follows:
•
Packet filtering in extended mode takes priority over packet filtering in non-extended mode.
•
For packet filtering in non-extended mode, packet filtering on Ethernet interfaces takes priority over packet filtering on VSI interfaces. Packet filtering on VSI interfaces takes priority over packet filtering on VLAN interfaces. Global packet filtering has the lowest priority.
The vxlan-inner keyword matches the inner header information of incomng VXLAN packets on
Ethernet interfaces and VSI interfaces. For example, if the vxlan-inner keyword is specified, the rule permit ip source 10.0.0.0 0.255.255.255
command matches the VXLAN packets with the inner source IP address in the network segment 10.0.0.0/24. If the vxlan-inner keyword is not specified, the rule permit ip source 10.0.0.0 0.255.255.255
command matches the VXLAN packets with the outer source IP address in the network segment 10.0.0.0/24 or non-VXLAN packets with the source IP address in the network segment 10.0.0.0/24.
The vxlan-inner keyword is supported only when an IPv4 advanced ACL or Layer 2 ACL is applied to an Ethernet interface or VSI interface.
The vxlan-inner keyword cannot match VXLAN-encapsulated ARP packets.
To delete the vxlan-inner configuration for an ACL applied to an interface, you must first remove the ACL from the interface and then reapply the ACL to the interface without the vxlan-inner keyword.
An IPv4 ACL takes effect on only matching Layer 3 packets if the ACL is applied to the outbound direction of an interface. It does not take effect on matching Layer 2 packets.
An IPv6 ACL rule takes effect on only matching Layer 3 packets if the following conditions exist:
•
The dscp dscp option is configured in a rule of the ACL.
•
The ACL is applied to the outbound direction of an interface.
An IPv6 ACL cannot be applied to the outbound direction of an interface if the source IPv6 address and destination IPv6 address match criteria are configured in the rule.
Examples
# Apply IPv4 basic ACL 2001 to filter incoming traffic on FortyGigE 1/0/1, and enable counting ACL rule matches performed in hardware.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] packet-filter 2001 inbound hardware-count
25
# Apply IPv4 basic ACL 2001 in sharing mode to filter outgoing traffic on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] packet-filter 2001 outbound share-mode
Related commands display packet-filter display packet-filter statistics display packet-filter verbose
packet-filter continuous enable
Use packet-filter continuous enable to enable the continuous mode for packet filtering.
Use undo packet-filter continuous enable to disable the continuous mode for packet filtering.
Syntax packet-filter continuous enable undo packet-filter continuous enable
Default
The continuous mode is enabled for packet filtering.
Views
System view
Predefined user roles network-admin mdc-admin
Usage guidelines
When you modify, delete, or add a rule in the ACL of a global or interface-based packet filter, the packet filter will be invalid for a short time. Enabling the continuous mode ensures that the packet filter is in effect while you are dynamically configuring the ACL. However, it affects forwarding performance (for example, reduces packet match speed).
If you enable or disable the continuous mode after configuring packet filtering, you must reboot the device for the continuous mode configuration to take effect.
Examples
# Enable the continuous mode for packet filtering.
<Sysname> system-view
[Sysname] packet-filter continuous enable
Enable the continuous mode for packet filter? [Y/N]:y
For the continuous mode to take effect, save the configuration, and then reboot the device.
packet-filter default deny
Use packet-filter default deny to set the packet filtering default action to deny . The packet filter denies packets that do not match any ACL rule.
Use undo packet-filter default deny to restore the default.
26
Syntax packet-filter default deny undo packet-filter default deny
Default
The packet filtering default action is permit . The packet filter permits packets that do not match any
ACL rule.
Views
System view
Predefined user roles network-admin mdc-admin
Usage guidelines
The packet filter applies the default action to all ACL applications for packet filtering. The default action appears in the display command output for packet filtering.
Examples
# Set the packet filter default action to deny .
<Sysname> system-view
[Sysname] packet-filter default deny
Related commands display packet-filter display packet-filter statistics display packet-filter verbose
packet-filter global
Use packet-filter global to apply an ACL to filter packets globally.
Use undo packet-filter global to remove an ACL for global packet filtering.
Syntax packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } global { inbound | outbound } [ hardware-count ] undo packet-filter [ ipv6 | mac user-defined ] { acl-number | name acl-name } global { inbound | outbound }
Default
No ACL is applied to filter packets globally.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters ipv6 : Specifies the IPv6 ACL type.
27
mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs.
name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters. global : Specifies all physical interfaces.
inbound : Filters incoming packets. outbound : Filters outgoing packets. hardware-count : Enables counting ACL rule matches performed in hardware. If you do not specify this keyword, rule matches for the ACL are not counted in hardware.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
The hardware-count keyword in this command enables match counting in hardware for all rules in an ACL, and the counting keyword in the rule command enables match counting specific to rules.
To disable ACL rule match counting in hardware when resources are insufficient, you must execute the undo packet-filter command and then reconfigure the packet-filter command without specifying the hardware-count keyword.
To disable ACL rule match counting in hardware when resources are sufficient, you can directly reconfigure the packet-filter command without specifying the hardware-count keyword.
You can apply a maximum of three ACLs to the same direction for global packet filtering: one IPv4
ACL, one IPv6 ACL, and one Layer 2 ACL.
An IPv4 ACL takes effect on only matching Layer 3 packets if the ACL is applied to the outbound direction globally. It does not take effect on matching Layer 2 packets.
An IPv6 ACL rule takes effect on only matching Layer 3 packets if the following conditions exist:
•
The dscp dscp option is configured after the protocol parameter is configured in the rule.
•
The ACL is applied to the outbound direction globally.
An IPv6 ACL cannot be applied to the outbound direction globally if the source IPv6 address and destination IPv6 address match criteria are configured in the rule.
Examples
# Apply IPv4 basic ACL 2001 to filter incoming traffic on all physical interfaces, and enable counting
ACL rule matches performed in hardware.
<Sysname> system-view
[Sysname] packet-filter 2001 global inbound hardware-count
Related commands display packet-filter display packet-filter statistics display packet-filter verbose
28
packet-filter vlan-interface
Use packet-filter vlan-interface to apply an ACL to a list of VLAN interfaces to filter packets.
Use undo packet-filter vlan-interface to remove an ACL from a list of VLAN interfaces.
Syntax packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } vlan-interface vlan-interface-list { inbound | outbound }
[ hardware-count ] undo packet-filter [ ipv6 | mac | user-defined ] { acl-number | name acl-name } vlan-interface vlan-interface-list { inbound | outbound }
Default
No ACL is applied to a list of VLAN interfaces to filter packets.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs.
name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters. vlan-interface vlan-interface-list : Specifies a space-separated list of up to eight
VLAN interface items. Each item specifies a VLAN interface or a range of VLAN interfaces in the form of start-vlan-interface to end-vlan-interface .
inbound : Filters incoming packets. outbound : Filters outgoing packets. hardware-count : Enables counting ACL rule matches performed in hardware. If you do not specify this keyword, rule matches for the ACL are not counted in hardware.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
You can use the packet-filter command in VLAN interface view or use the packet-filter vlan-interface command in system view to configure packet filtering in one direction of a VLAN interface. You cannot configure both of them in the same direction of a VLAN interface.
29
The hardware-count keyword in this command enables match counting in hardware for all rules in an ACL, and the counting keyword in the rule command enables match counting specific to rules.
With the packet-filter vlan-interface command, you can configure only two filters: one for each direction. You can repeat the command to add VLAN interfaces to the packet filter in each direction. As a best practice to save resources, use the packet-filter vlan-interface command to configure packet filtering for VLAN interfaces that share the same packet filtering ACL.
For a packet filter, the use of the hardware-count keyword must be consistent across all its VLAN interfaces. You must specify the hardware-count keyword for all its VLAN interfaces or none of its VLAN interfaces.
A list of VLAN interfaces can contain up to eight VLAN interface items. Each item has at least one
VLAN interface. Follow these restrictions and guidelines when you use the undo packet-filter vlan-interface command:
•
You can specify the entire VLAN interface list to remove the ACL from all VLAN interfaces in the list.
•
You can specify one or more VLAN interface items of the list to remove the ACL from the specified VLAN interfaces.
•
For a VLAN interface item with multiple VLAN interfaces, you cannot remove the ACL from only some of the VLAN interfaces of the VLAN interface item.
To disable ACL rule match counting in hardware when resources are insufficient, you must execute the undo packet-filter command and then reconfigure the packet-filter command without specifying the hardware-count keyword.
To disable ACL rule match counting in hardware when resources are sufficient, you can directly reconfigure the packet-filter command without specifying the hardware-count keyword.
Examples
# Apply IPv4 basic ACL 2003 to filter incoming traffic on VLAN interfaces 3 through 10, and enable counting ACL rule matches performed in hardware.
<Sysname> system-view
[Sysname] packet-filter 2003 vlan-interface 3 to 10 inbound hardware-count
Related commands display packet-filter display packet-filter statistics display packet-filter verbose
reset acl counter
Use reset acl counter to clear statistics for ACLs.
Syntax reset acl [ ipv6 | mac | user-defined ] counter { acl-number | all | name acl-name }
Views
User view
Predefined user roles network-admin mdc-admin
30
Parameters ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs. all : Clears statistics for all ACLs of the specified type.
name acl-name : Clears statistics of an ACL specified by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
Usage guidelines
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
Examples
# Clear statistics for IPv4 basic ACL 2001.
<Sysname> reset acl counter 2001
Related commands display acl
reset packet-filter statistics
Use reset packet-filter statistics to clear the packet filtering statistics.
Syntax reset packet-filter statistics { global | interface [ interface-type interface-number ] | vlan-interface } { inbound | outbound } [ [ ipv6 | mac | user-defined ] { acl-number | name acl-name } ]
Views
User view
Predefined user roles network-admin mdc-admin
Parameters global : Specifies all physical interfaces.
interface [ interface-type interface-number ] : Specifies an interface by its type and number. If you do not specify an interface, this command clears packet filtering statistics for all interfaces. vlan-interface : Specifies the list of VLAN interfaces specified in the packet-filter vlan-interface command. inbound : Specifies the inbound direction. outbound : Specifies the outbound direction.
31
ipv6 : Specifies the IPv6 ACL type. mac : Specifies the Layer 2 ACL type. user-defined : Specifies the user-defined ACL type. acl-number : Specifies an ACL by its number. The following are available value ranges:
•
2000 to 2999 for basic ACLs.
•
3000 to 3999 for advanced ACLs.
•
4000 to 4999 for Layer 2 ACLs.
•
5000 to 5999 for user-defined ACLs.
name acl-name : Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.
Usage guidelines
If acl-number , name acl-name , ipv6 , mac , or user-defined is not specified, this command clears the packet filtering statistics for all ACLs.
To specify the IPv4 ACL type, do not specify the ipv6 , mac , or user-defined keyword.
Examples
# Clear IPv4 basic ACL 2001 statistics for inbound packet filtering on FortyGigE 1/0/1.
<Sysname> reset packet-filter statistics interface fortygige 1/0/1 inbound 2001
# Clear IPv4 basic ACL 2001 statistics for inbound packet filtering on the list of VLAN interfaces.
<Sysname> reset packet-filter statistics vlan-interface inbound 2001
Related commands display packet-filter statistics display packet-filter statistics sum
rule (IPv4 advanced ACL view)
Use rule to create or edit an IPv4 advanced ACL rule.
Use undo rule to delete an entire IPv4 advanced ACL rule or some attributes in the rule.
Syntax rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { object-group address-group-name | dest-address dest-wildcard | any } | destination-port { object-group port-group-name | operator port1 [ port2 ] } | { dscp dscp | { precedence precedence | tos tos } * } | fragment | icmp-type { icmp-type [ icmp-code ] | icmp-message } | [ flow-logging | logging ] | qos-local-id local-id-value | source { object-group address-group-name | source-address source-wildcard
| any } | source-port { object-group port-group-name | operator port1
[ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ]
* rule [ rule-id ] { deny | permit } { gre-encapsulation | ipinip-encapsulation
| vxlan } [ destination { dest-address dest-wildcard | any } | source
{ source-address source-wildcard | any } | source-port operator port1
[ port2 ] | vxlan-id vxlan-id ] * inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-wildcard | any } | inner-destination-port operator port1 [ port2 ] | inner-established |
32
inner-source { source-address source-wildcard | any } | inner-source-port operator port1 [ port2 ] | [ flow-logging | logging ] | time-range time-range-name ] * undo rule rule-id [ { { ack | fin | psh | rst | syn | urg } * | established } | counting | destination | destination-port | { dscp | { precedence | tos } * } | fragment | icmp-type | inner-destination | inner-destination-port | inner-established | inner-source | inner-source-port | [ flow-logging | logging ] | qos-local-id | source | source-port | time-range | vpn-instance | vxlan-id ] * undo rule { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { object-group address-group-name | dest-address dest-wildcard | any } | destination-port { object-group port-group-name | operator port1 [ port2 ] } | { dscp dscp | { precedence precedence | tos tos } * }
| fragment | icmp-type { icmp-type [ icmp-code ] | icmp-message } |
[ flow-logging | logging ] | qos-local-id | source { object-group address-group-name | source-address source-wildcard | any } | source-port
{ object-group port-group-name | operator port1 [ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ] * undo rule { deny | permit } { gre-encapsulation | ipinip-encapsulation | vxlan } [ destination { dest-address dest-wildcard | any } | source
{ source-address source-wildcard | any } | source-port operator port1
[ port2 ] | vxlan-id vxlan-id ] * inner-protocol inner-protocol [ counting | inner-destination { dest-address dest-wildcard | any } | inner-destination-port operator port1 [ port2 ] | inner-established | inner-source { source-address source-wildcard | any } | inner-source-port operator port1 [ port2 ] | [ flow-logging | logging ] | time-range time-range-name ] *
Default
No IPv4 advanced ACL rules exist.
Views
IPv4 advanced ACL view
Predefined user roles network-admin mdc-admin
Parameters rule-id : Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30. deny : Denies matching packets. permit : Allows matching packets to pass. protocol : Specifies one of the following values:
•
A protocol number in the range of 0 to 255.
•
A protocol by its name: gre (47), icmp (1), igmp (2), ip , ipinip (4), ospf (89), tcp (6), or udp
(17). The ip keyword specifies all protocols.
describes the parameters that you can specify regardless of the value for the protocol argument.
33
Table 8 Match criteria and other rule information for IPv4 advanced ACL rules
Parameters Function Description source
{ object-group address-group-name
| source-address source-wildcard | any }
Specifies a source address.
The address-group-name argument specifies an object group of source IP addresses.
The source-address source-wildcard arguments specify a source IP address and a wildcard mask in dotted decimal notation. An all-zero wildcard represents a host address.
The any keyword specifies any source IP address. destination
{ object-group address-group-name
| dest-address dest-wildcard | any } counting
Specifies a destination address.
Enables rule match counting in software.
The address-group-name argument specifies an object group of destination IP addresses.
The dest-address dest-wildcard arguments specify a destination IP address and a wildcard mask in dotted decimal notation. An all-zero wildcard mask represents a host address.
The any keyword represents any destination IP address.
The counting keyword enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL. If the counting keyword is not specified, matches for the rule are not counted in software.
precedence precedence tos dscp tos dscp fragment
Specifies an IP precedence value.
Specifies a ToS preference.
Specifies a DSCP priority.
Applies the rule only to non-first fragments.
The precedence argument can be a number in the range of 0 to 7, or in words: routine (0), priority (1), immediate (2), flash (3), flash-override (4), critical (5), internet (6), or network (7).
The tos argument can be a number in the range of 0 to 15, or in words: max-reliability (2), max-throughput (4), min-delay (8), min-monetary-cost (1), or normal (0).
The dscp argument can be a number in the range of 0 to 63, or in words: af11 (10), af12
(12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42
(36), af43 (38), cs1 (8), cs2 (16), cs3 (24), cs4
(32), cs5 (40), cs6 (48), cs7 (56), default (0), or ef (46).
If you do not specify this keyword, the rule applies to all fragments and non-fragments.
34
Parameters Function Description flow-logging
Logs matching packets on a per-flow basis.
The log information includes the number of matching packets, and the source IP address, destination IP address, source port number, and destination port number of the matching flow.
This feature requires that the module (for example, packet filtering) that uses the ACL supports logging.
The flow-logging keyword is available in
Release 2712 and later versions. logging Logs matching packets.
This feature requires that the module (for example, packet filtering) that uses the ACL supports logging. time-range time-range-name qos-local-id
local-id-value
Specifies a time range for the rule.
The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range.
For more information about time range, see ACL and QoS Configuration Guide .
Specifies a local QoS ID.
The value range for the local-id-value argument is 1 to 4095. By default, no local QoS
ID is specified. vpn-instance vpn-instance-name
Applies the rule to an
MPLS L3VPN instance.
The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters.
If you do not specify a VPN instance, the rule applies to both non-VPN packets and VPN packets.
If the protocol argument is tcp (6) or udp (17), set the parameters shown in
.
Table 9 TCP/UDP-specific parameters for IPv4 advanced ACL rules source-port
{ object-group port-group-name
| operator port1
[ port2 ] }
Specifies one or more UDP or
TCP source ports.
The port-group-name argument specifies an object group of ports.
The operator argument can be lt (lower than), gt (greater than), eq (equal to), neq (not equal to), or range (inclusive range).
35
destination-port
{ object-group port-group-name
| operator port1
[ port2 ] }
{ ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } *
Specifies one or more UDP or
TCP destination ports.
Specifies one or more TCP flags including ACK,
FIN, PSH, RST,
SYN, and URG.
The port1 and port2 arguments are TCP or UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range .
TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime (13), discard (9), dns (53), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin (543), kshell (544), login (513), lpd (515), nntp
(119), pop2 (109), pop3 (110), smtp (25), sunrpc (111), tacacs (49), talk (517), telnet (23), time (37), uucp (540), whois (43), and www (80).
UDP port numbers can be represented as: biff (512), bootpc (68), bootps (67), discard (9), dns (53), dnsix
(90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp (161), snmptrap (162), sunrpc (111), syslog (514), tacacs-ds
(65), talk (517), tftp (69), time (37), who (513), and xdmcp
(177).
Parameters specific to TCP.
The value for each argument can be 0 (flag bit not set) or 1
(flag bit set).
The TCP flags in a rule are ANDed. For example, a rule configured with ack 0 psh 1 matches packets that have the
ACK flag bit not set and the PSH flag bit set. established
Specifies the flags for indicating the established status of a TCP connection.
Parameter specific to TCP.
The rule matches TCP connection packets with the ACK or
RST flag bit set.
If the protocol argument is icmp
(1), set the parameters shown in Table 10 .
Table 10 ICMP-specific parameters for IPv4 advanced ACL rules
Parameters Function Description icmp-type
{ icmp-type icmp-code | icmp-message }
Specifies the ICMP message type and code.
The icmp-type argument is in the range of 0 to 255.
The icmp-code argument is in the range of 0 to 255.
The icmp-message argument specifies a message name. Supported ICMP message names and their
corresponding type and code values are listed in Table 11 .
Table 11 ICMP message names supported in IPv4 advanced ACL rules
ICMP message name ICMP message type ICMP message code echo 8 0 echo-reply 0 fragmentneed-DFset 3 host-redirect 5 host-tos-redirect 5 host-unreachable 3
0
4
1
3
1
36
ICMP message name ICMP message type information-reply 16 information-request 15 net-redirect 5 net-tos-redirect 5 net-unreachable 3 parameter-problem 12 port-unreachable 3 protocol-unreachable 3 reassembly-timeout 11 source-quench 4 source-route-failed 3 timestamp-reply 14 timestamp-request 13
ICMP message code
0
0
0
2
0
0
3
2
1
0
5
0
0 ttl-exceeded 11 0 vxlan : Specifies VXLAN encapsulation. You can specify a VXLAN ID only after you specify this keyword. gre-encapsulation : Specifies GRE encapsulation. The source-port operator port1
[ port2 ] and vxlan-id vxlan-id options cannot be configured if you specify the gre-encapsulation keyword. ipinip-encapsulation : Specifies IP-in-IP encapsulation. The source-port operator port1 [ port2 ] and vxlan-id vxlan-id options cannot be configured if you specify the ipinip-encapsulation keyword. vxlan-id vxlan-id : Specifies a VXLAN ID in the range of 0 to 16777215. inner-protocol inner-protocol : Specifies an inner protocol type by its number in the range of 0 to 255 or by its name: gre (47), icmp (1), igmp (2), ip , ipinip (4), ospf (89), tcp (6), or udp (17).
Table 12 describes the parameters that you can specify regardless of the value for the
inner-protocol argument.
Table 12 Match criteria and other rule information for IPv4 advanced ACL rules
Parameters Function Description inner-established
Specifies the inner flags for indicating the established status of a
TCP connection.
Parameter specific to the inner TCP protocol.
The rule matches TCP connection packets with the ACK or RST flag bit set. inner-source
{ source-address source-wildcard | any }
Specifies inner source
IPv4 addresses.
The source-address source-wildcard arguments represent an inner source IPv4 address and an inner wildcard mask in dotted decimal notation. An all-zero wildcard mask specifies a host address.
The any keyword specifies any inner source
IPv4 addresses.
37
Parameters Function Description inner-destination
{ dest-address dest-wildcard any }
|
Specifies inner destination
IPv4 addresses.
The dest-address dest-wildcard arguments represent an inner destination IPv4 address and an inner wildcard mask in dotted decimal notation. An all-zero wildcard mask specifies a host address.
The any keyword represents any inner destination IPv4 addresses.
If the inner-protocol argument is tcp (6) or udp (17), set the parameters shown in
.
Table 13 TCP/UDP-specific parameters for IPv4 advanced ACL rules inner-source-port operator port1 [ port2 ] inner-destination-port operator port1 [ port2 ]
Specifies inner
UDP or TCP source ports.
Specifies inner
UDP or TCP destination ports.
The operator argument can be lt (lower than), gt (greater than), eq (equal to), neq (not equal to), or range (inclusive range).
The port1 and port2 arguments are TCP or
UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range .
TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime
(13), discard (9), dns (53), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin
(543), kshell (544), login (513), lpd (515), nntp
(119), pop2 (109), pop3 (110), smtp (25), sunrpc
(111), tacacs (49), talk (517), telnet (23), time
(37), uucp (540), whois (43), and www (80).
UDP port numbers can be represented as: biff
(512), bootpc (68), bootps (67), discard (9), dns
(53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp
(161), snmptrap (162), sunrpc (111), syslog
(514), tacacs-ds (65), talk (517), tftp (69), time
(37), who (513), and xdmcp (177).
The TCP port domain is saved as dns in the configuration file.
Usage guidelines
If an IPv4 advanced ACL is used for outbound packet filtering, do not specify the vpn-instance keyword.
If an IPv4 advanced ACL is used for QoS traffic classification or packet filtering, do not specify neq for the operator argument.
If an IPv4 advanced ACL is used for outbound QoS traffic classification or outbound packet filtering:
•
The rule [ rule-id ] { deny | permit } ip command can match only Layer 3 forwarded packets, but not packets processed by the CPU or Layer 2 forwarded packets.
•
Any other IPv4 advanced ACL rule can match packets processed by the CPU, Layer 2 forwarded packets, and Layer 3 forwarded packets.
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
38
You can edit ACL rules only when the match order is config .
To view the existing IPv4 basic and advanced ACL rules, use the display acl all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for the rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
Examples
# Create an IPv4 advanced ACL rule to permit TCP packets with the destination port 80 from
129.9.0.0/16 to 202.38.160.0/24.
<Sysname> system-view
[Sysname] acl advanced 3000
[Sysname-acl-ipv4-adv-3000] rule permit tcp source 129.9.0.0 0.0.255.255 destination
202.38.160.0 0.0.0.255 destination-port eq 80
# Create IPv4 advanced ACL rules to permit all IP packets but the ICMP packets destined for
192.168.1.0/24.
<Sysname> system-view
[Sysname] acl advanced 3001
[Sysname-acl-ipv4-adv-3001] rule deny icmp destination 192.168.1.0 0.0.0.255
[Sysname-acl-ipv4-adv-3001] rule permit ip
# Create IPv4 advanced ACL rules to permit inbound and outbound FTP packets.
<Sysname> system-view
[Sysname] acl advanced 3002
[Sysname-acl-ipv4-adv-3002] rule permit tcp source-port eq ftp
[Sysname-acl-ipv4-adv-3002] rule permit tcp source-port eq ftp-data
[Sysname-acl-ipv4-adv-3002] rule permit tcp destination-port eq ftp
[Sysname-acl-ipv4-adv-3002] rule permit tcp destination-port eq ftp-data
# Create IPv4 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets.
<Sysname> system-view
[Sysname] acl advanced 3003
[Sysname-acl-ipv4-adv-3003] rule permit udp source-port eq snmp
[Sysname-acl-ipv4-adv-3003] rule permit udp source-port eq snmptrap
[Sysname-acl-ipv4-adv-3003] rule permit udp destination-port eq snmp
[Sysname-acl-ipv4-adv-3003] rule permit udp destination-port eq snmptrap
# Create an IPv4 advanced ACL rule to permit VXLAN packets whose inner source IP address is in subnet 192.168.1.0/24.
<Sysname> system-view
[Sysname] acl advanced 3004
[Sysname-acl-ipv4-adv-3004] rule permit vxlan inner-protocol ip inner-source 192.168.1.0
0.0.0.255
Related commands acl acl logging interval display acl step time-range
39
rule (IPv4 basic ACL view)
Use rule to create or edit an IPv4 basic ACL rule.
Use undo rule to delete an entire IPv4 basic ACL rule or some attributes in the rule.
Syntax rule [ rule-id ] { deny | permit } [ counting | fragment | [ flow-logging | logging ] | source { object-group address-group-name | source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] * undo rule rule-id [ counting | fragment | [ flow-logging | logging ] | source | time-range | vpn-instance ] * undo rule { deny | permit } [ counting | fragment | [ flow-logging | logging ]
| source { object-group address-group-name | source-address source-wildcard | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
Default
No IPv4 basic ACL rules exist.
Views
IPv4 basic ACL view
Predefined user roles network-admin mdc-admin
Parameters rule-id : Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30. deny : Denies matching packets. permit : Allows matching packets to pass. counting : Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software. fragment : Applies the rule only to non-first fragments. If you do not specify this keyword, the rule applies to both fragments and non-fragments. flow-logging : Logs matching packets on a per-flow basis. The log information includes the number of matching packets, and the source IP address, destination IP address, source port number, and destination port number of the matching flow. This feature is available only when the module (for example, packet filtering) that uses the ACL supports the logging feature. The flow-logging keyword is available in Release 2712 and later versions. logging : Logs matching packets. This feature is available only when the application module (for example, packet filtering) that uses the ACL supports the logging feature. source { object-group address-group-name | source-address source-wildcard
| any } : Matches a source address. The object-group address-group-name option specifies an object group of source IP addresses. The source-address and source-wildcard arguments specify a source IP address and a wildcard mask in dotted decimal
40
notation. A wildcard mask of zeros represents a host address. The any keyword represents any source IP address. time-range time-range-name : Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide .
vpn-instance vpn-instance-name : Applies the rule to an MPLS L3VPN instance. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If you do not specify a VPN instance, the rule applies to both non-VPN packets and VPN packets.
Usage guidelines
If an IPv4 basic ACL is used for outbound packet filtering, do not specify the vpn-instance keyword.
If an IPv4 basic ACL is used for outbound QoS traffic classification or outbound packet filtering:
•
The rule [ rule-id ] { deny | permit } { object-group address-group-name | source { source-address source-wildcard | any } } command can match only Layer
3 forwarded packets, but not packets processed by the CPU or Layer 2 forwarded packets.
•
Any other IPv4 basic ACL rule can match packets processed by the CPU, Layer 2 forwarded packets, and Layer 3 forwarded packets.
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be
You can edit ACL rules only when the match order is config
.
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL.
To view the existing IPv4 basic and advanced ACL rules, use the display acl all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for the rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
Examples
# Create a rule in IPv4 basic ACL 2000 to deny the packets from any source IP subnet but 10.0.0.0/8,
172.17.0.0/16, or 192.168.1.0/24.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] rule permit source 10.0.0.0 0.255.255.255
[Sysname-acl-ipv4-basic-2000] rule permit source 172.17.0.0 0.0.255.255
[Sysname-acl-ipv4-basic-2000] rule permit source 192.168.1.0 0.0.0.255
[Sysname-acl-ipv4-basic-2000] rule deny source any
Related commands acl acl logging interval display acl step time-range
41
rule (IPv6 advanced ACL view)
Use rule to create or edit an IPv6 advanced ACL rule.
Use undo rule to delete an entire IPv6 advanced ACL rule or some attributes in the rule.
Syntax rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { object-group address-group-name | dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port { object-group port-group-name | operator port1 [ port2 ] }
| dscp dscp | flow-label flow-label-value | fragment | icmp6-type
{ icmp6-type icmp6-code | icmp6-message } | [ flow-logging | logging ] | qos-local-id local-id-value | routing [ type routing-type ] | hop-by-hop
[ type hop-type ] | source { object-group address-group-name | source-address source-prefix | source-address/source-prefix | any } | source-port { object-group port-group-name | operator port1 [ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ] * undo rule rule-id [ { { ack | fin | psh | rst | syn | urg } * | established } | counting | destination | destination-port | dscp | flow-label | fragment | icmp6-type | [ flow-logging | logging ] | qos-local-id | routing | hop-by-hop
| source | source-port | time-range | vpn-instance ] * undo rule { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { object-group address-group-name | dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port
{ object-group port-group-name | operator port1 [ port2 ] } | dscp dscp | flow-label flow-label-value | fragment | icmp6-type { icmp6-type icmp6-code | icmp6-message } | [ flow-logging | logging ] | qos-local-id | routing [ type routing-type ] | hop-by-hop [ type hop-type ] | source
{ object-group address-group-name | source-address source-prefix | source-address/source-prefix | any } | source-port { object-group port-group-name | operator port1 [ port2 ] } | time-range time-range-name | vpn-instance vpn-instance-name ] *
Default
No IPv6 advanced ACL rules exist.
Views
IPv6 advanced ACL view
Predefined user roles network-admin mdc-admin
Parameters rule-id : Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30. deny : Denies matching packets. permit : Allows matching packets to pass.
42
protocol : Specifies one of the following values:
•
A protocol number in the range of 0 to 255.
•
A protocol name: gre (47), icmpv6 (58), ipv6 , ipv6-ah (51), ipv6-esp (50), ospf (89), tcp (6), or udp (17). The ipv6 keyword specifies all protocols.
describes the parameters that you can specify regardless of the value for the protocol argument.
Table 14 Match criteria and other rule information for IPv6 advanced ACL rules source { object-group address-group-name | source-address source-prefix | source-address/sourc e-prefix | any } destination
{ object-group address-group-name | dest-address dest-prefix | dest-address/dest-pr efix | any } counting dscp dscp flow-label fragment flow-label-value
Specifies a source IPv6 address.
The address-group-name argument specifies an object group of source IPv6 addresses.
The source-address argument specifies an IPv6 source address.
The source-prefix argument specifies a prefix length in the range of 1 to 128.
The any keyword represents any IPv6 source address.
Specifies a destination IPv6 address.
The address-group-name argument specifies an object group of destination IPv6 addresses.
The dest-address argument specifies a destination IPv6 address.
The dest prefix argument specifies a prefix length in the range of 1 to 128.
The any keyword represents any IPv6 destination address.
Enables rule match counting in software.
Specifies a DSCP preference.
The counting keyword enables match counting specific to rules, and the hardware-count keyword in the packet-filter ipv6 command enables match counting in hardware for all rules in an ACL. If the counting keyword is not specified, matches for the rule are not counted in software.
The dscp argument can be a number in the range of 0 to 63, or in words, af11
(10), af12 (12), af13 (14), af21 (18), af22
(20), af23 (22), af31 (26), af32 (28), af33
(30), af41 (34), af42 (36), af43 (38), cs1
(8), cs2 (16), cs3 (24), cs4 (32), cs5 (40), cs6 (48), cs7 (56), default (0), or ef (46).
Specifies a flow label value in an IPv6 packet header.
The flow-label-value argument is in the range of 0 to 1048575.
Applies the rule only to non-first fragments.
If you do not specify this keyword, the rule applies to all fragments and non-fragments.
43
flow-logging logging routing [ routing-type hop-by-hop hop-type type
] time-range
[ type time-range-name qos-local-id
]
local-id-value vpn-instance vpn-instance-name
Logs matching packets on a per-flow basis.
The log information includes the number of matching packets, and the source IP address, destination IP address, source port number, and destination port number of the matching flow.
This feature requires that the module (for example, packet filtering) that uses the
ACL supports logging.
The flow-logging keyword is available in Release 2712 and later versions.
Logs matching packets.
Specifies an IPv6 routing header type.
This feature requires that the module (for example, packet filtering) that uses the
ACL supports logging. routing-type : Value of the IPv6 routing header type, in the range of 0 to
255.
If you specify the type routing-type option, the rule applies to the specified type of IPv6 routing header. If you do not specify the type routing-type option, the rule applies to all types of IPv6 routing headers.
Specifies an IPv6
Hop-by-Hop Options header type. hop-type : Value of the IPv6
Hop-by-Hop Options header type, in the range of 0 to 255.
If you specify the type hop-type option, the rule applies to the specified type of IPv6 Hop-by-Hop Options header.
If you do not specify the type hop-type option, the rule applies to all types of IPv6 Hop-by-Hop Options header.
Specifies a time range for the rule.
Specifies a local QoS ID.
The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range.
For more information about time range, see ACL and QoS Configuration Guide .
The value range for the local-id-value argument is 1 to 4095. By default, no local
QoS ID is specified. For more information about the local QoS ID, see the routing policy in Layer 3—IP Routing
Configuration Guide .
Applies the rule to an MPLS
L3VPN instance.
The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters.
If you do not specify a VPN instance, the rule applies to both non-VPN packets and
VPN packets.
44
If the protocol argument is tcp (6) or udp (17), set the parameters shown in
.
Table 15 TCP/UDP-specific parameters for IPv6 advanced ACL rules source-port
{ operator
[ destination-port
{
{ port2 ] port1
} object-group ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * port-group-name | operator port1
[ port2 ] } object-group port-group-name |
Specifies one or more UDP or TCP source ports.
Specifies one or more UDP or TCP destination ports.
Specifies one or more TCP flags, including ACK, FIN,
PSH, RST, SYN, and URG.
The port-group-name argument specifies an object group of ports.
The operator argument can be lt (lower than), gt
(greater than), eq (equal to), neq (not equal to), or range (inclusive range).
The port1 and port2 arguments are TCP or
UDP port numbers in the range of 0 to 65535. The port2 argument is needed only when the operator argument is range .
TCP port numbers can be represented as: chargen (19), bgp (179), cmd (514), daytime
(13), discard (9), dns (53), domain (53), echo (7), exec (512), finger (79), ftp (21), ftp-data (20), gopher (70), hostname (101), irc (194), klogin
(543), kshell (544), login (513), lpd (515), nntp
(119), pop2 (109), pop3 (110), smtp (25), sunrpc
(111), tacacs (49), talk (517), telnet (23), time
(37), uucp (540), whois (43), and www (80).
UDP port numbers can be represented as: biff
(512), bootpc (68), bootps (67), discard (9), dns
(53), dnsix (90), echo (7), mobilip-ag (434), mobilip-mn (435), nameserver (42), netbios-dgm (138), netbios-ns (137), netbios-ssn (139), ntp (123), rip (520), snmp
(161), snmptrap (162), sunrpc (111), syslog
(514), tacacs-ds (65), talk (517), tftp (69), time
(37), who (513), and xdmcp (177).
Parameters specific to TCP.
The value for each argument can be 0 (flag bit not set) or 1 (flag bit set).
The TCP flags in a rule are ANDed. For example, a rule configured with ack 0 psh 1 matches packets that have the ACK flag bit not set and the PSH flag bit set. established
Specifies the flags for indicating the established status of a TCP connection.
Parameter specific to TCP.
The rule matches TCP packets with the ACK or
RST flag bit set.
If the protocol argument is icmpv6
(58), set the parameters shown in Table 16
.
Table 16 ICMPv6-specific parameters for IPv6 advanced ACL rules
Parameters Function Description icmp6-type
{ icmp6-type icmp6-code | icmp6-message }
Specifies the ICMPv6 message type and code.
The icmp6-type argument is in the range of 0 to 255.
The icmp6-code argument is in the range of 0 to 255.
The icmp6-message argument specifies a message name. Supported ICMP message names and their
corresponding type and code values are listed in Table
.
45
Table 17 ICMPv6 message names supported in IPv6 advanced ACL rules
ICMPv6 message name ICMPv6 message type echo-reply 129
ICMPv6 message code
0 echo-request 128 err-Header-field 4 frag-time-exceeded 3 hop-limit-exceeded 3 host-admin-prohib 1
0
0
1
0
1 host-unreachable 1 neighbor-advertisement 136 neighbor-solicitation 135 network-unreachable 1
3
0
0
0 packet-too-big 2 port-unreachable 1
0
4 redirect 137 0 router-advertisement 134 0 router-solicitation 133 unknown-ipv6-opt 4
0
2 unknown-next-hdr 4
Usage guidelines
1
If an IPv6 advanced ACL is used for QoS traffic classification or packet filtering:
•
Do not specify the fragment keyword.
•
Do not specify neq for the operator argument.
If an IPv6 advanced ACL is used for outbound packet filtering, do not specify the vpn-instance , routing , hop-by-hop , or flow-label keyword.
If an IPv6 advanced ACL is used for outbound QoS traffic classification or outbound packet filtering:
•
The rule [ rule-id ] { deny | permit } ipv6 command can match only Layer 3 forwarded packets, but not packets processed by the CPU or Layer 2 forwarded packets.
•
Any other IPv6 advanced ACL rule can match packets processed by the CPU, Layer 2 forwarded packets, and Layer 3 forwarded packets.
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
You can edit ACL rules only when the match order is config .
To view the existing IPv6 basic and advanced ACL rules, use the display acl ipv6 all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for a rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
46
Examples
# Create an IPv6 advanced ACL rule to permit TCP packets with the destination port 80 from
2030:5060::/64 to FE80:5060::/96.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3000
[Sysname-acl-ipv6-adv-3000] rule permit tcp source 2030:5060::/64 destination fe80:5060::/96 destination-port eq 80
# Create IPv6 advanced ACL rules to permit all IPv6 packets but the ICMPv6 packets destined for
FE80:5060:1001::/48.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3001
[Sysname-acl-ipv6-adv-3001] rule deny icmpv6 destination fe80:5060:1001:: 48
[Sysname-acl-ipv6-adv-3001] rule permit ipv6
# Create IPv6 advanced ACL rules to permit inbound and outbound FTP packets.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3002
[Sysname-acl-ipv6-adv-3002] rule permit tcp source-port eq ftp
[Sysname-acl-ipv6-adv-3002] rule permit tcp source-port eq ftp-data
[Sysname-acl-ipv6-adv-3002] rule permit tcp destination-port eq ftp
[Sysname-acl-ipv6-adv-3002] rule permit tcp destination-port eq ftp-data
# Create IPv6 advanced ACL rules to permit inbound and outbound SNMP and SNMP trap packets.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3003
[Sysname-acl-ipv6-adv-3003] rule permit udp source-port eq snmp
[Sysname-acl-ipv6-adv-3003] rule permit udp source-port eq snmptrap
[Sysname-acl-ipv6-adv-3003] rule permit udp destination-port eq snmp
[Sysname-acl-ipv6-adv-3003] rule permit udp destination-port eq snmptrap
# Create IPv6 advanced ACL 3004, and configure two rules: one permits packets with the
Hop-by-Hop Options header type as 5, and the other one denies packets with other Hop-by-Hop
Options header types.
<Sysname> system-view
[Sysname] acl ipv6 advanced 3004
[Sysname-acl-ipv6-adv-3004] rule permit ipv6 hop-by-hop type 5
[Sysname-acl-ipv6-adv-3004] rule deny ipv6 hop-by-hop
Related commands acl acl logging interval display acl step time-range
rule (IPv6 basic ACL view)
Use rule to create or edit an IPv6 basic ACL rule.
Use undo rule to delete an entire IPv6 basic ACL rule or some attributes in the rule.
47
Syntax rule [ rule-id ] { deny | permit } [ counting | fragment | [ flow-logging | logging ] | routing [ type routing-type ] | source { object-group address-group-name | source-address source-prefix | source-address / source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] * undo rule rule-id [ counting | fragment | [ flow-logging | logging ] | routing
| source | time-range | vpn-instance ] * undo rule { deny | permit } [ counting | fragment | [ flow-logging | logging ]
| routing [ type routing-type ] | source { object-group address-group-name | source-address source-prefix | source-address / source-prefix | any } | time-range time-range-name | vpn-instance vpn-instance-name ] *
Default
No IPv6 basic ACL rules exist.
Views
IPv6 basic ACL view
Predefined user roles network-admin mdc-admin
Parameters rule-id : Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30. deny : Denies matching packets. permit : Allows matching packets to pass. counting : Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software. fragment : Applies the rule only to non-first fragments. If you do not specify this keyword, the rule applies to both fragments and non-fragments. flow-logging : Logs matching packets on a per-flow basis. The log information includes the number of matching packets, and the source IP address, destination IP address, source port number, and destination port number of the matching flow. This feature is available only when the module (for example, packet filtering) that uses the ACL supports the logging feature. The flow-logging keyword is available in Release 2712 and later versions. logging : Logs matching packets. This feature is available only when the application module (for example, packet filtering) that uses the ACL supports the logging feature. routing [ type routing-type ] : Applies the rule to the specified type of IPv6 routing header or all types of IPv6 routing headers. The routing-type argument specifies the value of the IPv6 routing header type, in the range of 0 to 255. If you do not specify the type routing-type option, the rule applies to all types of IPv6 routing headers. source { object-group address-group-name | source-address source-prefix | source-address / source-prefix | any } : Matches a source IPv6 address. The object-group address-group-name option specifies an object group of source IPv6 addresses. The source-address argument specifies a source IPv6 address. The
48
source-prefix argument specifies an address prefix length in the range of 1 to 128. The any keyword represents any IPv6 source address. time-range time-range-name : Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide .
vpn-instance vpn-instance-name : Applies the rule to an MPLS L3VPN instance. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If you do not specify a VPN instance, the rule applies to both non-VPN packets and VPN packets.
Usage guidelines
If an IPv6 basic ACL is used for outbound packet filtering, do not specify the vpn-instance or routing keyword.
If an IPv6 basic ACL is used for QoS traffic classification or packet filtering, do not specify the fragment keyword.
If an IPv6 basic ACL is used for outbound QoS traffic classification or outbound packet filtering:
•
The rule [ rule-id ] { deny | permit } { source { object-group address-group-name | source-address source-prefix | source-address / source-prefix | any } } command can match only Layer 3 forwarded packets, but not packets processed by the CPU or Layer 2 forwarded packets.
•
Any other IPv6 basic ACL rule can match packets processed by the CPU, Layer 2 forwarded packets, and Layer 3 forwarded packets.
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
You can edit ACL rules only when the match order is config .
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter ipv6 command enables match counting in hardware for all rules in an ACL.
To view the existing IPv6 basic and advanced ACL rules, use the display acl ipv6 all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for a rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
Examples
# Create an IPv6 basic ACL rule to deny the packets from any source IP subnet but 1001::/16,
3124:1123::/32, or FE80:5060:1001::/48.
<Sysname> system-view
[Sysname] acl ipv6 basic 2000
[Sysname-acl-ipv6-basic-2000] rule permit source 1001:: 16
[Sysname-acl-ipv6-basic-2000] rule permit source 3124:1123:: 32
[Sysname-acl-ipv6-basic-2000] rule permit source fe80:5060:1001:: 48
[Sysname-acl-ipv6-basic-2000] rule deny source any
Related commands acl
49
acl logging interval display acl step time-range
rule (Layer 2 ACL view)
Use rule to create or edit a Layer 2 ACL rule.
Use undo rule to delete an entire Layer 2 ACL rule or some attributes in the rule.
Syntax rule [ rule-id ] { deny | permit } [ cos dot1p | counting | dest-mac dest-address dest-mask | { lsap lsap-type lsap-type-mask | type protocol-type protocol-type-mask } | source-mac source-address source-mask | time-range time-range-name ] * rule [ rule-id ] { deny | permit } vxlan [ counting | dest-mac dest-address dest-mask | inner-dest-mac inner-dest-address inner-dest-mask | inner-source-mac inner-source-address inner-source-mask | inner-type inner-protocol-type inner-protocol-type-mask | source-mac source-address source-mask | time-range time-range-name | type protocol-type protocol-type-mask | vxlan-id vxlan-id ] * undo rule rule-id [ counting | time-range ] * undo rule { deny | permit } [ cos dot1p | counting | dest-mac dest-address dest-mask | { lsap lsap-type lsap-type-mask | type protocol-type protocol-type-mask } | source-mac source-address source-mask | time-range time-range-name ] * undo rule { deny | permit } vxlan [ counting | dest-mac dest-address dest-mask | inner-dest-mac inner-dest-address inner-dest-mask | inner-source-mac inner-source-address inner-source-mask | inner-type inner-protocol-type inner-protocol-type-mask | source-mac source-address source-mask | time-range time-range-name | type protocol-type protocol-type-mask | vxlan-id vxlan-id ] *
Default
No Layer 2 ACL rules exist.
Views
Layer 2 ACL view
Predefined user roles network-admin mdc-admin
Parameters rule-id : Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30. deny : Denies matching packets. permit : Allows matching packets to pass.
50
cos dot1p : Matches an 802.1p priority. The 802.1p priority can be specified by one of the following values:
•
A priority number in the range of 0 to 7.
•
A priority name: best-effort (0), background (1), spare (2), excellent-effort (3), controlled-load (4), video (5), voice (6), or network-management (7). counting : Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software. dest-mac dest-address dest-mask : Matches a destination MAC address range. The dest-address and dest-mask arguments represent a destination MAC address and mask in the H-H-H format. To use this criterion to match packets in the outbound direction, specify the destination MAC address of the original packets.
lsap lsap-type lsap-type-mask : Matches the DSAP and SSAP fields in LLC encapsulation.
The lsap-type argument is a hexadecimal number that represents the encapsulation format. The value range for the lsap-type argument is 0 to ffff. The lsap-type-mask argument is a hexadecimal number that represents the LSAP mask. The value range for the lsap-type-mask argument is 0 to ffff. type protocol-type protocol-type-mask : Matches one or more protocols in the Layer 2.
The protocol-type argument is a hexadecimal number that represents a protocol type in
Ethernet_II and Ethernet_SNAP frames. The value range for the protocol-type argument is 0 to ffff. The protocol-type-mask argument is a hexadecimal number that represents a protocol type mask. The value range for the protocol-type-mask argument is 0 to ffff. source-mac source-address source-mask : Matches a source MAC address range. The source-address argument represents a source MAC address, and the sour-mask argument represents a mask in the H-H-H format. To use this criterion to match packets in the outbound direction, specify the source MAC address of the original packets. time-range time-range-name : Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide . vxlan : Specifies VXLAN encapsulation. vxlan-id vxlan-id : Specifies a VXLAN ID in the range of 0 to 16777215. inner-type inner-protocol-type inner-protocol-type-mask : Matches inner link layer protocols. The inner-protocol-type argument is a 16-bit hexadecimal number that represents a protocol type in inner Ethernet_II and Ethernet_SNAP frames. The protocol-type-mask argument is a 16-bit hexadecimal number that represents a protocol type mask. inner-source-mac inner-source-address inner-source-mask : Matches an inner source MAC address range. The inner-source-address argument represents an inner source
MAC address in the H-H-H format and the inner-source-mask argument represents a mask in the H-H-H format. inner-dest-mac inner-dest-address inner-dest-mask : Matches an inner destination
MAC address range. The inner-dest-address and inner-dest-mask arguments represent an inner destination MAC address and a mask in the H-H-H format.
Usage guidelines
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
51
You can edit ACL rules only when the match order is config .
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL.
To view the existing Layer 2 ACL rules, use the display acl mac all command.
The undo rule rule-id command without any optional parameters deletes an entire rule. If you specify optional parameters, the undo rule rule-id command deletes the specified attributes for the rule.
The undo rule { deny | permit } command can only be used to delete an entire rule. You must specify all the attributes of the rule for the command.
Examples
# Create a rule in Layer 2 ACL 4000 to permit ARP packets and deny RARP packets.
<Sysname> system-view
[Sysname] acl mac 4000
[Sysname-acl-mac-4000] rule permit type 0806 ffff
[Sysname-acl-mac-4000] rule deny type 8035 ffff
# Create a rule in Layer 2 ACL 4001 to permit VXLAN packets whose VXLAN ID is 300.
<Sysname> system-view
[Sysname] acl mac 4001
[Sysname-acl-mac-4001] rule permit vxlan vxlan-id 300
Related commands acl display acl step time-range
rule (user-defined ACL view)
Use rule to create or edit a user-defined ACL rule.
Use undo rule to delete a user-defined ACL rule.
Syntax rule [ rule-id ] { deny | permit } [ { l2 rule-string rule-mask offset }&<1-8> ]
[ counting | time-range time-range-name ] * undo rule rule-id undo rule { deny | permit } [ { l2 rule-string rule-mask offset }&<1-8> ]
[ counting | time-range time-range-name ] *
Default
No user-defined ACL rules exist.
Views
User-defined ACL view
Predefined user roles network-admin mdc-admin
52
Parameters rule-id : Specifies a rule ID in the range of 0 to 65534. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from 0. The numbering step for user-defined ACLs is fixed at 5. For example, if the rule numbering step is 5 and the current highest rule ID is 28, the rule is numbered 30. deny : Denies matching packets. permit : Allows matching packets to pass. l2 : Specifies that the offset is relative to the beginning of the Layer 2 frame header.
rule-string : Defines a match pattern in hexadecimal format. Its length must be a multiple of two. rule-mask : Defines a match pattern mask in hexadecimal format. Its length must be the same as that of the match pattern. A match pattern mask is used for ANDing the selected string of a packet. offset : Specifies an offset in bytes after which the match operation begins.
&<1-8> : Specifies that up to eight match patterns can be defined in the ACL rule. counting : Enables rule match counting in software. If you do not specify this keyword, matches for the rule are not counted in software. time-range time-range-name : Specifies a time range for the rule. The time-range-name argument is a case-insensitive string of 1 to 32 characters. It must start with an English letter. If the time range is not configured, the system creates the rule. However, the rule using the time range can take effect only after you configure the time range. For more information about time range, see ACL and QoS Configuration Guide .
Usage guidelines
Within an ACL, the permit or deny statement of each rule must be unique. If the rule you are creating or editing has the same deny or permit statement as another rule in the ACL, the rule will not be created or changed.
The counting keyword in this command enables match counting specific to rules, and the hardware-count keyword in the packet-filter command enables match counting in hardware for all rules in an ACL.
To view the existing user-defined ACL rules, use the display acl user-defined all command.
Both the undo rule rule-id command and the undo rule { deny | permit } command delete an entire rule. When you use the undo rule { deny | permit } command, you must specify all the attributes of the rule.
Examples
# Create a rule for user-defined ACL 5005 to permit ARP packets where the 12th and 13th bytes starting from the Layer 2 header are 0x0806.
<Sysname> system-view
[Sysname] acl user-defined 5005
[Sysname-acl-user-5005] rule permit l2 0806 ffff 12
Related commands acl display acl time-range
53
rule comment
Use rule comment to configure a comment for an ACL rule.
Use undo rule comment to delete an ACL rule comment.
Syntax rule rule-id comment text undo rule rule-id comment
Default
A rule does not have a comment.
Views
IPv4 basic/advanced ACL view
IPv6 basic/advanced ACL view
Layer 2 ACL view
User-defined ACL view
Predefined user roles network-admin mdc-admin
Parameters rule-id : Specifies an ACL rule ID in the range of 0 to 65534. The ACL rule must already exist. text : Specifies a comment about the ACL rule, a case-sensitive string of 1 to 127 characters.
Usage guidelines
This command adds a comment to a rule if the rule does not have a comment. It modifies the comment for a rule if the rule already has a comment.
Examples
# Create a rule for IPv4 basic ACL 2000, and add a comment about the rule.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] rule 0 deny source 1.1.1.1 0
[Sysname-acl-ipv4-basic-2000] rule 0 comment This rule is used on fortygige 1/0/1.
Related commands display acl
step
Use step to set a rule numbering step for an ACL.
Use undo step to restore the default.
Syntax step step-value [ start start-value ] undo step
54
Default
The rule numbering step is 5, and the start rule ID is 0.
Views
IPv4 basic/advanced ACL view
IPv6 basic/advanced ACL view
Layer 2 ACL view
Predefined user roles network-admin mdc-admin
Parameters step-value : Specifies the ACL rule numbering step in the range of 1 to 20.
start start-value : Specifies the start rule ID in the range of 0 to 20.
Usage guidelines
The rule numbering step sets the increment by which the system numbers rules automatically. If you do not specify a rule ID when creating an ACL rule, the system automatically assigns it a rule ID. This rule ID is the nearest higher multiple of the numbering step to the current highest rule ID, starting from the start rule ID. For example, if the rule numbering step is 5 and the current highest rule ID is
12, the rule is numbered 15.
The wider the numbering step, the more rules you can insert between two rules. Whenever the step or start rule ID changes, the rules are renumbered, starting from the start rule ID. For example, if there are five rules numbered 0, 5, 9, 10, and 15, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4, 6, and 8.
Examples
# Set the rule numbering step to 2 for IPv4 basic ACL 2000.
<Sysname> system-view
[Sysname] acl basic 2000
[Sysname-acl-ipv4-basic-2000] step 2
Related commands display acl
55
QoS policy commands
The device supports three QoS policy types: accounting, marking, and generic. Unless otherwise noted, the term "QoS policy" refers to generic QoS policy.
Traffic class commands description
Use description to configure a description for a traffic class.
Use undo description to restore the default.
Syntax description text undo description
Default
No description is configured for a traffic class.
Views
Traffic class view
Predefined user roles network-admin mdc-admin
Parameters text : Specifies a description, a case-sensitive string of 1 to 127 characters.
Usage guidelines
If you execute this command multiple times, the most recent configuration takes effect.
Examples
# Configure the description as classifier for traffic class class1 .
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] description classifier
display traffic classifier
Use display traffic classifier to display traffic classes.
Syntax
In standalone mode: display traffic classifier user-defined [ classifier-name ] [ slot slot-number ]
In IRF mode: display traffic classifier user-defined [ classifier-name ] [ chassis chassis-number slot slot-number ]
56
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters user-defined : Specifies user-defined traffic classes. classifier-name : Specifies a traffic class by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a traffic class, this command displays all traffic classes. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays the traffic classes for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays the traffic classes for the global active MPU. (In IRF mode.)
Examples
# Display all user-defined traffic classes.
<Sysname> display traffic classifier user-defined
User-defined classifier information:
Classifier: 1 (ID 100)
Operator: AND
Rule(s) :
If-match acl 2000
Classifier: 2 (ID 101)
Operator: AND
Rule(s) :
If-match protocol ipv6
Classifier: 3 (ID 102)
Operator: AND
Rule(s) :
-none-
Table 18 Command output
Field Description
Classifier Traffic class name and its match criteria.
Operator
Match operator you set for the traffic class. If the operator is AND, the traffic class matches the packets that match all its match criteria. If the operator is OR, the traffic class matches the packets that match any of its match criteria.
57
if-match
Use if-match to define a match criterion.
Use undo if-match to delete a match criterion.
Syntax
if-match match-criteria undo if-match match-criteria
Default
No match criterion is configured.
Views
Traffic class view
Predefined user roles network-admin mdc-admin
Parameters match-criteria : Specifies a match criterion.
Table 19 shows the available match criteria.
Table 19 Available match criteria
Option Description acl
{
[
[ ipv6 inner ]
| mac | user-defined
acl-number | name acl-name }
]
Matches an ACL.
The value range for the acl-number argument is as follows:
•
2000 to 3999 for IPv4 ACLs.
•
2000 to 3999 for IPv6 ACLs.
•
4000 to 4999 for Layer 2 MAC ACLs.
•
5000 to 5999 for user-defined ACLs.
The acl-name argument is a case-insensitive string of 1 to 63 characters, which must start with an English letter. To avoid confusion, make sure the argument is not all .
You can use the inner keyword to match the inner header information of VXLAN packets. For example, a rule permit ip source 10.0.0.0 0.255.255.255
statement matches the inner source IP address of VXLAN packets if the inner keyword is specified in the if-match acl command. The statement matches the source IP address of non-VXLAN packets or the outer source IP address of VXLAN packets if the inner keyword is not specified.
If you specify the inner keyword in the if-match acl command, you must also specify it when executing the undo if-match acl command. any control-plane protocol protocol-name &<1-8>
Matches all packets.
Matches control plane protocols.
The protocol-name &<1-8> argument specifies a space-separated list of up to eight system-defined control plane protocols. For available system-defined control plane
58
Option Description
Matches a control plane protocol group. control-plane protocol-group
protocol-group-name
The protocol-group-name argument can be critical , important , management , monitor , normal , or redirect . destination-mac dscp dscp-value
mac-address
&<1-8>
Matches a destination MAC address.
This option takes effect only on Ethernet interfaces.
Matches DSCP values.
The dscp-value &<1-8> argument specifies a space-separated list of up to eight DSCP values. The value range for the dscp-value argument is 0 to 63 or
forwarding-layer route Matches Layer 3 forwarded packets. ip-precedence mpls-exp ip-precedence-value exp-value
&<1-8>
&<1-8>
Matches IP precedence values.
The ip-precedence-value &<1-8> argument specifies a space-separated list of up to eight IP precedence values. The value range for the ip-precedence-value argument is 0 to 7.
Matches MPLS EXP values.
The exp-value &<1-8> argument specifies a space-separated list of up to eight EXP values. The value range for the exp-value argument is 0 to 7. mpls-label { label-value &<1-8>
| label-value1 to label-value2 }
Matches MPLS labels.
The label-value &<1-8> argument specifies a space-separated list of up to eight MPLS label values. The label-value1 to label-value2 option specifies a range of MPLS label values. The value for label-value2 must be greater than or equal to the value for label-value1 .
The value range for the label-value argument is 0 to 1048575. mpls { l2vpn | l3vpn protocol
}
protocol-name
Matches the MPLS VPN type:
• l2vpn —Matches L2VPN packets.
• l3vpn —Matches L3VPN packets.
Matches a protocol.
The protocol-name argument can be ip or ipv6 . qos-local-id local-id-value Matches a local QoS ID in the range of 1 to 4095. second-mpls-exp exp-value &<1-8>
Matches inner MPLS EXP values.
The exp-value &<1-8> argument is a space-separated list of up to eight EXP values. The value range for the exp-value argument is 0 to 7. second-mpls-label
{ label-value &<1-8> | label-value1 to label-value2 }
Matches inner MPLS labels.
The label-value &<1-8> argument specifies a space-separated list of up to eight MPLS label values. The label-value1 to label-value2 option specifies a range of MPLS label values. The value for label-value2 must be greater than or equal to the value for label-value1 . The value range for the label-value argument is 0 to 1048575.
59
Option Description service-dot1p dot1p-value &<1-8 >
Matches 802.1p priority values in outer VLAN tags.
The dot1p-value &<1-8> argument specifies a space-separated list of up to eight 802.1p priority values.
The value range for the dot1p-value argument is 0 to 7. service-vlan-id vlan-id-list
Matches VLAN IDs in outer VLAN tags.
The vlan-id-list argument specifies a space-separated list of up to 10 VLAN items. Each item specifies a VLAN or a range of VLANs in the form of vlan-id1 to vlan-id2 . The value for vlan-id2 must be greater than or equal to the value for vlan-id1 .
The value range for the vlan-id argument is 1 to 4094.
You can use this option to match single-tagged packets. source-mac mac-address traffic-type unknown-unicast multicast }
{ unicast
|
|
broadcast |
Matches a source MAC address.
This option takes effect only on Ethernet interfaces.
Matches the packet type:
• unicast —Matches unicast packets.
• unknown-unicast —Matches unknown unicast packets.
• broadcast —Matches broadcast packets.
• multicast —Matches multicast packets.
For a traffic class to match multiple packet types, you must specify the OR operator when creating the class. vlan-tag single }
{ double | none |
Matches the VLAN tagging mode:
• double —Matches double-tagged packets.
• none —Matches packets with no tags.
• single —Matches single-tagged packets. vxlan { any | vxlan-id } Matches a VXLAN ID.
Table 20 Available system-defined control plane protocols
Protocol Description bgp4+ default dhcp-snooping dhcpv6 dot1x hoplimit-expires
60
IPv6 BGP packets
Protocol packets other than the packet types listed in this table
DHCP snooping packets
IPv6 DHCP packets
802.1X packets (The switch does not support 802.1X in the current software version.)
Hop-limit expire packets
Protocol Description mvrp ospf-multicast ospf-unicast ospf3-multicast ospf3-unicast pim-multicast pim-unicast pim6-multicast pim6-unicast
MVRP packets (including GVRP packets)
OSPF multicast packets
OSPF unicast packets
OSPFv3 multicast packets
OSPFv3 unicast packets
PIM multicast packets
PIM unicast packets
IPv6 PIM multicast packets
IPv6 PIM unicast packets ttl-expires TTL expire packets vrrp6
Usage guidelines
IPv6 VRRP packets
In a traffic class with the logical OR operator, you can configure multiple if match commands for any of the available match criteria.
When you configure a match criterion that can have multiple values in one if-match command, follow these restrictions and guidelines:
•
You can specify up to eight values for any of the following match criteria in one if-match command:
{
{
{
{
{
Control plane protocol.
802.1p priority.
DSCP.
IP precedence.
MPLS EXP.
61
{
MPLS label.
{
VLAN ID.
•
If a packet matches one of the specified values, it matches the if-match command.
•
To delete a criterion that has multiple values, the specified values in the undo if-match command must be the same as those specified in the if-match command. The order of the values can be different.
When you configure ACL-based match criteria, follow these restrictions and guidelines:
•
The ACL must already exist.
•
An ACL can only match the following inner header information of VXLAN packets:
{
{
{
{
Source IP address.
Destination IP address.
Source port number.
Destination port number.
{ Transport protocol type.
•
The ACL is used for classification only and the permit/deny actions in ACL rules are ignored.
Actions taken on matching packets are defined in traffic behaviors.
You can use both AND and OR operators to define the match relationships between the criteria for a class. For example, you can define relationships among three match criteria in traffic class classA as follows: traffic classifier classB operator and if-match criterion 1 if-match criterion 2 traffic classifier classA operator or if-match criterion 3
If a traffic class includes both the control-plane protocol or control-plane protocol-group criterion and other criteria, the QoS policy that contains the traffic class cannot be applied correctly.
If any traffic class in a QoS policy includes the control-plane protocol or control-plane protocol-group match criterion, the QoS policy can be applied only to a control plane.
For the service-vlan-id match criterion, you can configure multiple values in one if-match command.
Examples
# Define a match criterion for traffic class class1 to match the inner packet information of VXLAN packets by using ACL 3000.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match acl 3000 inner
# Define a match criterion for traffic class class1 to match the packets with a destination MAC address of 0050-ba27-bed3.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match destination-mac 0050-ba27-bed3
# Define a match criterion for traffic class class2 to match the packets with a source MAC address of
0050-ba27-bed2.
<Sysname> system-view
[Sysname] traffic classifier class2
62
[Sysname-classifier-class2] if-match source-mac 0050-ba27-bed2
# Define a match criterion for traffic class class1 to match the packets with 802.1p priority 5 in the outer VLAN tag.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match service-dot1p 5
# Define a match criterion for traffic class class1 to match advanced ACL 3101.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match acl 3101
# Define a match criterion for traffic class class1 to match the ACL named flow .
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match acl name flow
# Define a match criterion for traffic class class1 to match advanced IPv6 ACL 3101.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match acl ipv6 3101
# Define a match criterion for traffic class class1 to match the IPv6 ACL named flow .
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match acl ipv6 name flow
# Define a match criterion for traffic class class1 to match all packets.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match any
# Define a match criterion for traffic class class1 to match the packets with a DSCP value of 1, 6, or
9.
<Sysname> system-view
[Sysname] traffic classifier class1 operator or
[Sysname-classifier-class1] if-match dscp 1 6 9
# Define a match criterion for traffic class class1 to match the packets with an IP precedence value of 1 or 6.
<Sysname> system-view
[Sysname] traffic classifier class1 operator or
[Sysname-classifier-class1] if-match ip-precedence 1 6
# Define a match criterion for traffic class class1 to match IP packets.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match protocol ip
# Define a match criterion for traffic class class1 to match the packets with VLAN ID 2, 7, or 10 in the outer VLAN tag.
<Sysname> system-view
[Sysname] traffic classifier class1 operator or
[Sysname-classifier-class1] if-match service-vlan-id 2 7 10
# Define a match criterion for traffic class class1 to match the packets with a local QoS ID of 3.
63
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match qos-local-id 3
# Define a match criterion for traffic class class1 to match packets with MPLS labels in the range of
1 to 10000.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match mpls-label 1 to 10000
# Define a match criterion for traffic class class1 to match MPLS L2VPN packets.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match mpls l2vpn
# Define a match criterion for traffic class class1 to match Layer 2 forwarded packets.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match forwarding-layer bridge
# Define a match criterion for traffic class class1 to match ARP protocol packets.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match control-plane protocol arp
# Define a match criterion for traffic class class1 to match packets of the protocols in protocol group normal .
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match control-plane protocol-group normal
# Define a match criterion for traffic class class1 to match multicast packets.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match traffic-type multicast
# Define a match criterion for traffic class class1 to match double-tagged packets.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match vlan-tag double
# Define a match criterion for traffic class class1 to match the packets with VXLAN 10.
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1] if-match vxlan 10
traffic classifier
Use traffic classifier to create a traffic class and enter its view, or enter the view of an existing traffic class.
Use undo traffic classifier to delete a traffic class.
Syntax traffic classifier classifier-name [ operator { and | or } ] undo traffic classifier classifier-name
64
Default
No traffic classes exist.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters classifier-name : Specifies a name for the traffic class, a case-sensitive string of 1 to 31 characters. operator : Sets the operator to logic AND (the default) or OR for the traffic class. and : Specifies the logic AND operator. The traffic class matches the packets that match all its criteria. or : Specifies the logic OR operator. The traffic class matches the packets that match any of its criteria.
Examples
# Create a traffic class named class1 .
<Sysname> system-view
[Sysname] traffic classifier class1
[Sysname-classifier-class1]
Related commands display traffic classifier
Traffic behavior commands accounting
Use accounting to configure a traffic accounting action in a traffic behavior.
Use undo accounting to restore the default.
Syntax accounting [ byte | packet ] * undo accounting
Default
No traffic accounting action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
65
Parameters byte : Counts traffic in bytes. packet : Counts traffic in packets.
Usage guidelines
The byte and packet keywords can be both configured in Release 2712 and later versions.
If you do not specify the byte or packet keyword, the device counts traffic in packets.
Examples
# Configure a traffic accounting action in traffic behavior database to count traffic in bytes.
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] accounting byte
car
Use car to configure a CAR action in absolute value in a traffic behavior.
Use undo car to restore the default.
Syntax car cir committed-information-rate [ cbs committed-burst-size [ ebs excess-burst-size ] ] car cir committed-information-rate [ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ] undo car
Default
No CAR action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters cir committed-information-rate : Specifies the committed information rate (CIR) in the range of 8 to 160000000 kbps, in increments of 8. cbs committed-burst-size : Specifies the committed burst size (CBS) in bytes. The value range for committed-burst-size is 512 to 256000000, in increments of 512. The default value for this argument is the product of 62.5 and the CIR and must be an integral multiple of 512. When the product is not an integral multiple of 512, it is rounded up to the nearest integral multiple of 512 that is greater than the product. A default value greater than 256000000 is converted to 256000000. ebs excess-burst-size : Specifies the excess burst size (EBS) in bytes. The value range for excess-burst-size is 0 to 256000000, in increments of 512. If the PIR is configured, the default
EBS is the product of 62.5 and the PIR and must be an integral multiple of 512. When the product is not an integral multiple of 512, it is rounded up to the nearest integral multiple of 512. A default value greater than 256000000 is converted to 256000000.
66
pir peak-information-rate : Specifies the peak information rate (PIR) in the range of 8 to
160000000 kbps, in increments of 8.
Usage guidelines
The device supports the following application destinations for traffic policing:
•
Interface.
•
VLANs.
•
Globally.
•
Control plane.
A traffic policing action takes effect only when the QoS policy is applied to the inbound direction.
To use two rates for traffic policing, configure the car command with the pir peak-information-rate option. To use one rate for traffic policing, configure the car command without the pir peak-information-rate option.
If you execute the car command multiple times in the same traffic behavior, the most recent configuration takes effect.
Examples
# Configure a CAR action in traffic behavior database .
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] car cir 200 cbs 51200
display traffic behavior
Use display traffic behavior to display traffic behaviors.
Syntax
In standalone mode: display traffic behavior user-defined [ behavior-name ] [ slot slot-number ]
In IRF mode: display traffic behavior user-defined [ behavior-name ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters user-defined : Specifies user-defined traffic behaviors. behavior-name : Specifies a behavior by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a traffic behavior, this command displays all traffic behaviors. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays traffic behaviors for the active MPU. (In standalone mode.)
67
chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays the traffic behaviors for the global active MPU. (In IRF mode.)
Examples
# Display all user-defined traffic behaviors.
<Sysname> display traffic behavior user-defined
User-defined behavior information:
Behavior: 1 (ID 100)
Marking:
Remark dscp 3
Committed Access Rate:
CIR 112 (kbps), CBS 5120 (Bytes), EBS 512 (Bytes)
Green action : pass
Red action : discard
Table 21 Command output
Field Description
Behavior Name and contents of a traffic behavior.
Marking
Remark dscp
Committed Access Rate
Green action
Red action
Accounting enable
Filter enable
Redirecting
Information about priority marking.
Action of setting the DSCP value for packets.
Information about the CAR action.
Action to take on green packets.
Action to take on red packets.
Class-based accounting action.
Traffic filtering action.
Information about traffic redirecting. none No other traffic behavior is configured.
filter
Use filter to configure a traffic filtering action in a traffic behavior.
Use undo filter to restore the default.
Syntax filter { deny | permit } undo filter
Default
No traffic filtering action is configured.
68
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters deny : Drops packets. permit : Transmits packets.
Examples
# Configure a traffic filtering action as deny in traffic behavior database .
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] filter deny
mac-address mac-learning enable
Use mac-address mac-learning enable to enable MAC address learning for a traffic behavior.
Use undo mac-address mac-learning enable to disable MAC address learning for a traffic behavior.
Syntax mac-address mac-learning enable undo mac-address mac-learning enable
Default
MAC address learning is enabled for a traffic behavior.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Usage guidelines
To prevent the MAC address table from being saturated when the device is experiencing attacks, disable MAC address learning. For example, you can disable MAC address learning to prevent the device from being attacked by a large number of frames with different source MAC addresses.
Disabling MAC address learning in a traffic behavior takes effect only if the QoS policy is applied to the inbound direction of an interface or globally.
Disabling MAC address learning has the following impacts:
•
The device does not learn new MAC addresses of packets that match the QoS policy and therefore cannot update MAC address changes in real time.
•
The device floods packets that do not match an entry in the MAC address table.
As a best practice, configure broadcast storm suppression on the interface that has the QoS policy applied. For information about broadcast storm suppression, see Layer 2—LAN
Switching Configuration Guide .
69
•
The device does not delete existing MAC addresses until the aging timer expires.
To delete the existing MAC addresses, delete them manually or wait for the aging timer to expire.
Examples
# Disable MAC address learning in traffic behavior data .
<Sysname> system-view
[Sysname] traffic behavior data
[Sysname-behavior-data] undo mac-address mac-learning enable
nest top-most
Use nest top-most to configure an outer VLAN tag adding action in a traffic behavior.
Use undo nest top-most to restore the default.
Syntax
nest top-most vlan vlan-id undo nest top-most
Default
No outer VLAN tag adding action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters vlan-id vlan-id : Specifies the VLAN ID to be added in the outer VLAN tag, in the range of 1 to
4094.
Usage guidelines
If a QoS policy contains an outer VLAN tag adding action, apply it only to the incoming traffic of an interface.
If you execute the nest top-most command multiple times in the same traffic behavior, the most recent configuration takes effect.
An outer VLAN tag adding action takes effect only when the QoS policy is applied to the inbound direction of an interface, VLANs, or globally.
This command does not take effect on packets forwarded by a VXLAN overlay network.
Examples
# Configure traffic behavior b1 to add an outer VLAN tag with VLAN ID 123.
<Sysname> system-view
[Sysname] traffic behavior b1
[Sysname-behavior-b1] nest top-most vlan 123
packet-rate
Use packet-rate to configure a protocol packet rate limiting action in a traffic behavior.
70
Use undo packet-rate to restore the default.
Syntax
packet-rate value undo packet-rate
Default
No protocol packet rate limiting action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters value : Specifies the protocol packet rate in pps. The value range for this argument is 1 to 1048575.
The device converts the specified value to the nearest integral multiple of 43 that is not 0.
Usage guidelines
Protocol packet rate limiting can protect the CPU against protocol packet attacks.
If you execute the packet-rate command multiple times in the same traffic behavior, the most recent configuration takes effect.
Examples
# Configure traffic behavior copp to rate limit the protocol packets sent to the CPU to 1600 pps.
<Sysname> system-view
[Sysname] traffic behavior copp
[Sysname-behavior-copp] packet-rate 1600
redirect
Use redirect to configure a traffic redirecting action in a traffic behavior.
Use undo redirect to restore the default.
Syntax redirect { cpu | interface interface-type interface-number } undo redirect { cpu | interface interface-type interface-number }
Default
No traffic redirecting action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters cpu : Redirects traffic to the CPU.
71
interface interface-type interface-number : Redirects traffic to an interface specified by its type and number.
Usage guidelines
If you execute the redirect command multiple times in the same traffic behavior, the most recent configuration takes effect.
Examples
# Configure redirecting traffic to FortyGigE 1/0/1 in traffic behavior database .
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] redirect interface fortygige 1/0/1
Related commands classifier behavior qos policy traffic behavior
remark dot1p
Use remark dot1p to configure an 802.1p priority marking action in a traffic behavior.
Use undo remark dot1p to restore the default.
Syntax remark dot1p dot1p-value undo remark dot1p
Default
No 802.1p priority marking action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters dot1p-value : Specifies the 802.1p priority to be marked for packets, in the range of 0 to 7.
Usage guidelines
For the remark dot1p command in a QoS policy to take effect, you must configure the dot1p-trust-tc command.
If you execute the remark dot1p command multiple times, the most recent configuration takes effect.
Examples
# Configure traffic behavior database to mark matching traffic with 802.1p 2.
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] remark dot1p 2
72
Related commands dot1p-trust-tc
remark drop-precedence
Use remark drop-precedence to configure a drop priority marking action in a traffic behavior.
Use undo remark drop-precedence to restore the default.
Syntax remark drop-precedence drop-precedence-value undo remark drop-precedence
Default
No drop priority marking action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters drop-precedence-value : Specifies the drop priority to be marked for packets, in the range of 0 to 2.
Usage guidelines
A drop priority marking action takes effect only when the QoS policy is applied to the inbound direction.
If you execute the remark drop-precedence command multiple times in the same traffic behavior, the most recent configuration takes effect.
Examples
# Configure traffic behavior database to mark matching traffic with drop priority 2.
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] remark drop-precedence 2
remark dscp
Use remark dscp to configure a DSCP marking action in a traffic behavior.
Use undo remark dscp to restore the default.
Syntax remark dscp dscp-value undo remark dscp
Default
No DSCP marking action is configured.
73
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters dscp-value
: Specifies a DSCP value, which can be a number from 0 to 63 or a keyword in Table
Table 22 DSCP keywords and values
Keyword DSCP value (binary) DSCP value (decimal) default 000000 0
Usage guidelines
When you apply QoS policies in the outbound direction to mark DSCP values for packets, follow these restrictions and guidelines:
•
When QoS policies are applied in the outbound direction of interfaces, up to two remark dscp dscp-value commands can be applied on one chip. For the mappings between chips and interfaces, execute the debug port mapping command in probe view. The Unit field in the command output displays the chip number of an interface.
74
•
When QoS policies are applied globally in the outbound direction, up to two remark dscp dscp-value commands can be applied.
Examples
# Configure traffic behavior database to mark matching traffic with DSCP 6.
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] remark dscp 6
remark local-precedence
Use remark local-precedence to configure a local precedence marking action in a traffic behavior.
Use undo remark local-precedence to restore the default.
Syntax remark local-precedence local-precedence-value undo remark local-precedence
Default
No local precedence marking action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters local-precedence-value : Specifies the local precedence to be marked for packets, in the range of 0 to 7.
Usage guidelines
A local precedence marking action takes effect only when the QoS policy is applied to the inbound direction.
Examples
# Configure traffic behavior database to mark matching traffic with local precedence 2.
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] remark local-precedence 2
remark qos-local-id
Use remark qos-local-id to configure a local QoS ID marking action in a traffic behavior.
Use undo remark qos-local-id to restore the default.
Syntax
remark qos-local-id local-id-value undo remark qos-local-id
75
Default
No local QoS ID marking action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters local-id-value : Specifies the local QoS ID to be marked for packets. The value range for this argument varies by hardware.
•
The value range is 1 to 200 on the HPE FlexFabric 12900E H card series.
•
The value range is 1 to 4095 on the following hardware:
{
The HPE FlexFabric 12900 switch series.
{
{
The HPE FlexFabric 7900 switch series.
The HPE FlexFabric 12900E F card series.
Usage guidelines
You can use one QoS policy to mark the local QoS ID for packets in the inbound direction. Then, you can use another QoS policy to apply other QoS features in the outbound direction based on the marked local QoS ID.
If you execute the remark qos-local-id command multiple times in the same traffic behavior, the most recent configuration takes effect.
Examples
# Configure the action of marking packets with local QoS ID 2.
<Sysname> system-view
[Sysname] traffic behavior database
[Sysname-behavior-database] remark qos-local-id 2
remark service-class
Use remark service-class to configure an MPLS TE service class marking action in a traffic behavior.
Use undo remark service-class to restore the default.
Syntax
remark service-class service-class-value undo remark service-class
Default
No MPLS TE service class marking action is configured.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
76
Parameters service-class-value : Specifies the MPLS TE service class to be marked for packets. The value range for this argument is 0 to 6.
Usage guidelines
This command is used only in CBTS to mark the MPLS TE service class for packets. For more information about CBTS, see MPLS TE in MPLS Configuration Guide .
You can use the mpls te service-class command to set an MPLS TE service class value for a tunnel. For more information about this command, see MPLS TE commands in MPLS Command
Reference .
A QoS policy that contains the remark service-class command can only be applied globally.
If you execute the remark service-class command multiple times in the same traffic behavior, the most recent configuration takes effect.
For an HF card, if the TCAM operating mode is mixed, the traffic class associated with the MPLS TE service class marking action can match packets by using the following criteria:
•
Source IP address.
•
Destination IP address.
•
Source MAC address.
•
Destination MAC address.
•
Port number.
•
DSCP value.
If the TCAM operating mode is not mixed, the traffic class can match packets by using only the DSCP value.
For a card other than HF, the traffic class associated with the MPLS TE service class marking action can match packets by using only the DSCP value.
For information about TCAM operating modes, see device management in Fundamentals
Configuration Guide .
Examples
# Configure the action of marking MPLS TE service class 2 for packets.
<Sysname> system-view
[Sysname] traffic behavior data
[Sysname-behavior-data] remark service-class 2
remark service-vlan-id
Syntax remark service-vlan-id vlan-id undo remark service-vlan-id
Default
Use remark service-vlan-id to configure an SVLAN marking action in a traffic behavior.
Use undo remark service-vlan-id to restore the default.
No SVLAN marking action is configured.
Views
Traffic behavior view
77
Predefined user roles network-admin mdc-admin
Parameters vlan-id : Specifies an SVLAN ID in the range of 1 to 4094.
Examples
# Configure traffic behavior b1 to mark matching packets with SVLAN 222.
<Sysname> system-view
[Sysname] traffic behavior b1
[Sysname-behavior-b1] remark service-vlan-id 222
traffic behavior
Use traffic behavior to create a traffic behavior and enter its view, or enter the view of an existing traffic behavior.
Use undo traffic behavior to delete a traffic behavior.
Syntax traffic behavior behavior-name undo traffic behavior behavior-name
Default
No traffic behaviors exist.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters behavior-name : Specifies a name for the traffic behavior, a case-sensitive string of 1 to 31 characters.
Examples
# Create a traffic behavior named behavior1 .
<Sysname> system-view
[Sysname] traffic behavior behavior1
[Sysname-behavior-behavior1]
Related commands display traffic behavior
QoS policy commands classifier behavior
Use classifier behavior to associate a traffic behavior with a traffic class in a QoS policy.
78
Use undo classifier to delete a class-behavior association from a QoS policy.
Syntax classifier classifier-name behavior behavior-name [ mode { dcbx | qppb-manipulation } | insert-before before-classifier-name ]
undo classifier classifier-name
Default
No traffic behavior is associated with a traffic class.
Views
QoS policy view
Predefined user roles network-admin mdc-admin
Parameters classifier-name : Specifies a traffic class by its name, a case-sensitive string of 1 to 31 characters. behavior-name : Specifies a traffic behavior by its name, a case-sensitive string of 1 to 31 characters. mode dcbx : Specifies that the class-behavior association applies only to the DCBX. For more information about DCBX, see Layer 2—LAN Switching Configuration Guide . mode qppb-manipulation : Specifies that the class-behavior association applies only to QPPB.
The if-match qos-local-id command in the class sets the same local QoS ID as the apply qos-local-id command in the BGP routing policy. For more information about routing policies, see Layer 3—IP Routing Configuration Guide . insert-before before-classifier-name : Inserts the new traffic class before an existing traffic class in the QoS policy. The before-classifier-name argument specifies an existing traffic class by its name, a case-sensitive string of 1 to 31 characters. If you do not specify the insert-before before-classifier-name option, the new traffic class is placed at the end of the QoS policy.
Usage guidelines
A traffic class can be associated only with one traffic behavior in a QoS policy.
If the specified traffic class or traffic behavior does not exist, the system defines a null traffic class or traffic behavior.
Examples
# Associate traffic class database with traffic behavior test in QoS policy user1 .
<Sysname> system-view
[Sysname] qos policy user1
[Sysname-qospolicy-user1] classifier database behavior test
# Associate traffic class database with traffic behavior test in QoS policy user1 , and specify that the class-behavior association applies only to QPPB.
<Sysname> system-view
[Sysname] qos policy user1
[Sysname-qospolicy-user1] classifier database behavior test mode qppb-manipulation
# Associate traffic class database with traffic behavior test in QoS policy user1 , and insert traffic class database before an existing traffic class named class-a .
79
<Sysname> system-view
[Sysname] qos policy user1
[Sysname-qospolicy-user1] classifier database behavior test insert-before class-a
Related commands qos policy
control-plane
Use control-plane to enter control plane view.
Syntax
In standalone mode: control-plane slot slot-number
In IRF mode: control-plane chassis chassis-number slot slot-number
Views
System view
Predefined user roles network-admin mdc-admin
Parameters slot slot-number : Specifies a card by its slot number. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. (In IRF mode.)
Usage guidelines
A QoS policy applied in control plane view takes effect on all packets to the control plane except the packets sent from the management interface.
Examples
# (In standalone mode.) Enter the control plane view of slot 3.
<Sysname> system-view
[Sysname] control-plane slot 3
[Sysname-cp-slot3]
display qos policy
Use display qos policy to display QoS policies.
Syntax
In standalone mode: display qos policy user-defined [ accounting | remarking ] [ policy-name
[ classifier classifier-name ] ] [ slot slot-number ]
In IRF mode:
80
display qos policy user-defined [ accounting | remarking ] [ policy-name
[ classifier classifier-name ] ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters user-defined : Specifies user-defined QoS policies. accounting : Specifies accounting-type QoS policies. remarking : Specifies marking-type QoS policies. policy-name : Specifies a QoS policy by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a QoS policy, this command displays all user-defined QoS policies. classifier classifier-name : Specifies a traffic class by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a traffic class, this command displays all traffic classes. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays the QoS policies for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays the QoS policies for the global active MPU. (In IRF mode.)
Usage guidelines
If you do not specify the accounting or remarking keyword, this command displays generic
QoS policies.
Examples
# Display all user-defined generic QoS policies.
<Sysname> display qos policy user-defined
User-defined QoS policy information:
Policy: 1 (ID 100)
Classifier: 1 (ID 100)
Behavior: 1
Marking:
Remark dscp 3
Committed Access Rate:
CIR 112 (kbps), CBS 51200 (Bytes), EBS 512 (Bytes)
Green action : pass
Red action : discard
Classifier: 2 (ID 101)
Behavior: 2
81
Accounting enable: Packet
Filter enable: Permit
Marking:
Remark dot1p 4
Classifier: 3 (ID 102)
Behavior: 3
-none-
# Display user-defined accounting-type QoS policies.
<Sysname> display qos policy user-defined accounting
User-defined QoS policy information:
Accounting policy: 1 (ID 100)
Classifier: 1 (ID 100)
Behavior: 1
Accounting enable: Packet
# Display user-defined marking-type QoS policies.
<Sysname> display qos policy user-defined remarking
User-defined QoS policy information:
Marking policy: 1 (ID 100)
Classifier: 1 (ID 100)
Behavior: 1
Marking:
Remark dscp 3
Table 23 Command output
Field Description
User-defined QoS policy information
Information about a user-defined QoS policy.
System-defined QoS policy information
Information about a system-defined QoS policy.
Policy
Accounting policy
User-defined generic QoS policy name.
User-defined accounting-type QoS policy name.
Marking policy User-defined marking-type QoS policy name.
For the description of other fields, see Table 18
display qos policy control-plane
Use display qos policy control-plane to display QoS policies applied to a control plane.
Syntax
In standalone mode: display qos policy control-plane slot slot-number
In IRF mode:
82
display qos policy control-plane chassis chassis-number slot slot-number
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters slot slot-number : Specifies a card by its slot number. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. (In IRF mode.)
Examples
# (In standalone mode.) Display the QoS policy applied to the control plane of slot 1.
<Sysname> display qos policy control-plane slot 1
Control plane slot 1
Direction: Inbound
Policy: 1
Classifier: 1
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: 1
Marking:
Remark dscp 3
Committed Access Rate:
CIR 112 (kbps), CBS 51200 (Bytes), EBS 512 (Bytes)
Green action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Classifier: 2
Operator: AND
Rule(s) :
If-match protocol ipv6
Behavior: 2
Accounting enable:
0 (Packets)
Filter enable: Permit
Marking:
Remark dscp 3
83
Classifier: 3
Operator: AND
Rule(s) :
-none-
Behavior: 3
-none-
Table 24 Command output
Field Description
Direction Direction in which the QoS policy is applied.
For the description of other fields, see Table 18
display qos policy control-plane pre-defined
Use display qos policy control-plane pre-defined to display predefined control plane
QoS policies.
Syntax
In standalone mode: display qos policy control-plane pre-defined [ slot slot-number ]
In IRF mode: display qos policy control-plane pre-defined [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays the predefined control plane QoS policies for all cards. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays predefined control plane QoS policies for all cards. (In IRF mode.)
Examples
# (In standalone mode.) Display the predefined control plane QoS policy of slot 1.
<Sysname> display qos policy control-plane pre-defined slot 1
Pre-defined policy information slot 1
Protocol Priority Bandwidth Group
Default N/A 1024 (pps) N/A
IS-IS 5 2048 (pps) critical
VRRP 6 512 (pps) important
84
OSPF Multicast 5 4096 (pps) critical
OSPF Unicast 5 4096 (pps) critical
PIM Multicast 4 512 (pps) critical
PIM Unicast 4 512 (pps) critical
IGMP 3 512 (pps) important
PIMv6 Multicast 4 256 (pps) critical
PIMv6 Unicast 4 256 (pps) critical
OSPFv3 Unicast 5 2048 (pps) critical
OSPFv3 Multicast 5 2048 (pps) critical
VRRPv6 6 512 (pps) important
ARP 2 2048 (pps) normal
DHCP Snooping 3 384 (pps) redirect
DHCP 3 384 (pps) normal
802.1x 2 512 (pps) important
STP 6 384 (pps) critical
LACP 6 43 (pps) critical
MVRP 3 384 (pps) critical
BGP 4 2048 (pps) critical
ICMP 1 512 (pps) monitor
TTL Expires 3 256 (pps) important
IPOPTION 3 256 (pps) normal
BGPv6 4 2048 (pps) critical
Hop Limit Expires 3 256 (pps) important
IPOPTIONv6 3 256 (pps) normal
LLDP 4 384 (pps) important
DLDP 4 256 (pps) critical
TELNET 1 896 (pps) management
SSH 1 896 (pps) management
TACACS 1 896 (pps) management
RADIUS 1 896 (pps) management
SNMP 1 896 (pps) management
ARP Snooping 3 2048 (pps) redirect
ICMPv6 1 2048 (pps) monitor
DHCPv6 3 384 (pps) normal
BFD 5 2048 (pps) critical
Table 25 Command output
Field Description
Pre-defined control plane policy Contents of the predefined control plane QoS policy.
Default Protocols other than those listed.
Group Protocol group of the protocol.
For descriptions of other fields, see
.
display qos policy global
Use display qos policy global to display QoS policies applied globally.
85
Syntax
In standalone mode: display qos policy global [ slot slot-number ] [ inbound | outbound ]
In IRF mode: display qos policy global [ chassis chassis-number slot slot-number ]
[ inbound | outbound ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters inbound : Specifies the QoS policy applied in the inbound direction. outbound : Specifies the QoS policy applied in the outbound direction. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays global QoS policies for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays global QoS policies for the global active MPU. (In IRF mode.)
Usage guidelines
If you do not specify a direction, this command displays both inbound and outbound global QoS policies.
Examples
# Display QoS policies applied globally.
<Sysname> display qos policy global
Direction: Inbound
Policy: 1
Classifier: 1
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: 1
Marking:
Remark dscp 3
Committed Access Rate:
CIR 112 (kbps), CBS 51200 (Bytes), EBS 512 (Bytes)
Green action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Classifier: 2
86
Operator: AND
Rule(s) :
If-match protocol ipv6
Behavior: 2
Accounting enable:
0 (Packets)
Filter enable: Permit
Marking:
Remark dscp 3
Classifier: 3
Operator: AND
Rule(s) :
-none-
Behavior: 3
-none-
Table 26 Command output
Field Description
Direction Direction in which the QoS policy is applied.
Green packets Statistics about green packets.
Red packets Statistics about red packets.
For the description of other fields, see Table 18
display qos policy interface
Use display qos policy interface to display the QoS policies applied to interfaces.
Syntax
In standalone mode: display qos [ accounting | remarking ] policy interface [ interface-type interface-number ] [ slot slot-number ] [ inbound | outbound ]
In IRF mode: display qos [ accounting | remarking ] policy interface [ interface-type interface-number ] [ chassis chassis-number slot slot-number ] [ inbound | outbound ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters accounting : Specifies accounting-type QoS policies.
87
remarking : Specifies marking-type QoS policies.
interface-type interface-number : Specifies an interface by its type and number. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays QoS policies on the active MPU. Only logical interfaces support this option. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays QoS policies on the global active MPU. Only logical interfaces support this option.
(In IRF mode.) inbound : Specifies the QoS policy applied to incoming traffic. outbound : Specifies the QoS policy applied to outgoing traffic.
Usage guidelines
If you do not specify the accounting or remarking keyword, this command displays generic
QoS policies applied.
If you do not specify a direction, this command displays the QoS policy applied to incoming traffic and the QoS policy applied to outgoing traffic.
Examples
# Display the generic QoS policy applied to the incoming traffic of FortyGigE 1/0/1.
<Sysname> display qos policy interface fortygige 1/0/1 inbound
Interface: FortyGigE1/0/1
Direction: Inbound
Policy: 1
Classifier: 1
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: 1
Marking:
Remark dscp 3
Committed Access Rate:
CIR 112 (kbps), CBS 51200 (Bytes), EBS 512 (Bytes)
Green action : pass
Red action : discard
Green packets : 0 (Packets) 0 (Bytes)
Red packets : 0 (Packets) 0 (Bytes)
Classifier: 2
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
88
If-match protocol ipv6
Behavior: 2
Accounting enable:
0 (Packets)
Filter enable: Permit
Marking:
Remark dscp 3
Classifier: 3
Matched : 0 (Packets) 0 (Bytes)
5-minute statistics:
Forwarded: 0/0 (pps/bps)
Dropped : 0/0 (pps/bps)
Operator: AND
Rule(s) :
-none-
Behavior: 3
-none-
# Display information about the accounting-type QoS policy applied to the incoming traffic of
FortyGigE 1/0/1.
<Sysname> display qos accounting policy interface fortygige 1/0/1 inbound
Interface: FortyGigE1/0/1
Direction: Inbound
Accounting Policy: 1
Classifier: 1
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: 1
Accounting enable:
0 (Packets)
# Display information about the marking-type QoS policy applied to the incoming traffic of FortyGigE
1/0/1.
<Sysname> display qos remarking policy interface fortygige 1/0/1 inbound
Interface: FortyGigE1/0/1
Direction: Inbound
Marking policy: 1
Classifier: 1
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: 1
Marking:
Remark dscp 3
# Display the generic QoS policies applied to all interfaces.
<Sysname> display qos policy interface
Interface: FortyGigE1/0/1
Direction: Inbound
Type : Extension
89
Mode : Share
Policy: a
Classifier: a
Operator: AND
Rule(s) :
If-match any
Behavior: a
Mirroring:
Mirror to the interface: FortyGigE1/0/2
Committed Access Rate:
CIR 112 (kbps), CBS 51200 (Bytes), EBS 0 (Bytes)
Green action : pass
Red action : discard
Green packets : 0 (Packets)
Red packets : 0 (Packets)
Interface: FortyGigE1/0/3
Direction: Inbound
Type : Extension
Mode : Share
Policy: a
Classifier: a
Operator: AND
Rule(s) :
If-match any
Behavior: a
Mirroring:
Mirror to the interface: FortyGigE1/0/4
Committed Access Rate:
CIR 112 (kbps), CBS 51200 (Bytes), EBS 0 (Bytes)
Green action : pass
Red action : discard
Green packets : 0 (Packets)
Red packets : 0 (Packets)
Table 27 Command output
Field Description
Direction Direction in which the QoS policy is applied.
Policy
Accounting policy
Marking policy
Type
User-defined generic QoS policy name.
Accounting-type QoS policy name.
Marking-type QoS policy name.
Mode in which the QoS policy is applied to an interface. The value can only be Extension .
If you do not specify the mode when applying a QoS policy to an interface, this field does not appear.
This field is available only on HF cards and FE cards.
90
Field Description
Mode
Sharing mode for QoS and ACL resources.
This field appears only if a QoS policy is applied with the share-mode keyword.
Matched
Forwarded
Dropped
Number of matching packets.
Average rate of successfully forwarded matching packets in a statistics collection period.
Average rate of dropped matching packets in a statistics collection period.
Green packets Traffic statistics for green packets.
Red packets Traffic statistics for red packets.
For the description of other fields, see Table 18
display qos policy l2vpn-ac
Use display qos policy l2vpn-ac to display the QoS policies applied to Ethernet service instances.
Syntax
In standalone mode: display qos policy l2vpn-ac [ interface interface-type interface-number
[ service-instance instance-id ] [ slot slot-number ] ] [ inbound ]
In IRF mode: display qos policy l2vpn-ac [ interface interface-type interface-number
[ service-instance instance-id ] [ chassis chassis-number slot slot-number ] ] [ inbound ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays QoS policies applied to Ethernet service instances on all interfaces.
service-instance instance-id : Specifies an Ethernet service instance by its ID in the range of 1 to 4096. If you do not specify an Ethernet service instance, this command displays QoS policies applied to all Ethernet service instances on an interface. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays QoS policy information for all cards. Only Layer 2 aggregate interfaces support this option.
(In standalone mode.)
91
chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays QoS policy information for all cards. Only Layer 2 aggregate interfaces support this option. (In IRF mode.) inbound : Specifies the QoS policies applied to incoming traffic. If you do not specify this keyword, the command execution results are the same.
Examples
# Display the QoS policy applied to the incoming traffic of Ethernet service instance 1 on FortyGigE
1/0/1.
<Sysname> display qos policy l2vpn-ac interface fortygige 1/0/1 service-instance 1 inbound
Interface: FortyGigE1/0/1 Service instance ID: 1
Direction: Inbound
Policy: p
Classifier: c
Operator: AND
Rule(s) :
If-match any
Behavior: b
Committed Access Rate:
CIR 88 (kbps), CBS 5632 (Bytes), EBS 0 (Bytes)
Green action : pass
Yellow action : pass
Red action : discard
Green packets : 0 (Packets)
Red packets : 0 (Packets)
For the description of fields, see
and
display qos vlan-policy
Use display qos vlan-policy to display QoS policies applied to VLANs.
Syntax
In standalone mode: display qos vlan-policy { name policy-name | vlan [ vlan-id ] } [ slot slot-number ] [ inbound | outbound ]
In IRF mode: display qos vlan-policy { name policy-name | vlan [ vlan-id ] } [ chassis chassis-number slot slot-number ] [ inbound | outbound ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
92
Parameters name policy-name : Specifies a QoS policy by its name, a case-sensitive string of 1 to 31 characters. vlan vlan-id : Specifies a VLAN by its ID in the range of 1 to 4094. inbound : Displays QoS policies applied to incoming traffic. outbound : Displays QoS policies applied to outgoing traffic. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays QoS policies applied to VLANs for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays QoS policies applied to VLANs for the global active MPU. (In IRF mode.)
Usage guidelines
If you do not specify a direction, this command displays QoS policies applied to VLANs in both the inbound and outbound directions.
Examples
# Display QoS policies applied to VLAN 2.
<Sysname> display qos vlan-policy vlan 2
Vlan 2
Direction: Inbound
Policy: 1
Classifier: 1
Operator: AND
Rule(s) :
If-match acl 2000
Behavior: 1
Marking:
Remark dscp 3
Classifier: 2
Operator: AND
Rule(s) :
If-match protocol ipv6
Behavior: 2
Accounting enable:
0 (Packets)
Filter enable: Permit
Marking:
Remark dscp 3
Classifier: 3
Operator: AND
Rule(s) :
-none-
Behavior: 3
-none-
93
Table 28 Command output
Field Description
Direction Direction in which the QoS policy is applied.
For the description of other fields, see Table 18
qos apply policy
Use qos apply policy to apply a QoS policy to an Ethernet service instance, interface, or control plane.
Use undo qos apply policy to remove an applied QoS policy.
Syntax qos apply policy [ accounting | remarking ] policy-name { inbound [ extension ]
| outbound } [ share-mode ] undo qos apply policy [ accounting | remarking ] policy-name { inbound | outbound }
Default
No QoS policy is applied.
Views
Control plane view
Ethernet service instance view
Layer 2 Ethernet interface view
Layer 2 aggregate interface view
Layer 3 Ethernet interface view
Layer 3 aggregate interface view
Layer 3 Ethernet subinterface view
Predefined user roles network-admin mdc-admin
Parameters accounting : Specifies an accounting-type QoS policy. remarking : Specifies a marking-type QoS policy.
policy-name : Specifies a QoS policy by its name, a case-sensitive string of 1 to 31 characters. inbound : Applies the QoS policy to incoming traffic. outbound : Applies the QoS policy to outgoing traffic. This keyword is not supported in Ethernet service instance view or control plane view. extension : Applies the QoS policy in extended mode to a Layer 2 or Layer 3 Ethernet interface.
You can apply a QoS policy to one direction of an interface either with or without the extension keyword, but not both. A QoS policy applied with the extension keyword uses more hardware resources but supports limited parameters than that applied without the extension keyword. This keyword is available only on FE cards and HF cards. Before using this keyword, you must set the
94
TCAM operating mode to acl by using the hardware-resource tcam command. For information about this command, see device management commands in Fundamentals Command Reference . share-mode : Applies the QoS policy in sharing mode to a Layer 2 Ethernet interface, Layer 3
Ethernet interface, or VSI interface. In this mode, all Layer 2 Ethernet interfaces, Layer 3 Ethernet interfaces, or VSI interfaces on an interface card with the same QoS policy applied in one direction share one QoS and ACL resource. For Ethernet interfaces, the device has four QoS and ACL resources that can be shared in each direction separately. For VSI interfaces, the device has three
QoS and ACL resources that can be shared in each direction separately. The device supports the sharing mode for packet filtering, QoS policy, and policy-based routing. Policy-based routing supports the sharing mode only in the inbound direction. If all QoS and ACL resources that can be shared are used, they can be reused after they are released.
Usage guidelines
For configuration commands for Ethernet service instances, see MPLS L2VPN or VPLS in MPLS
Command Reference or see VXLAN Command Reference .
A maximum of three QoS policies (one for each type) can be applied to one direction of an interface.
Different actions can be taken on the same traffic class if QoS policies of different types are applied to an interface.
If you specify the share-mode keyword, all interfaces on an interface module with the QoS policy applied in one direction share one QoS and ACL resource. If the share-mode keyword is not specified, each interface uses one QoS and ACL resource in one direction.
You cannot change the sharing mode dynamically after a QoS policy is applied to an interface. To change the sharing mode for an applied QoS policy, perform the following tasks:
1. Remove the QoS policy from the interface.
2. Reapply the QoS policy with or without the share-mode keyword specified.
A traffic behavior takes effect only on matching Layer 3 packets and does not take effect on matching
Layer 2 packets if the following conditions exist:
•
The associated traffic class contains an IPv4 ACL.
•
The QoS policy is applied to the outbound direction of an interface.
A traffic behavior takes effect only on matching Layer 3 packets and does not take effect on matching
Layer 2 packets if the following conditions exist:
•
The associated traffic class contains an IPv6 ACL.
•
The dscp dscp option is configured in an ACL rule.
•
The QoS policy is applied to the outbound direction of an interface.
A QoS policy cannot be applied to the outbound direction of an interface if the following conditions exist:
•
A traffic class contains an IPv6 ACL.
•
The source IPv6 address and destination IPv6 address match criteria are configured in a rule of the ACL.
Examples
# Apply generic QoS policy USER1 to the outgoing traffic of FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos apply policy USER1 outbound
# Apply accounting-type QoS policy USER1 to the outgoing traffic of FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos apply accounting policy USER1 outbound
95
# Apply marking-type QoS policy aaa to the outgoing traffic of FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos apply remarking policy aaa outbound
# Apply QoS policy aaa to the incoming traffic of the control plane of slot 3.
<Sysname> system-view
[Sysname] control-plane slot 3
[Sysname-cp-slot3] qos apply policy aaa inbound
# Apply QoS policy test to the incoming traffic of Ethernet service instance 200.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] service-instance 200
[Sysname-GigabitEthernet1/0/1-srv200] qos apply policy test inbound
# Apply generic QoS policy aaa in sharing mode to the outgoing traffic of FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1]qos apply policy aaa outbound share-mode
qos apply policy global
Use qos apply policy global to apply a QoS policy globally.
Use undo qos apply policy global to remove a globally applied QoS policy.
Syntax
qos apply policy policy-name global { inbound | outbound }
undo qos apply policy policy-name global { inbound | outbound }
Default
No QoS policy is applied globally.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters policy-name : Specifies a QoS policy by its name, a case-sensitive string of 1 to 31 characters. inbound : Applies the QoS policy to the incoming packets on all interfaces. outbound : Applies the QoS policy to the outgoing packets on all interfaces.
Usage guidelines
A global QoS policy takes effect on all incoming or outgoing traffic depending on the direction in which the QoS policy is applied.
A traffic behavior takes effect only on matching Layer 3 packets and does not take effect on matching
Layer 2 packets if the following conditions exist:
•
The associated traffic class contains an IPv4 ACL.
•
The QoS policy is applied to the outbound direction globally.
96
A traffic behavior takes effect only on matching Layer 3 packets and does not take effect on matching
Layer 2 packets if the following conditions exist:
•
The associated traffic class contains an IPv6 ACL.
•
The dscp dscp option is configured in an ACL rule.
•
The QoS policy is applied to the outbound direction globally.
A QoS policy cannot be applied to the outbound direction globally if the following conditions exist:
•
A traffic class contains an IPv6 ACL.
•
The source IPv6 address and destination IPv6 address match criteria are configured in a rule of the ACL.
Examples
# Globally apply QoS policy user1 to the incoming traffic.
<Sysname> system-view
[Sysname] qos apply policy user1 global inbound
qos policy
Use qos policy to create a QoS policy and enter its view, or enter the view of an existing QoS policy.
Use undo qos policy to delete a QoS policy.
Syntax qos [ accounting | remarking ] policy policy-name undo qos [ accounting | remarking ] policy policy-name
Default
No QoS policies exist.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters policy-name : Specifies a name for the QoS policy, a case-sensitive string of 1 to 31 characters. accounting : Identifies the QoS policy as an accounting-type QoS policy. remarking : Identifies the QoS policy as a marking-type QoS policy.
Usage guidelines
If you do not specify the accounting or remarking keyword when creating a QoS policy, a generic QoS policy is created.
QoS policies of different types cannot use the same policy name.
A generic QoS policy can be applied to all supported destinations and can contain all actions. An accounting-type QoS policy can be applied to only interfaces and can contain only class-based accounting actions. A marking-type QoS policy can be applied to only interfaces and can contain only marking actions.
To delete a QoS policy that has been applied to an object, you must first remove the QoS policy from the object.
97
Examples
# Create a generic QoS policy named user1 .
<Sysname> system-view
[Sysname] qos policy user1
[Sysname-qospolicy-user1]
# Create an accounting-type QoS policy named user2 .
<Sysname> system-view
[Sysname] qos accounting policy user2
[Sysname-qospolicy-user2]
# Create a marking-type QoS policy named user3 .
<Sysname> system-view
[Sysname] qos remarking policy user3
[Sysname-qospolicy-user3]
Related commands classifier behavior qos apply policy qos apply policy global qos vlan-policy
qos vlan-policy
Use qos vlan-policy to apply a QoS policy to the specified VLANs.
Use undo qos vlan-policy to remove a QoS policy from the specified VLANs.
Syntax qos vlan-policy policy-name vlan vlan-id-list { inbound | outbound } undo qos vlan-policy policy-name vlan vlan-id-list { inbound | outbound }
Default
No QoS policy is applied to a VLAN.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters policy-name : Specifies a QoS policy by its name, a case-sensitive string of 1 to 31 characters. vlan vlan-id-list : Specifies a space-separated list of up to eight VLAN IDs or a VLAN ID range in the form of vlan-id1 to vlan-id2 . The value for vlan-id2 must be greater than or equal to the value for vlan-id1 . The value range for the vlan-id argument is 1 to 4094. inbound : Applies the QoS policy to incoming packets. outbound : Applies the QoS policy to outgoing packets.
98
Examples
# Apply QoS policy test to the incoming traffic of VLAN 200, VLAN 300, VLAN 400, and VLAN 500.
<Sysname> system-view
[Sysname] qos vlan-policy test vlan 200 300 400 500 inbound
reset qos policy control-plane
Use reset qos policy control-plane to clear the statistics of the QoS policy applied to a control plane.
Syntax
In standalone mode: reset qos policy control-plane slot slot-number
In IRF mode: reset qos policy control-plane chassis chassis-number slot slot-number
Views
User view
Predefined user roles network-admin mdc-admin
Parameters slot slot-number : Specifies a card by its slot number. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. (In IRF mode.)
Examples
# (In standalone mode.) Clear the statistics of the QoS policy applied to the control plane of slot 1.
<Sysname> reset qos policy control-plane slot 1
reset qos policy global
Use reset qos policy global to clear the statistics of a global QoS policy.
Syntax reset qos policy global [ inbound | outbound ]
Views
User view
Predefined user roles network-admin mdc-admin
Parameters inbound : Clears the statistics of the global QoS policy applied to incoming traffic globally. outbound : Clears the statistics of the global QoS policy applied to outgoing traffic globally.
99
Usage guidelines
If you do not specify a direction, this command clears the statistics of the global QoS policies in both directions.
Examples
# Clear the statistics of the global QoS policy applied to the incoming traffic globally.
<Sysname> reset qos policy global inbound
reset qos vlan-policy
Use reset qos vlan-policy to clear the statistics for QoS policies applied to VLANs.
Syntax reset qos vlan-policy [ vlan vlan-id ] [ inbound | outbound ]
Views
User view
Predefined user roles network-admin mdc-admin
Parameters vlan vlan-id : Specifies a VLAN ID in the range of 1 to 4094. inbound : Specifies the QoS policy applied to incoming traffic. outbound : Specifies the QoS policy applied to outgoing traffic.
Usage guidelines
If you do not specify a direction, this command clears the statistics of the QoS policies in both directions of the VLAN.
Examples
# Clear the statistics of QoS policies applied to VLAN 2.
<Sysname> reset qos vlan-policy vlan 2
100
Priority mapping commands
Priority map commands display qos map-table
Use display qos map-table to display the configuration of priority maps.
Syntax display qos map-table [ dot1p-dp | dot1p-dscp | dot1p-lp | dscp-dot1p | dscp-dp | dscp-dscp | dscp-exp | exp-dot1p | exp-dscp ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters
The device provides the following types of priority map.
Table 29 Priority maps
Priority mapping dot1p-dp
Description
802.1p-drop priority map. dot1p-lp dscp-dot1p dscp-dp
802.1p-local priority map.
DSCP-802.1p priority map.
DSCP-drop priority map. dscp-exp exp-dot1p
DSCP-EXP priority map.
EXP-802.1p priority map. exp-dscp
Usage guidelines
EXP-DSCP priority map.
If you do not specify a priority map, this command displays the configuration of all priority maps.
Examples
# Display the configuration of the 802.1p-local priority map.
<Sysname> display qos map-table dot1p-lp
MAP-TABLE NAME: dot1p-lp TYPE: pre-define
IMPORT : EXPORT
0 : 2
101
1 : 0
2 : 1
3 : 3
4 : 4
5 : 5
6 : 6
7 : 7
Table 30 Command output
Field Description
MAP-TABLE NAME Name of the priority map.
TYPE
IMPORT
Type of the priority map.
Input values of the priority map.
dot1p-trust-tc
Use dot1p-trust-tc to modify the 802.1p priority of outgoing packets to the local precedence value.
Use undo dot1p-trust-tc to restore the default.
Syntax dot1p-trust-tc undo dot1p-trust-tc
Default
The 802.1p priority of outgoing packets is not modified.
Views
System view
Predefined user roles network-admin
Usage guidelines
For the remark dot1p command to take effect, this command must be configured.
After an incoming packet is marked according to the remark dot1p command, it is assigned to a queue according to the default dot1p-lp priority map. The 802.1p priority of the packet is modified as its local precedence value before it is sent out.
If you modify the default dot1p-lp priority map, the outgoing packet is enqueued to a different queue, and its 802.1p priority is modified to a different local precedence value.
Examples
# Modify the 802.1p priority of outgoing packets to the local precedence value.
<Sysname> system-view
[Sysname] dot1p-trust-tc
Related commands remark dot1p
102
import
Use import to configure mappings for a priority map.
Use undo import to restore the specified or all mappings to the default for a priority map.
Syntax import import-value-list export export-value undo import { import-value-list | all }
Default
The default priority maps are used. For more information, see ACL and QoS Configuration Guide .
Views
Priority map view
Predefined user roles network-admin mdc-admin
Parameters import-value-list : Specifies a list of input values. export-value : Specifies the output value. all : Restores all mappings in the priority map to the default.
Examples
# Configure the 802.1p-local priority map to map 802.1p priority values 4 and 5 to local priority 1.
<Sysname> system-view
[Sysname] qos map-table dot1p-lp
[Sysname-maptbl-dot1p-lp] import 4 5 export 1
Related commands display qos map-table
qos map-table
Use qos map-table to enter the specified priority map view.
Syntax qos map-table { dot1p-dp | dot1p-dscp | dot1p-lp | dscp-dot1p | dscp-dp | dscp-dscp | dscp-exp | exp-dot1p | exp-dscp }
Views
System view
Predefined user roles network-admin mdc-admin
Parameters
For the description of the keywords, see Table 29 .
103
Examples
# Enter 802.1p-local priority map view.
<Sysname> system-view
[Sysname] qos map-table dot1p-lp
[Sysname-maptbl-dot1p-lp]
Related commands display qos map-table import
Priority trust mode commands display qos trust interface
Use display qos trust interface to display the priority trust mode and port priorities of an interface.
Syntax display qos trust interface [ interface-type interface-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the priority trust mode and port priorities of all interfaces.
Examples
# Display the priority trust mode and port priority of FortyGigE 1/0/1.
<Sysname> display qos trust interface fortygige 1/0/1
Interface: FortyGigE1/0/1
Port priority trust information
Port priority:4
Port priority trust type: dscp
Table 31 Command output
Field Description
Interface Interface type and interface number.
Port priority Port priority set for the interface.
104
Field Description
Port priority trust type
Priority trust mode on the interface:
• dot1p —Uses the 802.1p priority of received packets for mapping.
• dscp —Uses the DSCP precedence of received IP packets for mapping.
qos trust
Use qos trust to configure the priority trust mode for an interface.
Use undo qos trust to restore the default.
Syntax qos trust { dot1p | dscp } undo qos trust
Default
An interface trusts the 802.1p priority in incoming packets.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters dot1p : Uses the 802.1p priority in incoming packets for priority mapping. dscp : Uses the DSCP value in incoming packets for priority mapping.
Examples
# Set the priority trust mode to 802.1p priority on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos trust dot1p
Related commands display qos trust interface
Port priority commands qos priority
Use qos priority to change the port priority of an interface.
Use undo qos priority to restore the default.
Syntax qos priority [ dscp ] priority-value undo qos priority [ dscp ]
105
Default
The port priority is 0.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters dscp : Specifies a DSCP value in the range of 0 to 63. The dscp keyword is available in Release
2712 and later versions.
priority-value : Specifies a port priority value in the range of 0 to 7.
Examples
# Set the port priority of FortyGigE 1/0/1 to 2.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos priority 2
Related commands display qos trust interface
106
GTS and rate limit commands
GTS commands display qos gts interface
Use display qos gts interface to display the GTS configuration for interfaces.
Syntax display qos gts interface [ interface-type interface-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the GTS configuration for all interfaces.
Examples
# Display the GTS configuration for all interfaces.
<Sysname> display qos gts interface
Interface: FortyGigE1/0/1
Rule: If-match queue 1
CIR 512 (kbps), CBS 51200 (Bytes)
Table 32 Command output
Field Description
Interface Interface name, including the interface type and interface number.
CIR
CBS
CIR in kbps.
CBS in bytes.
qos gts
Use qos gts to set GTS parameters on an interface.
Use undo qos gts to delete the GTS configuration on an interface.
Syntax
qos gts queue queue-id cir committed-information-rate [ cbs committed-burst-size ]
107
undo qos gts queue queue-id
Default
No GTS parameters are configured.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters
queue queue-id : Shapes the packets in a queue specified by its ID. The value range for queue-id is 0 to 7. cir committed-information-rate : Specifies the CIR in kbps. The committed-information-rate argument has the following value ranges:
•
8 to 1000000 for GE interfaces.
•
8 to 10000000 for 10-GE interfaces.
•
8 to 40000000 for 40-GE interfaces.
•
8 to 100000000 for 100-GE interfaces.
The specified value must be an integral multiple of 8.
cbs committed-burst-size : Specifies the CBS in bytes. The value range for committed-burst-size is 512 to 16000000, in increments of 512. The default value for this argument is the product of 62.5 and the CIR and must be an integral multiple of 512. When the product is not an integral multiple of 512, it is rounded up to the nearest integral multiple of 512 that is greater than the product. A default value greater than 16000000 is converted to 16000000.
Usage guidelines
GTS settings take effect only on outbound traffic.
Examples
# Shape the packets in queue 0 on FortyGigE 1/0/1. The GTS parameters are as follows:
•
The CIR is 200 kbps.
•
The CBS is 51200 bytes.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos gts queue 0 cir 200 cbs 51200
Rate limit commands display qos lr interface
Use display qos lr interface to display the rate limit configuration for interfaces.
Syntax display qos lr interface [ interface-type interface-number ]
Views
Any view
108
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the rate limit configuration for all interfaces.
Examples
# Display the rate limit configuration for all interfaces.
<Sysname> display qos lr interface
Interface: FortyGigE1/0/1
Direction: Outbound
CIR 2000 (kbps), CBS 20480 (Bytes)
Table 33 Command output
Field Description
Interface Interface name, including the interface type and interface number.
Direction
CIR
CBS
Direction in which the rate limit configuration is applied.
CIR in kbps.
CBS in bytes.
qos lr
Use qos lr to configure rate limiting on an interface.
Use undo qos lr to delete the rate limit configuration on an interface.
Syntax
qos lr outbound cir committed-information-rate committed-burst-size ] undo qos lr outbound
Default
No rate limit is configured.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters outbound : Limits the rate of outgoing packets.
[ cbs cir committed-information-rate : Specifies the CIR in kbps. The committed-information-rate argument has the following value ranges:
109
•
8 to 1000000 for GE interfaces.
•
8 to 10000000 for 10-GE interfaces.
•
8 to 40000000 for 40-GE interfaces.
•
8 to 100000000 for 100-GE interfaces.
The specified value must be an integral multiple of 8.
cbs committed-burst-size : Specifies the CBS in bytes. The value range for committed-burst-size is 512 to 128000000, in increments of 512. The default value for this argument is the product of 62.5 and the CIR and must be an integral multiple of 512. When the product is not an integral multiple of 512, it is rounded up to the nearest integral multiple of 512 that is greater than the product. A default value greater than 128000000 is converted to 128000000.
Examples
# Limit the rate of outgoing packets on FortyGigE 1/0/1, with CIR 256 kbps and CBS 51200 bytes.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos lr outbound cir 256 cbs 51200
Per-card inbound rate limit level commands pps-level inbound
Use pps-level inbound to set the per-card inbound rate limit level.
Use undo pps-level inbound to restore the default.
Syntax
pps-level inbound level-value undo pps-level inbound
Default
On an HF card, the per-card rate limit level varies by TCAM operating mode:
•
6 for routing mode.
•
1 for ACL mode.
•
0 for mixed mode.
•
1023 for normal mode and IPv6 mode.
On an HB card, the per-card rate limit level is 1023.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters level-value : Specifies a per-card rate limit level in the range of 0 to 1024.
110
Usage guidelines
This command takes effect only for H-series cards. This command modifies the maximum number of incoming packets in Mpps that can be processed by a card and implements rate limiting on a per-card basis.
The maximum number of incoming packets that can be processed by a card is calculated by using he following formula:
720 x (inbound rate limit level + 1)/(2 x (inbound rate limit level + 1) + 4)
For information about setting the TCAM operating mode, see device management commands in
Fundamentals Command Reference .
Examples
# Set the per-card inbound rate limit level to 7.
<Sysname> system-view
[Sysname] pps-level inbound 7
111
Congestion management commands
Common commands display qos queue interface
Use display qos queue interface to display the queuing information for interfaces.
Syntax display qos queue interface [ interface-type interface-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the queuing information for all interfaces.
Examples
# Display the queuing information for all interfaces.
<Sysname> display qos queue interface
Interface: FortyGigE1/0/1
Output queue: Strict Priority queuing
Interface: GigabitEthernet1/0/2
Output queue: Strict Priority queuing
Interface: GigabitEthernet1/0/3
Output queue: Strict Priority queuing
Interface: GigabitEthernet1/0/4
Output queue: Strict Priority queuing
Interface: GigabitEthernet1/0/5
Output queue: Strict Priority queuing
Interface: GigabitEthernet1/0/6
Output queue: Strict Priority queuing
Table 34 Command output
Field Description
Interface Interface name, including the interface type and interface number.
Output queue
Group
Weight
Type of the current output queue.
Number of the group that holds the queue.
Packet-count scheduling weight of the queue. N/A is displayed for a queue that uses the SP scheduling algorithm.
112
Field Description
Byte-count
Byte-count scheduling weight of the queue. N/A is displayed for a queue that uses the SP scheduling algorithm.
SP commands display qos queue sp interface
Use display qos queue sp interface to display the SP queuing configuration of an interface.
Syntax display qos queue sp interface [ interface-type interface-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the SP queuing configuration of all interfaces.
Examples
# Display the SP queuing configuration of FortyGigE 1/0/1.
<Sysname> display qos queue sp interface fortygige 1/0/1
Interface: FortyGigE1/0/1
Output queue: Strict Priority queuing
Table 35 Command output
Field Description
Interface Interface type and interface number.
Output queue Type of the current output queue.
qos sp
Syntax
Use qos sp to enable SP queuing on an interface.
Use undo qos sp to restore the default. qos sp undo qos sp
113
Default
An interface uses SP queuing.
Views
Interface view
Predefined user roles network-admin mdc-admin
Examples
# Enable SP queuing on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos sp
Related commands display qos queue sp interface
WRR commands display qos queue wrr interface
Use display qos queue wrr interface to display the WRR queuing configuration of an interface.
Syntax display qos queue wrr interface [ interface-type interface-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the WRR queuing configuration of all interfaces.
Examples
# Display the WRR queuing configuration of FortyGigE 1/0/1.
<Sysname> display qos queue wrr interface fortygige 1/0/1
Interface: FortyGigE1/0/1
Output queue: Weighted Round Robin queuing
Queue ID Queue name Group Weight
--------------------------------------------------------
0 be 1 1
1 af1 1 1
114
2 af2 1 1
3 af3 1 1
4 af4 1 1
5 ef 1 1
6 cs6 1 1
7 cs7 sp N/A
Table 36 Command output
Field Description
Interface Interface type and interface number.
Output queue
Group
Weight
Byte count
Type of the current output queue.
ID of the group a queue is assigned to.
Packet-count queue scheduling weight of a queue. N/A is displayed for a queue that uses the SP scheduling algorithm.
Byte-count scheduling weight of a queue. N/A is displayed for a queue that uses the SP scheduling algorithm.
qos wrr
Use qos wrr to enable WRR queuing on an interface.
Use undo qos wrr to restore the default.
Syntax qos wrr { byte-count | weight } undo qos wrr { byte-count | weight }
Default
An interface uses SP queuing.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters byte-count : Allocates bandwidth to queues in bytes. weight : Allocates bandwidth to queues in packets.
Usage guidelines
You must use the qos wrr command to enable WRR queuing before you can configure WRR queuing parameters for a queue on an interface.
Examples
# Enable packet-count WRR queuing on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wrr weight
115
# Enable byte-count WRR queuing on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wrr byte-count
Related commands display qos queue wrr interface
qos wrr { byte-count | weight }
Use qos wrr { byte-count | weight } to configure the WRR queuing parameters for a queue on an interface.
Use undo qos wrr to restore the default.
Syntax
qos wrr queue-id group 1 { byte-count | weight } schedule-value
undo qos wrr queue-id
Default
All queues on a WRR-enabled interface are in WRR group 1, and queues 0 through 7 have a weight of 1, 2, 3, 4, 5, 6, 7, and 8, respectively.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7 or keywords in
Table 37 The number-keyword map for the queue-id argument
Number Keyword
0 be
1 af1
2 af2
3 af3
4 af4
5 ef
6 cs6
7 cs7 group 1 : Specifies WRR group 1. Only WRR group 1 is supported in the current software version. byte-count : Allocates bandwidth to queues in bytes. weight : Allocates bandwidth to queues in packets. schedule-value : Specifies a scheduling weight in the range of 1 to 127.
116
Usage guidelines
You must use the qos wrr command to enable WRR queuing before you can configure WRR queuing parameters for a queue on an interface.
Examples
# Enable packet-based WRR queuing on FortyGigE 1/0/1, assign queue 0 to WRR group 1, and specify scheduling weight 10 for queue 0.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wrr weight
[Sysname-FortyGigE1/0/1] qos wrr 0 group 1 weight 10
Related commands display qos queue wrr interface qos wrr
qos wrr group sp
Use qos wrr group sp to assign a queue to the SP group.
Use undo qos wrr group sp to remove a queue from the SP group.
Syntax
qos wrr queue-id group sp
undo qos wrr queue-id
Default
All queues on a WRR-enabled interface are in WRR group 1.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7 or keywords in
Usage guidelines
This command is available only on a WRR-enabled interface. Queues in the SP group are scheduled with SP. The SP group has higher scheduling priority than the WRR groups.
You must use the qos wrr command to enable WRR queuing before you can configure this command on an interface.
Examples
# Enable WRR queuing on FortyGigE 1/0/1, and assign queue 0 to the SP group.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wrr weight
[Sysname-FortyGigE1/0/1] qos wrr 0 group sp
117
Related commands display qos queue wrr interface qos wrr
WFQ commands display qos queue wfq interface
Use display qos queue wfq interface to display the WFQ configuration of an interface.
Syntax display qos queue wfq interface [ interface-type interface-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the WFQ configuration of all interfaces.
Examples
# Display the WFQ configuration of FortyGigE 1/0/1.
<Sysname> display qos wfq interface fortygige 1/0/1
Interface: FortyGigE1/0/1
Output queue: Hardware Weighted Fair Queuing
Queue ID Queue name Group Byte count Min Bandwidth
--------------------------------------------------------------------------------
0 be 1 1 64
1 af1 1 1 64
2 af2 1 1 64
3 af3 1 1 64
4 af4 1 1 64
5 ef 1 1 64
6 cs6 1 1 64
7 cs7 1 1 64
Table 38 Command output
Field Description
Interface Interface type and interface number.
Output queue
Group
Type of the current output queue.
ID of the group that holds the queue.
118
Field Description
Byte-count
Byte-count scheduling weight of the queue. N/A is displayed for a queue that uses the SP scheduling algorithm.
Weight
Packet-count queue scheduling weight of the queue. N/A is displayed for a queue that uses the SP scheduling algorithm.
Min Bandwidth Minimum guaranteed bandwidth for the queue.
qos bandwidth queue
Use qos bandwidth queue to set the minimum guaranteed bandwidth for a queue on an interface.
Use undo qos bandwidth queue to restore the default.
Syntax
qos bandwidth queue queue-id min bandwidth-value
undo qos bandwidth queue queue-id
Default
The minimum guaranteed bandwidth for a queue is 64 kbps.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7 or keywords in
min bandwidth-value : Sets the minimum guaranteed bandwidth in kbps. The bandwidth-value argument has the following value ranges:
•
8 to 1000000 for GE interfaces.
•
8 to 10000000 for 10-GE interfaces.
•
8 to 40000000 for 40-GE interfaces.
•
8 to 100000000 for 100-GE interfaces.
Usage guidelines
The minimum guaranteed bandwidth is the amount of bandwidth guaranteed for a queue when the interface is congested.
You must use the qos wfq command to enable WFQ before you can configure this command on an interface.
If you configure the outbound rate limit on the interface, the actual minimum guaranteed bandwidth will be slightly different from the set value.
Examples
# Set the minimum guaranteed bandwidth to 100 kbps for queue 0 on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
119
[Sysname-FortyGigE1/0/1] qos wfq weight
[Sysname-FortyGigE1/0/1] qos bandwidth queue 0 min 100
Related commands qos wfq
qos wfq
Use qos wfq to enable WFQ on an interface.
Use undo qos wfq to restore the default.
Syntax qos wfq { byte-count | weight } undo qos wfq { byte-count | weight }
Default
An interface uses SP queuing.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters byte-count : Allocates bandwidth to queues in bytes. weight : Allocates bandwidth to queues in packets.
Usage guidelines
You must use the qos wfq command to enable WFQ before you can configure WFQ queuing parameters for a queue on an interface.
Examples
# Enable packet-count WFQ on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wfq weight
# Enable byte-count WFQ on FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wfq byte-count
Related commands display qos queue wfq interface
qos wfq { byte-count | weight }
Use qos wfq { byte-count | weight } to assign a queue to a WFQ group with a certain scheduling weight.
Use undo qos wfq to restore the default.
120
Syntax
qos wfq queue-id group 1 { byte-count | weight } schedule-value
undo qos wfq queue-id
Default
All queues on a WFQ-enabled interface are in WFQ group 1 and have a weight of 1.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7 or keywords in
group 1 : Specifies WFQ group 1. Only WFQ group 1 is supported in the current software version. byte-count : Allocates bandwidth to queues in bytes. weight : Allocates bandwidth to queues in packets. schedule-value : Specifies a scheduling weight in the range of 1 to 127.
Usage guidelines
You must use the qos wfq command to enable WFQ before you configure this command.
Examples
# Enable byte-count WFQ on FortyGigE 1/0/1, and specify scheduling weight 10 for queue 0.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wfq byte-count
[Sysname-FortyGigE1/0/1] qos wfq 0 group 1 byte-count 10
Related commands display qos queue wfq interface qos bandwidth queue qos wfq
qos wfq group sp
Use qos wfq group sp to assign a queue to the SP group.
Use undo qos wfq group sp to remove a queue from the SP group.
Syntax
qos wfq queue-id group sp
undo qos wfq queue-id
Default
All queues on a WFQ-enabled interface are in WFQ group 1.
121
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7 or keywords in
Usage guidelines
This command is available only on a WFQ-enabled interface. Queues in the SP group are scheduled with SP, instead of WFQ. The SP group has higher scheduling priority than the WFQ groups.
You must use the qos wfq command to enable WFQ before you configure this command.
Examples
# Enable WFQ on FortyGigE 1/0/1, and assign queue 0 to the SP group.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wfq weight
[Sysname-FortyGigE1/0/1] qos wfq 0 group sp
Related commands display qos queue wfq interface qos bandwidth queue qos wfq
Queue scheduling profile commands bandwidth queue
Use bandwidth queue to set the minimum guaranteed bandwidth for a queue.
Use undo bandwidth queue to restore the default.
Syntax
bandwidth queue queue-id min bandwidth-value
undo bandwidth queue queue-id
Default
The minimum guaranteed bandwidth for a queue is 64 kbps.
Views
Queue scheduling profile view
Predefined user roles network-admin mdc-admin
122
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7 or keywords in
min bandwidth-value : Specifies the minimum guaranteed bandwidth in the range of 8 to
100000000 kbps.
Usage guidelines
You must configure a queue as a WFQ queue before you set the minimum guaranteed bandwidth for the queue.
The minimum guaranteed bandwidth is the amount of bandwidth guaranteed for a queue when the interface is congested.
Examples
# Configure queue 0 as a WFQ queue, and set the minimum guaranteed bandwidth to 100 kbps for queue 0.
<Sysname> system-view
[Sysname] qos qmprofile myprofile
[Sysname-qmprofile-myprofile] queue 0 wfq group 1 weight 1
[Sysname-qmprofile-myprofile] bandwidth queue 0 min 100
display qos qmprofile configuration
Use display qos qmprofile configuration to display the queue scheduling profile configuration.
Syntax
In standalone mode: display qos qmprofile configuration [ profile-name ] [ slot slot-number ]
In IRF mode: display qos qmprofile configuration [ profile-name ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters profile-name : Specifies a queue scheduling profile by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a queue scheduling profile, this command displays the configuration of all queue scheduling profiles. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays the queue scheduling profile configuration for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option,
123
the command displays the queue scheduling profile configuration for the global active MPU. (In IRF mode.)
Examples
# Display the configuration of queue scheduling profile myprofile .
<Sysname> display qos qmprofile configuration myprofile
Queue management profile: myprofile (ID 1)
Queue ID Type Group Schedule Schedule Min Max
unit value bandwidth bandwidth
--------------------------------------------------------------------- be WFQ 1 weight 1 100 N/A af1 WFQ N/A N/A N/A 64 N/A af2 WFQ N/A N/A N/A 64 N/A af3 WFQ N/A N/A N/A 64 N/A af4 WFQ N/A N/A N/A 64 N/A ef WFQ N/A N/A N/A 64 N/A cs6 WFQ N/A N/A N/A 64 N/A cs7 WFQ N/A N/A N/A 64 N/A
Table 39 Command output
Field Description
Queue management profile Queue scheduling profile name.
Type
Group
Schedule unit
Schedule value
Min bandwidth
Max bandwidth
Queue scheduling type:
•
SP.
•
WRR.
•
WFQ.
Priority group to which the queue belongs.
The value can only be 1. N/A indicates this field is ignored.
Scheduling unit: weight or byte-count .
N/A indicates that this field is ignored.
This field indicates:
•
Number of packets for the weight scheduling unit.
•
Number of bytes for the byte-count scheduling unit.
N/A indicates that this field is ignored.
Minimum guaranteed bandwidth for the queue.
N/A indicates that this field is ignored.
This field is not supported in the current software version. Maximum allowed bandwidth for the queue. N/A indicates that this field is ignored.
display qos qmprofile interface
Use display qos qmprofile interface to display the queue scheduling profile applied to an interface.
Syntax display qos qmprofile interface [ interface-type interface-number ]
124
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the queue scheduling profiles applied to all interfaces.
Examples
# Display the queue scheduling profile applied to FortyGigE 1/0/1.
<Sysname> display qos qmprofile interface fortygige 1/0/1
Interface: FortyGigE1/0/1
Direction: Outbound
Queue management profile: myprofile
Table 40 Command output
Field Description
Direction Direction in which the queue scheduling profile is applied.
Queue management profile Name of the queue scheduling profile applied to the interface.
qos apply qmprofile
Use qos apply qmprofile to apply a queue scheduling profile to the outbound direction of an interface.
Use undo qos apply qmprofile to restore the default.
Syntax
qos apply qmprofile profile-name undo qos apply qmprofile
Default
No queue scheduling profile is applied to an interface.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters profile-name : Specifies a queue scheduling profile by its name, a case-sensitive string of 1 to 31 characters.
125
Usage guidelines
You can apply only one queue scheduling profile to an interface.
Examples
# Apply queue scheduling profile myprofile to the outbound direction of FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos apply qmprofile myprofile
Related commands display qos qmprofile interface
qos qmprofile
Use qos qmprofile to create a queue scheduling profile and enter its view, or enter the view of an existing queue scheduling profile.
Use undo qos qmprofile to delete a queue scheduling profile.
Syntax
qos qmprofile profile-name
undo qos qmprofile profile-name
Default
No user-created queue scheduling profiles exist.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters profile-name : Specifies a name for the queue scheduling profile, a case-sensitive string of 1 to
31 characters.
Usage guidelines
To delete a queue scheduling profile already applied to an object, first remove it from the object.
Examples
# Create a queue scheduling profile named myprofile and enter queue scheduling profile view.
<Sysname> system-view
[Sysname] qos qmprofile myprofile
[Sysname-qmprofile-myprofile]
Related commands display qos qmprofile interface queue
queue
Use queue to configure queue scheduling parameters.
126
Use undo queue to delete queue scheduling parameter settings.
Syntax
queue queue-id { sp | wfq group group-id { weight | byte-count } schedule-value | wrr group group-id { weight | byte-count } schedule-value }
undo queue queue-id
Default
All queues in a queue scheduling profile use SP queuing.
Views
Queue scheduling profile view
Predefined user roles network-admin mdc-admin
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7 or keywords in
sp : Enables SP for the queue. wfq : Enables WFQ for the queue. wrr : Enables WRR for the queue. group group-id : Specifies a WFQ or WRR group by its ID. The group ID can only be 1. byte-count : Allocates bandwidth to queues in bytes. weight : Allocates bandwidth to queues in packets. schedule-value : Specifies a scheduling weight. For WRR, the value range is 1 to 15. For WFQ, the value range is 1 to 15 if you have specified the byte-count keyword and 1 to 127 if you have specified the weight keyword.
Examples
# Create a queue scheduling profile named myprofile , and configure queue 0 to use SP.
<Sysname> system-view
[Sysname] qos qmprofile myprofile
[Sysname-qmprofile-myprofile] queue 0 sp
# Create a queue scheduling profile named myprofile . Configure queue 1 to meet the following requirements:
•
The WRR queuing is used.
•
The WRR group is group 1.
•
The scheduling weight is 10.
<Sysname> system-view
[Sysname] qos qmprofile myprofile
[Sysname-qmprofile-myprofile] queue 1 wrr group 1 weight 10
Related commands display qos qmprofile interface qos qmprofile
127
Congestion avoidance commands
WRED commands display qos wred interface
Use display qos wred interface to display the WRED information for interfaces.
Syntax display qos wred interface [ interface-type interface-number ]
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the WRED information for all interfaces.
Examples
# Display the WRED information for all interfaces.
<Sysname> display qos wred interface
Interface: FortyGigE1/0/3
Current WRED configuration:
Applied WRED table name: q1
Table 41 Command output
Field Description
Interface Interface type and interface number.
display qos wred table
Syntax
Use display qos wred table to display the WRED table configuration.
In standalone mode: display qos wred table [ name table-name ] [ slot slot-number ]
In IRF mode: display qos wred table [ name table-name ] [ chassis chassis-number slot slot-number ]
128
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters name table-name : Specifies a WRED table by its name, a case-sensitive string of 1 to 32 characters. If you do not specify a WRED table, this command displays the configuration of all
WRED tables. slot slot-number : Specifies a card by its slot number. If you do not specify a card, this command displays the WRED table configuration for the active MPU. (In standalone mode.) chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify this option, the command displays the WRED table configuration for the global active MPU. (In IRF mode.)
Examples
# Display the configuration of WRED table 1.
<Sysname> display qos wred table name 1
Table name: 1
Table type: Queue based WRED
QID gmin gmax gprob ymin ymax yprob rmin rmax rprob exponent ECN
----------------------------------------------------------------------------
0 100 1000 10 100 1000 10 100 1000 10 9 N
1 100 1000 10 100 1000 10 100 1000 10 9 N
2 100 1000 10 100 1000 10 100 1000 10 9 N
3 100 1000 10 100 1000 10 100 1000 10 9 N
4 100 1000 10 100 1000 10 100 1000 10 9 N
5 100 1000 10 100 1000 10 100 1000 10 9 N
6 100 1000 10 100 1000 10 100 1000 10 9 N
7 100 1000 10 100 1000 10 100 1000 10 9 N
Table 42 Command output
Field Description
Table name Name of a WRED table.
Table type Type of a WRED table. gmin gmax gprob ymin ymax
Lower limit for green packets.
Upper limit for green packets.
Drop probability for green packets.
Lower limit for yellow packets.
Upper limit for yellow packets.
129
Field Description yprob Drop probability for yellow packets. rmin rmax rprob exponent
ECN
Lower limit for red packets.
Upper limit for red packets.
Drop probability for red packets.
Exponent for average queue length calculation.
This field is not supported in the current software version.
Indicates whether ECN is enabled for the queue:
•
Y —Enabled.
•
N —Disabled.
qos wred apply
Use qos wred apply to apply a WRED table to an interface.
Use undo qos wred apply to restore the default.
Syntax qos wred apply [ table-name ] undo qos wred apply
Default
No WRED table is applied to an interface, and the tail drop mode is used on an interface.
Views
Layer 2/Layer 3 Ethernet interface view
Predefined user roles network-admin mdc-admin
Parameters table-name : Specifies a WRED table by its name, a case-sensitive string of 1 to 32 characters. If you do not specify a WRED table, this command applies the default WRED table to the interface.
Examples
# Apply WRED table table1 to FortyGigE 1/0/1.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] qos wred apply table1
Related commands display qos wred interface display qos wred table qos wred queue table
130
qos wred queue table
Use qos wred queue table to create a WRED table and enter its view, or enter the view of an existing WRED table.
Use undo qos wred queue table to delete a WRED table.
Syntax qos wred queue table table-name undo qos wred queue table table-name
Default
No WRED tables exist.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters table table-name : Specifies a name for the WRED table, a case-sensitive string of 1 to 32 characters.
Usage guidelines
You cannot delete a WRED table in use. To delete it, first remove it from the specified interface.
You can use the display qos wred table command to display the default WRED table, which cannot be modified or deleted.
Examples
# Create a queue-based WRED table named queue-table1 .
<Sysname> system-view
[Sysname] qos wred queue table queue-table1
[Sysname-wred-table-queue-table1]
Related commands display qos wred table
queue
Use queue to configure the drop-related parameters for a queue in the queue-based WRED table.
Use undo queue to restore the default.
Syntax queue queue-id [ drop-level drop-level ] low-limit low-limit high-limit high-limit [ discard-probability discard-prob ] undo queue { queue-id | all }
Default
The lower limit is 250, the upper limit is 1000, and the drop probability is 10%.
131
Views
WRED table view
Predefined user roles network-admin mdc-admin
Parameters all : Specifies all queues.
queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7.
drop-level drop-level : Specifies a drop level. This argument is a consideration for dropping packets. The value 0 corresponds to green packets, the value 1 corresponds to yellow packets, and the value 2 corresponds to red packets. If you do not specify a drop level, the subsequent configuration takes effect on the packets in the queue regardless of the drop level. low limit low-limit : Specifies the lower limit for the average queue length. The value range for low-limit is 0 to 16383 KB. high-limit high-limit : Specifies the upper limit for the average queue length. The upper limit must be greater than the lower limit. The value range for high-limit is 0 to 16383 KB. discard-probability discard-prob : Specifies the denominator for drop probability calculation. The greater the denominator, the smaller the calculated drop probability. The value range for discard-prob is 0 to 100.
Usage guidelines
When the average queue size is smaller than the lower threshold, no packet is dropped. When the average queue size is between the lower threshold and the upper threshold, the packets are dropped at random. The longer the queue is, the higher the drop probability is. When the average queue size exceeds the upper threshold, subsequent packets are dropped.
Examples
# In queue-based WRED table queue-table1 , configure the following drop-related parameters for packets in queue 1:
•
The drop level is 1.
•
The lower limit for the average queue length is 10.
•
The upper limit for the average queue length is 20.
•
The drop probability is 30%.
<Sysname> system-view
[Sysname] qos wred queue table queue-table1
[Sysname-wred-table-queue-table1] queue 1 drop-level 1 low-limit 10 high-limit 20 discard-probability 30
Related commands display qos wred table qos wred queue table
queue weighting-constant
Use queue weighting-constant to specify an exponent for average queue length calculation for a queue.
Use undo queue weighting-constant to restore the default.
132
Syntax queue queue-id weighting-constant exponent
undo queue queue-id weighting-constant
Default
The exponent for average queue length calculation is 9.
Views
WRED table view
Predefined user roles network-admin mdc-admin
Parameters queue-id : Specifies a queue by its ID. The value range for this argument is 0 to 7. weighting-constant exponent : Specifies the WRED exponent for average queue length calculation. The value range for exponent is 0 to 15.
Usage guidelines
The bigger the exponent is, the less sensitive the average queue size is to real-time queue size changes. The average queue size is calculated using the formula:
Average queue size = previous average queue size × (1-2
-n
) + current queue size × 2
-n
, where n can be configured with the qos wred weighting-constant command.
Examples
# In WRED table queue-table1 , set the exponent for average queue length calculation to 12 for queue 1.
<Sysname> system-view
[Sysname] qos wred queue table queue-table1
[Sysname-wred-table-queue-table1] queue 1 weighting-constant 12
Related commands display qos wred table qos wred queue table
133
Aggregate CAR commands
car name
Use car name to use an aggregate CAR action in a traffic behavior.
Use undo car to restore the default.
Syntax car name car-name undo car
Default
No aggregate CAR action is configured in a traffic behavior.
Views
Traffic behavior view
Predefined user roles network-admin mdc-admin
Parameters car-name : Specifies the name of an aggregate CAR action. This argument must start with a letter, and is a case-sensitive string of 1 to 31 characters.
Usage guidelines
The switch supports the following application destinations for aggregate CAR:
•
Interface.
•
VLANs.
•
Globally.
•
Control plane.
An aggregate CAR action takes effect only when the QoS policy is applied to the inbound direction.
Examples
# Use aggregate CAR action aggcar-1 in traffic behavior be1 .
<Sysname> system-view
[Sysname] traffic behavior be1
[Sysname-behavior-be1] car name aggcar-1
Related commands display qos car name display traffic behavior user-defined
display qos car name
Use display qos car name to display information about aggregate CAR actions.
Syntax display qos car name [ car-name ]
134
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters car-name : Specifies an aggregate CAR action by its name. This argument must start with a letter, and is a case-sensitive string of 1 to 31 characters. If you do not specify an aggregate CAR action, this command displays information about all aggregate CAR actions.
Examples
# (In standalone mode.) Display information about all aggregate CAR actions.
<Sysname> display qos car name
Name: a
Mode: aggregative
CIR 32 (kbps) CBS: 2048 (Bytes) PIR: 888 (kbps) EBS: 0 (Bytes)
Green action : pass
Red action : discard
Slot 0:
Green packets : 0 (Packets), 0 (Bytes)
Red packets : 0 (Packets), 0 (Bytes)
Slot 1:
Green packets : 0 (Packets), 0 (Bytes)
Red packets : 0 (Packets), 0 (Bytes)
Slot 2:
Apply failed
Table 43 Command output
Field Description
Name Name of the aggregate CAR action.
Mode
CIR CBS PIR EBS
Green action
Red action
Green packet
Red packet
Type of the CAR action, which can only be aggregative .
Parameters for the CAR action.
Action to take on green packets:
• discard —Drops the packets.
• pass —Permits the packets to pass through.
Action to take on red packets:
• discard —Drops the packets.
• pass —Permits the packets to pass through.
Statistics about green packets.
Statistics about red packets.
135
qos car
Use qos car aggregative to configure an aggregate CAR action.
Use undo qos car to delete an aggregate CAR action.
Syntax
qos car car-name aggregative cir committed-information-rate [ cbs
committed-burst-size [ ebs excess-burst-size ] ]
qos car car-name aggregative cir committed-information-rate [ cbs committed-burst-size ] pir peak-information-rate [ ebs excess-burst-size ]
undo qos car car-name
Default
No aggregate CAR action is configured.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters car-name : Specifies the name of the aggregate CAR action. This argument must start with a letter, and is a case-sensitive string of 1 to 31 characters. cir committed-information-rate : Specifies the CIR in kbps, which is an average traffic rate.
The value range for committed-information-rate is 8 to 160000000, in increments of 8.
cbs committed-burst-size : Specifies the CBS in bytes. The value range for committed-burst-size is 512 to 256000000, in increments of 512. The default value for this argument is the product of 62.5 and the CIR and must be an integral multiple of 512. When the product is not an integral multiple of 512, it is rounded up to the nearest integral multiple of 512 that is greater than the product. A default value greater than 256000000 is converted to 256000000. ebs excess-burst-size : Specifies the EBS in bytes. The value range for excess-burst-size is 0 to 256000000, in increments of 512. If the PIR is configured, the default
EBS is the product of 62.5 and the PIR and must be an integral multiple of 512. When the product is not an integral multiple of 512, it is rounded up to the nearest integral multiple of 512. A default value greater than 256000000 is converted to 256000000. pir peak-information-rate : Specifies the PIR in kbps. The value range for peak-information-rate is 8 to 160000000, in increments of 8.
Usage guidelines
The switch supports the following application destinations for aggregate CAR:
•
Interface.
•
VLANs.
•
Globally.
•
Control plane.
An aggregate CAR action takes effect only when the QoS policy is applied to the inbound direction.
136
To use two rates for aggregate CAR, configure the qos car command with the pir peak-information-rate option. To use one rate for aggregate CAR, configure the qos car command without the pir peak-information-rate option.
Examples
# Configure aggregate CAR action aggcar-1 .
<Sysname> system-view
[Sysname] qos car aggcar-1 aggregative cir 25600 cbs 512000
Related commands display qos car name
reset qos car name
Use reset qos car name to clear the statistics about aggregate CAR actions.
Syntax reset qos car name [ car-name ]
Views
User view
Predefined user roles network-admin mdc-admin
Parameters car-name : Specifies an aggregate CAR action by its name. This argument must start with a letter, and is a case-sensitive string of 1 to 31 characters. If you do not specify an aggregate CAR action, this command clears statistics for all aggregate CAR actions.
Examples
# Clear the statistics about aggregate CAR action aggcar-1 .
<Sysname> reset qos car name aggcar-1
137
Queue-based accounting commands
display qos queue-statistics interface outbound
Use display qos queue-statistics interface outbound to display outgoing traffic statistics collected for interfaces on a per-queue basis.
Syntax display qos queue-statistics interface [ interface-type interface-number ] outbound
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command displays the outgoing traffic statistics for all interfaces.
Examples
# (For H-series cards.) Display queue-based outgoing traffic statistics of FortyGigE 1/0/1. (For H cards)
<Sysname> display qos queue-statistics interface fortygige 1/0/1 outbound
Interface: FortyGigE1/0/1
Direction: outbound
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Queue 0
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
Queue 1
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
Queue 2
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
Queue 3
Forwarded: 0 packets, 0 bytes
138
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
Queue 4
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
Queue 5
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
Queue 6
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
Queue 7
Forwarded: 0 packets, 0 bytes
Dropped: 1 packets, 1 bytes
Total queue length: 0 packets
Current queue length: 0 packets, 0% use ratio
# (For F-series cards.) Display queue-based outgoing traffic statistics of FortyGigE 1/0/1.
<Sysname> display qos queue-statistics interface fortygige 1/0/1 outbound
Interface: FortyGigE1/0/1
Direction: outbound
Dropped: 0 packets, 0 bytes
Aged: 0 packets, 0 bytes
Queue 0
Dropped: 0 packets, 0 bytes
Total queue length: 10000 packets
Current queue length: 0 packets, 0% use ratio
Queue 1
Dropped: 0 packets, 0 bytes
Total queue length: 10000 packets
Current queue length: 0 packets, 0% use ratio
Queue 2
Dropped: 0 packets, 0 bytes
Total queue length: 20000 packets
Current queue length: 0 packets, 0% use ratio
Queue 3
Dropped: 0 packets, 0 bytes
Total queue length: 10000 packets
Current queue length: 0 packets, 0% use ratio
Queue 4
Dropped: 0 packets, 0 bytes
Total queue length: 10000 packets
139
Current queue length: 0 packets, 0% use ratio
Queue 5
Dropped: 0 packets, 0 bytes
Total queue length: 10000 packets
Current queue length: 0 packets, 0% use ratio
Queue 6
Dropped: 0 packets, 0 bytes
Total queue length: 10000 packets
Current queue length: 0 packets, 0% use ratio
Queue 7
Dropped: 0 packets, 0 bytes
Total queue length: 10000 packets
Current queue length: 0 packets, 0% use ratio
Table 44 Command output
Field Description
Interface Interface for which queue-based traffic statistics are displayed.
Direction
Forwarded
Dropped
Aged
Total queue length
Current queue length
Direction of traffic for which statistics are collected.
(This field is not supported in the current software version.) Counts forwarded traffic both in packets and in bytes.
Counts dropped traffic both in packets and in bytes.
(This field is not supported in the current software version.) Counts aged traffic both in packets and in bytes.
Total number of packets allowed in the queue.
Current number of packets in the queue. use ratio
Related commands
Utilization ratio of the queue. reset counters interface ( Interface Command Reference )
display statistic mode
Use display statistic mode to display the packet counting mode.
Syntax display statistic mode
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Examples
# Display the packet counting mode.
140
<Sysname> display statistic mode
The packet statistic mode is queue.
Related commands statistic mode queue
reset qos queue-statistics interface outbound
Use reset qos queue-statistics interface outbound to clear outgoing queue-based traffic statistics for an interface.
Syntax reset qos queue-statistics interface [ interface-type interface-number ] outbound
Views
User view
Predefined user roles network-admin mdc-admin
Parameters interface-type interface-number : Specifies an interface by its type and number. If you do not specify an interface, this command clears the outgoing queue-based traffic statistics for all interfaces.
Examples
# Clear the outgoing queue-based traffic statistics for all interfaces.
<Sysname> reset qos queue-statistics interface outbound
# Clear the outgoing queue-based traffic statistics for FortyGigE 1/0/1.
<Sysname> reset qos queue-statistics interface fortygige 1/0/1 outbound
statistic mode queue
Use statistic mode queue to set the packet counting mode to queue.
Use undo statistic mode queue to restore the default.
Syntax statistic mode queue undo statistic mode
Default
The packet counting mode is vsi.
Views
System view
Predefined user roles network-admin mdc-admin
141
Usage guidelines
After you configure this command and the qos queue-statistics command, the device collects statistics on packets of each queue. You can use the display qos queue-statistics interface outbound command to display the statistics.
Examples
# Set the packet counting mode to queue.
<Sysname> system-view
[Sysname] statistic mode queue
Do you want to change the packet statistic mode? [Y/N]:y
Related commands display statistic mode
142
QPPB commands
bgp-policy
Use bgp-policy to enable QPPB, which transmits the apply ip-precedence and apply qos-local-id configuration through BGP routing policies.
Use undo bgp-policy to restore the default.
Syntax bgp-policy { destination | source } { ip-prec-map | ip-qos-map } * undo bgp-policy { destination | source } [ ip-prec-map | ip-qos-map ] *
Default
QPPB is disabled.
Views
Layer 3 Ethernet interface view
VLAN interface view
Predefined user roles network-admin mdc-admin
Parameters destination : Searches the routing table by destination IP address. source : Searches the routing table by source IP address. If the source keyword is specified, the source IP address is used as the destination address for inverse lookup. ip-prec-map : Sets an IP precedence value for matching packets. ip-qos-map : Sets a local QoS ID for matching packets.
Usage guidelines
This command is available only on HF cards. Before configuring this command, you must set the
TCAM operating mode to routing by using the hardware-resource tcam command. For information about this command, see device management commands in Fundamentals Command
Reference .
The bgp-policy command applies only to the incoming traffic of an interface.
In an MPLS L3VPN, the bgp-policy command is executed after the QoS features are performed in the inbound direction of the PE's public network interface. In any other case, the bgp-policy command is executed before the QoS features.
If you configure either of the following bgp-policy command pairs, both commands in the pair take effect:
• bgp-policy destination ip-prec-map and bgp-policy source ip-qos-map .
• bgp-policy source ip-prec-map and bgp-policy destination ip-qos-map .
If you configure either of the following bgp-policy command pairs, the command with the destination keyword in the pair takes effect:
• bgp-policy destination ip-prec-map and bgp-policy source ip-prec-map .
143
• bgp-policy destination ip-qos-map and bgp-policy source ip-qos-map .
Examples
# Configure FortyGigE 1/0/1 to get the IP precedence and local QoS ID by looking up routes based on source IP address.
<Sysname> system-view
[Sysname] interface fortygige 1/0/1
[Sysname-FortyGigE1/0/1] bgp-policy source ip-prec-map ip-qos-map
Related commands apply ip-precedence ( Layer 3—IP Routing Command Reference ) apply qos-local-id ( Layer 3—IP Routing Command Reference ) route-policy ( Layer 3—IP Routing Command Reference )
144
Time range commands
display time-range
Use display time-range to display time range configuration and status.
Syntax display time-range { time-range-name | all }
Views
Any view
Predefined user roles network-admin network-operator mdc-admin mdc-operator
Parameters time-range-name : Specifies a time range name, a case-insensitive string of 1 to 32 characters. It must start with an English letter. all : Displays the configuration and status of all existing time ranges.
Examples
# Display the configuration and status of time range t4 .
<Sysname> display time-range t4
Current time is 17:12:34 11/23/2010 Tuesday
Time-range : t4 (Inactive)
10:00 to 12:00 Mon
14:00 to 16:00 Wed
from 00:00 1/1/2011 to 00:00 1/1/2012
from 00:00 6/1/2011 to 00:00 7/1/2011
Table 45 Command output
Field Description
Current time Current system time.
Time-range
Configuration and status of the time range, including its name, status (active or inactive), and start time and end time.
time-range
Use time-range to create or edit a time range.
Use undo time-range to delete a time range or a statement in the time range.
145
Syntax time-range time-range-name { start-time to end-time days [ from time1 date1 ]
[ to time2 date2 ] | from time1 date1 [ to time2 date2 ] | to time2 date2 } undo time-range time-range-name [ start-time to end-time days [ from time1 date1 ] [ to time2 date2 ] | from time1 date1 [ to time2 date2 ] | to time2 date2 ]
Default
No time ranges exist.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters time-range-name : Specifies a time range name. The name is a case-insensitive string of 1 to 32 characters. It must start with an English letter. To avoid confusion, it cannot be all . start-time to end-time : Specifies a periodic statement. Both start-time and end-time are in hh:mm format (24-hour clock). The value is in the range of 00:00 to 23:59 for the start time, and
00:00 to 24:00 for the end time. The end time must be greater than the start time. days : Specifies the day or days of the week (in words or digits) on which the periodic statement is valid. If you specify multiple values, separate each value with a space, and make sure they do not overlap. These values can take one of the following forms:
•
A digit in the range of 0 to 6, for Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, and
Saturday.
•
A day of a week in abbreviated words: Sun , Mon , Tue , Wed , Thu , Fri , and Sat .
• working-day for Monday through Friday.
• off-day for Saturday and Sunday.
• daily for the whole week. from time1 date1 : Specifies the start time and date of an absolute statement. The time1 argument specifies the time of the day in hh:mm format (24-hour clock). Its value is in the range of
00:00 to 23:59. The date1 argument specifies a date in MM/DD/YYYY or YYYY/MM/DD format, where MM is the month of the year in the range of 1 to 12, DD is the day of the month with the range varying by MM , and YYYY is the year in the calendar in the range of 1970 to 2100. If you do not specify this option, the start time is 01/01/1970 00:00 AM, the earliest time available in the system. to time2 date2 : Specifies the end time and date of the absolute time statement. The time2 argument has the same format as the time1
The date2 argument has the same format and value range as the date1 argument. The end time must be greater than the start time. If you do not specify this option, the end time is 12/31/2100 24:00
PM, the maximum time available in the system.
Usage guidelines
If an existing time range name is provided, this command adds a statement to the time range.
You can create multiple statements in a time range. Each time statement can take one of the following forms:
•
Periodic statement in the start-time to end-time days format. A periodic statement recurs periodically on a day or days of the week.
146
•
Absolute statement in the from time1 date1 to time2 date2 format. An absolute statement does not recur.
•
Compound statement in the start-time to end-time days from time1 date1 to time2 date2 format. A compound statement recurs on a day or days of the week only within the specified period. For example, to create a time range that is active from 08:00 to 12:00 on
Monday between January 1, 2015, 00:00 and December 31, 2015, 23:59, use the time-range test 08:00 to 12:00 Mon from 00:00 01/01/2015 to 23:59
12/31/2015 command.
You can create a maximum of 1024 time ranges, each with a maximum of 32 periodic statements and 12 absolute statements. The active period of a time range is calculated as follows:
1. Combining all periodic statements.
2. Combining all absolute statements.
3. Taking the intersection of the two statement sets as the active period of the time range.
Examples
# Create a periodic time range t1 , setting it to be active between 8:00 to 18:00 during working days.
<Sysname> system-view
[Sysname] time-range t1 08:00 to 18:00 working-day
# Create an absolute time range t2 , setting it to be active in the whole year of 2011.
<Sysname> system-view
[Sysname] time-range t2 from 00:00 1/1/2011 to 24:00 12/31/2011
# Create a compound time range t3 , setting it to be active from 08:00 to 12:00 on Saturdays and
Sundays of the year 2011.
<Sysname> system-view
[Sysname] time-range t3 08:00 to 12:00 off-day from 00:00 1/1/2011 to 24:00 12/31/2011
# Create a compound time range t4 , setting it to be active from 10:00 to 12:00 on Mondays and from
14:00 to 16:00 on Wednesdays in January and June of the year 2011.
<Sysname> system-view
[Sysname] time-range t4 10:00 to 12:00 1 from 00:00 1/1/2011 to 24:00 1/31/2011
[Sysname] time-range t4 14:00 to 16:00 3 from 00:00 6/1/2011 to 24:00 6/30/2011
Related commands display time-range
147
Data buffer commands
buffer usage threshold
Use buffer usage threshold to set a per-interface buffer usage threshold.
Use undo buffer usage threshold to restore the default.
Syntax
In standalone mode:
buffer usage threshold slot slot-number ratio ratio
undo buffer usage threshold slot slot-number
In IRF mode:
buffer usage threshold chassis chassis-number slot slot-number ratio ratio
undo buffer usage threshold chassis chassis-number slot slot-number
Default
The per-interface buffer usage threshold is 100%.
Views
System view
Predefined user roles network-admin mdc-admin
Parameters slot slot-number : Specifies a card by its slot number. (In standalone mode.)
chassis chassis-number slot slot-number : Specifies a card on an IRF member device.
The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. (In IRF mode.) ratio ratio : Specifies the buffer usage threshold in percentage, in the range of 1 to 100.
Usage guidelines
This command takes effect only when the packet statistics collection mode is queue (configured by using the statistic mode queue command).
After you configure this command, the switch automatically records buffer usage for each interface.
When a queue on an interface uses more buffer space than the set threshold, the system counts one threshold violation for the queue.
To display the buffer usage statistics for interfaces, use the display buffer usage interface command.
Examples
# (In standalone mode.) Set the per-interface buffer usage threshold to 50% for card 3.
<Sysname> system-view
[Sysname] buffer usage threshold slot 3 ratio 50
148
# (In IRF mode.) Set the per-interface buffer usage threshold to 50% for card 3 on IRF member device 2.
<Sysname> system-view
[Sysname] buffer usage threshold chassis 2 slot 3 ratio 50
Related commands display buffer usage interface
burst-mode enable
Use burst-mode enable to enable the Burst feature.
Use undo burst-mode enable to disable the Burst feature.
Syntax burst-mode enable undo burst-mode enable
Default
The Burst feature is disabled.
Views
System view
Predefined user roles network-admin mdc-admin
Usage guidelines
The Burst feature is especially useful for reducing packet losses under the following circumstances:
•
Traffic enters a device from a high-speed interface and goes out of a low-speed interface.
•
Traffic enters a device from multiple same-rate interfaces and goes out of an interface with the same rate.
The Burst feature takes effect only on known unicast packets.
Examples
# Enable the Burst feature.
<Sysname> system-view
[Sysname] burst-mode enable
display buffer usage interface
Use display buffer usage interface to display buffer usage statistics for interfaces.
Syntax display buffer usage interface [ interface-type [ interface-number ] ]
[ verbose ]
Views
Any view
Predefined user roles network-admin
149
network-operator mdc-admin mdc-operator
Parameters interface-type [ interface-number ] : Specifies an interface by its type and number. If you do not specify the interface-type argument, this command displays buffer usage statistics for all Ethernet interfaces. If you specify the interface-type argument without the interface-number argument, this command displays buffer usage statistics for all Ethernet interfaces of the specified type. verbose : Displays detailed buffer usage statistics. If you do not specify this keyword, the command displays brief buffer usage statistics. This keyword is available only for the HPE FlexFabric 12900E
H card series.
Examples
# Display brief buffer usage statistics for FortyGigE 1/0/1.
<Sysname> display buffer usage interface fortygige 1/0/1
Interface QueueID Total Used Threshold(%) Violations
--------------------------------------------------------------------------------
FGE1/0/1 0 761856 0 100 0
1 761856 0 100 0
2 761856 0 100 0
3 761856 0 100 0
4 761856 0 100 0
5 761856 0 100 0
6 761856 0 100 0
7 761856 0 100 0
Table 46 Command output
Field Description
Total Data buffer size in bytes allowed for a queue.
Used
Threshold(%)
Data buffer size in bytes that has been used by a queue.
Buffer usage threshold for a queue. The threshold value is the same as the per-interface threshold value.
Violations
Number of threshold violations for a queue.
The value of this field is reset upon a switch reboot.
# Display detailed buffer usage statistics for FortyGigE 1/0/1.
<Sysname> display buffer usage interface fortygige 1/0/1 verbose
FortyGigE1/0/1
Ingress:
QueueID: 0
Total: -- Used: 2 Threshold(%): 3
Violations: 4 Shared: 5 Headroom: 6
Xoff threshold: 7 Is dynamic: 8
QueueID: 1
Total: -- Used: 4 Threshold(%): 6
Violations: 8 Shared: 10 Headroom: 12
Xoff threshold: 14 Is dynamic: 16
150
QueueID: 2
Total: -- Used: 6 Threshold(%): 9
Violations: 12 Shared: 15 Headroom: 18
Xoff threshold: 21 Is dynamic: 24
QueueID: 3
Total: -- Used: 8 Threshold(%): 12
Violations: 16 Shared: 20 Headroom: 24
Xoff threshold: 28 Is dynamic: 32
QueueID: 4
Total: -- Used: 10 Threshold(%): 15
Violations: 20 Shared: 25 Headroom: 30
Xoff threshold: 35 Is dynamic: 40
QueueID: 5
Total: -- Used: 12 Threshold(%): 18
Violations: 24 Shared: 30 Headroom: 36
Xoff threshold: 42 Is dynamic: 48
QueueID: 6
Total: -- Used: 14 Threshold(%): 21
Violations: 28 Shared: 35 Headroom: 42
Xoff threshold: 49 Is dynamic: 56
QueueID: 7
Total: -- Used: 16 Threshold(%): 24
Violations: 32 Shared: 40 Headroom: 48
Xoff threshold: 56 Is dynamic: 64
Egress:
QueueID: 0
Total: 9 Used: 10 Threshold(%): 11
Violations: 12 TailDropThreshold: 13 Is dynamic: 14
QueueID: 1
Total: 18 Used: 20 Threshold(%): 22
Violations: 24 TailDropThreshold: 26 Is dynamic: 28
QueueID: 2
Total: 27 Used: 30 Threshold(%): 33
Violations: 36 TailDropThreshold: 39 Is dynamic: 42
QueueID: 3
Total: 36 Used: 40 Threshold(%): 44
Violations: 48 TailDropThreshold: 52 Is dynamic: 56
QueueID: 4
Total: 45 Used: 50 Threshold(%): 55
Violations: 60 TailDropThreshold: 65 Is dynamic: 70
QueueID: 5
Total: 54 Used: 60 Threshold(%): 66
Violations: 72 TailDropThreshold: 78 Is dynamic: 84
QueueID: 6
Total: 63 Used: 70 Threshold(%): 77
Violations: 84 TailDropThreshold: 91 Is dynamic: 98
QueueID: 7
Total: 72 Used: 80 Threshold(%): 88
151
Violations: 96 TailDropThreshold: 104 Is dynamic: 112
Table 47 Command output
Field Description
Total Data buffer size in bytes allowed for a queue.
Used
Threshold(%)
Violations
Shared
Headroom
Xoff threshold
Is dynamic
Data buffer size in bytes that has been used by a queue.
Buffer usage threshold for a queue. The threshold value is the same as the per-interface threshold value.
Number of threshold violations for a queue.
The value of this field is reset upon a switch reboot.
Number of cell resources in the shared area used by a queue. A cell resource is 1024 bytes.
Number of cell resources in the Headroom area used by a queue.
When a queue on an interface enabled with PFC enters PFC XOFF state, the interface sends XOFF frames to notify the peer interface to stop sending packets to that queue. Packets sent by the peer interface before it receives
XOFF frames are stored in the Headroom area.
Back pressure frame triggering threshold.
If a dynamic back pressure frame triggering threshold is configured, this field displays a percentage value. If a static back pressure frame triggering threshold is configured, this field displays an absolute value.
For information about configuring back pressure frame triggering thresholds, see Ethernet interface commands in Layer 2—LAN Switching Command
Reference .
For the inbound direction, this field can be one of the following values:
•
0 —Indicates a static back pressure frame triggering threshold.
•
1 —Indicates a dynamic back pressure frame triggering threshold.
For the outbound direction, this field can only be 1, which indicates a dynamic tail drop threshold.
152
Document conventions and icons
Conventions
This section describes the conventions used in the documentation.
Command conventions
Convention Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic
[ ]
{ x | y | ... }
[ x | y | ... ]
{ x | y | ... } *
[ x | y | ... ] *
&<1-n>
Italic text represents arguments that you replace with actual values.
Square brackets enclose syntax choices (keywords or arguments) that are optional.
Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.
Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none.
Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.
Asterisk marked square brackets enclose optional syntax choices separated by vertical bars, from which you select one choice, multiple choices, or none.
The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.
A line that starts with a pound (#) sign is comments. #
GUI conventions
Symbols
Convention Description
Boldface
Window names, button names, field names, and menu items are in Boldface. For example, the New User window opens; click OK .
>
Multi-level menus are separated by angle brackets. For example, File > Create >
Folder .
Convention Description
WARNING!
An alert that calls attention to important information that if not understood or followed can result in personal injury.
CAUTION:
An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software.
An alert that calls attention to essential information.
IMPORTANT:
NOTE: An alert that contains additional or supplementary information.
TIP:
An alert that provides helpful information.
153
Network topology icons
Convention Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
Examples provided in this document
Examples in this document might use devices that differ from your device in hardware model, configuration, or software version. It is normal that the port numbers, sample output, screenshots, and other information in the examples differ from what you have on your device.
154
Support and other resources
Accessing Hewlett Packard Enterprise Support
•
For live assistance, go to the Contact Hewlett Packard Enterprise Worldwide website: www.hpe.com/assistance
•
To access documentation and support services, go to the Hewlett Packard Enterprise Support
Center website: www.hpe.com/support/hpesc
Information to collect
•
Technical support registration number (if applicable)
•
Product name, model or version, and serial number
•
Operating system name and version
•
Firmware version
•
Error messages
•
Product-specific reports and logs
•
Add-on products or components
•
Third-party products or components
Accessing updates
•
Some software products provide a mechanism for accessing software updates through the product interface. Review your product documentation to identify the recommended software update method.
•
To download product updates, go to either of the following:
{ Hewlett Packard Enterprise Support Center Get connected with updates page: www.hpe.com/support/e-updates
{
Software Depot website: www.hpe.com/support/softwaredepot
•
To view and update your entitlements, and to link your contracts, Care Packs, and warranties with your profile, go to the Hewlett Packard Enterprise Support Center More Information on
Access to Support Materials page: www.hpe.com/support/AccessToSupportMaterials
IMPORTANT:
Access to some updates might require product entitlement when accessed through the Hewlett
Packard Enterprise Support Center. You must have an HP Passport set up with relevant entitlements.
155
Websites
Website Link
Networking websites
Hewlett Packard Enterprise Information Library for
Networking
Hewlett Packard Enterprise Networking website
Hewlett Packard Enterprise My Networking website
Hewlett Packard Enterprise My Networking Portal
Hewlett Packard Enterprise Networking Warranty
General websites
Hewlett Packard Enterprise Information Library
Hewlett Packard Enterprise Support Center
Hewlett Packard Enterprise Support Services Central
Contact Hewlett Packard Enterprise Worldwide
Subscription Service/Support Alerts
Software Depot
Customer Self Repair (not applicable to all devices)
Insight Remote Support (not applicable to all devices) www.hpe.com/networking/resourcefinder www.hpe.com/info/networking www.hpe.com/networking/support www.hpe.com/networking/mynetworking www.hpe.com/networking/warranty www.hpe.com/info/enterprise/docs www.hpe.com/support/hpesc ssc.hpe.com/portal/site/ssc/ www.hpe.com/assistance www.hpe.com/support/e-updates www.hpe.com/support/softwaredepot www.hpe.com/support/selfrepair www.hpe.com/info/insightremotesupport/docs
Customer self repair
Hewlett Packard Enterprise customer self repair (CSR) programs allow you to repair your product. If a CSR part needs to be replaced, it will be shipped directly to you so that you can install it at your convenience. Some parts do not qualify for CSR. Your Hewlett Packard Enterprise authorized service provider will determine whether a repair can be accomplished by CSR.
For more information about CSR, contact your local service provider or go to the CSR website: www.hpe.com/support/selfrepair
Remote support
Remote support is available with supported devices as part of your warranty, Care Pack Service, or contractual support agreement. It provides intelligent event diagnosis, and automatic, secure submission of hardware event notifications to Hewlett Packard Enterprise, which will initiate a fast and accurate resolution based on your product’s service level. Hewlett Packard Enterprise strongly recommends that you register your device for remote support.
For more information and device support details, go to the following website: www.hpe.com/info/insightremotesupport/docs
Documentation feedback
Hewlett Packard Enterprise is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation
Feedback ( [email protected]
). When submitting your feedback, include the document title,
156
part number, edition, and publication date located on the front cover of the document. For online help content, include the product name, product version, help edition, and publication date located on the legal notices page.
157
Index
A accounting,
acl resource log interval,
acl resource threshold percent,
acl trap interval,
acl-outbound-enhance enable,
B
bgp-policy,
C
car name,
D description,
description,
display buffer usage interface,
display packet-filter,
display packet-filter statistics, 13
display packet-filter statistics sum,
display packet-filter verbose, 18
display qos car name,
display qos gts interface, 107
display qos lr interface,
display qos policy,
display qos policy control-plane,
display qos policy control-plane pre-defined,
display qos policy global,
display qos policy interface, 87
display qos policy l2vpn-ac,
display qos qmprofile configuration, 123
display qos qmprofile interface,
display qos queue interface,
display qos queue sp interface,
158 display qos queue wfq interface,
display qos queue wrr interface, 114
display qos queue-statistics interface outbound,
display qos trust interface,
display qos vlan-policy,
display qos wred interface,
128 display qos wred table, 128
display traffic behavior,
display traffic classifier,
dot1p-trust-tc,
F
I
M
mac-address mac-learning enable, 69
N
P
packet-filter continuous enable, 26
packet-filter default deny,
packet-filter vlan-interface, 29
packet-rate,
Q
qos apply qmprofile,
qos gts,
qos map-table,
qos priority,
qos trust,
qos wfq,
120 qos wfq { byte-count | weight }, 120
qos wred apply,
qos wred queue table,
qos wrr,
qos wrr { byte-count | weight },
qos wrr group sp,
queue,
queue,
R
remark dot1p,
remark dscp,
remark qos-local-id,
remark service-class,
reset acl counter,
reset packet-filter statistics, 31
reset qos policy control-plane,
reset qos policy global,
reset qos queue-statistics interface outbound, 141
rule (IPv4 advanced ACL view), 32
rule (IPv4 basic ACL view), 40
rule (IPv6 advanced ACL view), 42
rule (IPv6 basic ACL view), 47
rule (Layer 2 ACL view),
rule (user-defined ACL view), 52
S
T
traffic classifier,
159
Herunterladen
Öffentlicher Link aktualisiert
Der öffentliche Link zu Ihrem Chat wurde aktualisiert. Sie können Ihre Chat-Links nach der Registrierung hier einsehen und verwalten.
Öffentlicher Dokumentenlink
Werbung