ACL and QoS

Basic ACLs

2000 to 2999

IPv4

Source IPv4 address

IPv6

Source IPv6 address

Advanced ACLs

3000 to 3999

IPv4

Source/destination IPv4 address, protocols over IPv4, and other Layer 3 and Layer 4 header fields

IPv6

Source/destination IPv6 address, protocols over IPv6, and other Layer 3 and Layer 4 header fields

Ethernet frame header ACLs

4000 to 4999

IPv4 and IPv6

Layer 2 header fields, such as source and destination MAC addresses, 802.1p priority, and link layer protocol type

1.     Configuring a time range

Optional

Create a time range. A rule referencing a time range takes effect only during the specified time range.

2.     Creating an IPv4 ACL

Required

Create an IPv4 ACL. The category of the created ACL depends on the ACL number that you specify.

3.     Configuring a rule for a basic IPv4 ACL

Required

Complete one of the following tasks according to the ACL category.

4.     Configuring a rule for an advanced IPv4 ACL

5.     Configuring a rule for an Ethernet frame header ACL

1.     Configuring a time range

Optional

Create a time range. A rule referencing a time range takes effect only during the specified time range.

2.     Creating an IPv6 ACL

Required

Create an IPv6 ACL. The category of the created IPv6 ACL depends on the ACL number that you specify.

3.     Configuring a rule for a basic IPv6 ACL

Required

Complete one of the tasks according to the ACL category.

4.     Configuring a rule for an advanced IPv6 ACL

Time Range Name

Set the name for the time range.

Periodic Time Range

Start Time

Set the start time of the periodic time range.

You can define both a periodic time range and an absolute time range to create a compound time range. This compound time range recurs on the day or days of the week only within the specified period.

End Time

Set the end time of the periodic time range. The end time must be greater than the start time.

Sun, Mon, Tue, Wed, Thu, Fri, and Sat.

Select the day or days of the week on which the periodic time range is valid. You can select any combination of the days of the week.

Absolute Time Range

From

Set the start time and date of the absolute time range. The time of the day is in the hh:mm format (24-hour clock), and the date is in the MM/DD/YYYY format.

To

Set the end time and date of the absolute time range. The time of the day is in the hh:mm format (24-hour clock), and the date is in the MM/DD/YYYY format. The end time must be greater than the start time.

ACL Number

Set the number of the IPv4 ACL.

Match Order

Set the match order of the ACL. Available values are:

·     Config—Packets are compared against ACL rules in the order that the rules are configured.

·     Auto—Packets are compared against ACL rules in the depth-first match order.

ACL

Select the basic IPv4 ACL for which you want to configure rules.

Available ACLs are basic IPv4 ACLs.

Rule ID

Select the Rule ID option and enter a number for the rule.

If you do not specify the rule number, the system will assign one automatically.

 IMPORTANT:

If the rule number you specify already exists, the following operations modify the configuration of the rule.

Action

Select the action to be performed for IPv4 packets matching the rule.

·     Permit: Allows matched packets to pass.

·     Deny: Drops matched packets.

Check Fragment

Select this option to apply the rule to only non-first fragments.

If you do no select this option, the rule applies to all fragments and non-fragments.

Check Logging

Select this option to keep a log of matched IPv4 packets.

A log entry contains the ACL rule number, operation for the matched packets, protocol that IP carries, source/destination address, source/destination port number, and number of matched packets.

Source IP Address

Select the Source IP Address option and enter a source IPv4 address and a wildcard mask, in dotted decimal notation.

Source Wildcard

Time Range

Select the time range during which the rule takes effect.

ACL

Select the advanced IPv4 ACL for which you want to configure rules.

Available ACLs are advanced IPv4 ACLs.

Rule ID

Select the Rule ID option and enter a number for the rule.

If you do not specify the rule number, the system will assign one automatically.

 IMPORTANT:

If the rule number you specify already exists, the following operations modify the configuration of the rule.

Action

Select the action to be performed for packets matching the rule.

·     Permit: Allows matched packets to pass.

·     Deny: Drops matched packets.

Non-First Fragments Only

Select this option to apply the rule to only non-first fragments.

If you do no select this option, the rule applies to all fragments and non-fragments.

Logging

Select this option to keep a log of matched packets.

A log entry contains the ACL rule number, operation for the matched packets, protocol that IP carries, source/destination address, source/destination port number, and number of matched packets.

IP Address Filter

Source IP Address

Select the Source IP Address option and enter a source IPv4 address and a source wildcard mask, in dotted decimal notation.

Source Wildcard

Destination IP Address

Select the Source IP Address option and enter a source IP address and a source wildcard mask, in dotted decimal notation.

Destination Wildcard

Protocol

Select the protocol to be carried by IP.

If you select 1 ICMP, you can configure the ICMP message type and code; if you select 6 TCP or 17 UDP, you can configure the TCP or UDP port.

ICMP Type

ICMP Message

Specify the ICMP message type and code.

These items are available only when you select 1 ICMP from the Protocol list.

If you select Other from the ICMP Message list, you need to type values in the ICMP Type and ICMP Code fields. Otherwise, the two fields will take the default values, which cannot be changed.

ICMP Type

ICMP Code

TCP/UDP Port

TCP Connection Established

Select this option to make the rule match packets used for establishing and maintaining TCP connections.

These items are available only when you select 6 TCP from the Protocol list.

Source

Operator

Select the operators and enter the source port numbers and destination port numbers as required.

These items are available only when you select 6 TCP or 17 UDP from the Protocol list.

Different operators have different configuration requirements for the port number fields:

·     Not Check: The following port number fields cannot be configured.

·     Range: The following port number fields must be configured to define a port range.

·     Other values: The first port number field must be configured and the second must not.

Port

-

Destination

Operator

Port

-

Precedence Filter

DSCP

Specify the DSCP value.

 IMPORTANT:

If you specify the ToS precedence or IP precedence when you specify the DSCP value, the specified TOS or IP precedence does not take effect.

TOS

Specify the ToS preference.

Precedence

Specify the IP precedence.

Time Range

Select the time range during which the rule takes effect.

ACL

Select the Ethernet frame header IPv4 ACL for which you want to configure rules.

Available ACLs are Ethernet frame header IPv4 ACLs.

Rule ID

Select the Rule ID option and enter a number for the rule.

If you do not specify the rule number, the system will assign one automatically.

 IMPORTANT:

If the rule number you specify already exists, the following operations modify the configuration of the rule.

Action

Select the action to be performed for packets matching the rule.

·     Permit: Allows matched packets to pass.

·     Deny: Drops matched packets.

MAC Address Filter

Source MAC Address

Select the Source MAC Address option and enter a source MAC address and a mask.

Source Mask

Destination MAC Address

Select the Destination MAC Address option and enter a destination MAC address and a mask.

Destination Mask

COS(802.1p priority)

Specify the 802.1p priority for the rule.

Type Filter

LSAP Type

Select the LSAP Type option and specify the DSAP and SSAP fields in the LLC encapsulation by configuring the following items:

·     LSAP Type: Indicates the frame encapsulation format.

·     LSAP Mask: Indicates the LSAP mask.

LSAP Mask

Protocol Type

Select the Protocol Type option and specify the link layer protocol type by configuring the following items:

·     Protocol Type: Indicates the frame type. It corresponds to the type-code field of Ethernet_II and Ethernet_SNAP frames.

·     Protocol Mask: Indicates the protocol mask.

Protocol Mask

Time Range

Select the time range during which the rule takes effect.

ACL Number

Enter a number for the IPv6 ACL.

Match Order

Select a match order for the ACL. Available values are:

·     Config: Packets are compared against ACL rules in the order the rules are configured.

·     Auto: Packets are compared against ACL rules in the depth-first match order.

Select Access Control List (ACL)

Select the basic IPv6 ACL for which you want to configure rules.

Rule ID

Select the Rule ID option and enter a number for the rule.

If you do not specify the rule number, the system will assign one automatically.

 IMPORTANT:

If the rule number you specify already exists, the following operations modify the configuration of the rule.

Operation

Select the operation to be performed for IPv6 packets matching the rule.

·     Permit: Allows matched packets to pass.

·     Deny: Drops matched packets.

Check Fragment

Select this option to apply the rule to only non-first fragments.

If you do no select this option, the rule applies to all fragments and non-fragments.

Check Logging

Select this option to keep a log of matched IPv6 packets.

A log entry contains the ACL rule number, operation for the matched packets, protocol that IP carries, source/destination address, source/destination port number, and number of matched packets.

Source IP Address

Select the Source IP Address option and enter a source IPv6 address and prefix length.

The IPv6 address must be in a format like X:X::X:X. An IPv6 address consists of eight 16-bit long fields, each of which is expressed with two hexadecimal numbers and separated from its neighboring fields by colon (:).

Source Prefix

Time Range

Select the time range during which the rule takes effect.

Select Access Control List (ACL)

Select the advanced IPv6 ACL for which you want to configure rules.

Rule ID

Select the Rule ID option and enter a number for the rule.

If you do not specify the rule number, the system will assign one automatically.

 IMPORTANT:

If the rule number you specify already exists, the following operations modify the configuration of the rule.

Operation

Select the operation to be performed for IPv6 packets matching the rule.

·     Permit: Allows matched packets to pass.

·     Deny: Drops matched packets.

Check Fragment

Select this option to apply the rule to only non-first fragments.

If you do no select this option, the rule applies to all fragments and non-fragments.

Check Logging

Select this option to keep a log of matched IPv6 packets.

A log entry contains the ACL rule number, operation for the matched packets, protocol that IP carries, source/destination address, source/destination port number, and number of matched packets.

IP Address Filter

Source IP Address

Select the Source IP Address option and enter a source IPv6 address and prefix length.

The IPv6 address must be in a format like X:X::X:X. An IPv6 address consists of eight 16-bit long fields, each of which is expressed with two hexadecimal numbers and separated from its neighboring fields by colon (:).

Source Prefix

Destination IP Address

Select the Destination IP Address option and enter a destination IPv6 address and prefix length.

The IPv6 address must be in a format like X:X::X:X. An IPv6 address consists of eight 16-bit long fields, each of which is expressed with two hexadecimal numbers and separated from its neighboring fields by colon (:).

Destination Prefix

Protocol

Select the protocol to be carried by IP.

If you select 58 ICMPv6, you can configure the ICMP message type and code; if you select 6 TCP or 17 UDP, you can configure the TCP or UDP specific items.

ICMPv6 Type

Named ICMPv6 Type

Specify the ICMPv6 message type and code.

These items are available only when you select 58 ICMPv6 from the Protocol list.

If you select Other from the Named ICMPv6 Type list, you need to type values in the ICMPv6 Type and ICMPv6 Code fields. Otherwise, the two fields will take the default values, which cannot be changed.

ICMPv6 Type

ICMPv6 Code

TCP/UDP Port

Source

Operator

Select the operators and enter the source port numbers and destination port numbers as required.

These items are available only when you select 6 TCP or 17 UDP from the Protocol list.

Different operators have different configuration requirements for the port number fields:

·     Not Check: The following port number fields cannot be configured.

·     Range: The following port number fields must be configured to define a port range.

·     Other values: The first port number field must be configured and the second must not.

Port

To Port

Destination

Operator

Port

Port

Time Range

Select the time range during which the rule takes effect.

1.     Creating a class

Required

Create a class and specify the logical relationship between the match criteria in the class.

2.     Configuring classification rules

Required

Configure match criteria for the class.

3.     Creating a traffic behavior

Required

Create a traffic behavior.

4.     Configuring traffic mirroring and traffic redirecting for a traffic behavior

Use either approach

Configure various actions for the traffic behavior.

5.     Configuring other actions for a traffic behavior

6.     Creating a policy

Required

Create a policy.

7.     Configuring classifier-behavior associations for the policy

Required

Associate the traffic behavior with the class in the QoS policy.

A class can be associated with only one traffic behavior in a QoS policy. Associating a class already associated with a traffic behavior will overwrite the old association.

8.     Applying a policy to a port

Required

Apply the QoS policy to a port.

1.     Configuring queue scheduling on a port

Optional

Configure the queue scheduling mode for a port.

The default queue scheduling mode of a port may vary depending on your device model.

1.     Configuring line rate on a port

Required

Limit the rate of incoming packets or outgoing packets of a physical port.

1.     Configuring priority mapping tables

Required

Set priority mapping tables.

1.     Configuring priority trust mode on a port

Required

Set the priority trust mode of a port.

Classifier Name

Specify a name for the classifier to be created.

Some devices have their own system-defined classifiers. The classifier name you specify cannot overlap with system-defined ones. The system-defined classifiers include: default-class, ef, af1, af2, af3, af4, ip-prec0, ip-prec1, ip-prec2, ip-prec3, ip-prec4, ip-prec5, ip-prec6, ip-prec7, mpls-exp0, mpls-exp1, mpls-exp2, mpls-exp3, mpls-exp4, mpls-exp5, mpls-exp6, and mpls-exp7.

Operator

Specify the logical relationship between rules of the classifier.

·     And—Specifies the relationship between the rules in a class as logic AND. The device considers a packet belongs to a class only when the packet matches all the rules in the class.

·     Or—Specifies the relationship between the rules in a class as logic OR. The device considers a packet belongs to a class as long as the packet matches one of the rules in the class.

Please select a classifier

Select an existing classifier in the list.

Any

Define a rule to match all packets.

Select the option to match all packets.

DSCP

Define a rule to match DSCP values.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

You can configure up to eight DSCP values each time. If multiple identical DSCP values are specified, the system considers them as one. The relationship between different DSCP values is OR. After such configurations, all the DSCP values are arranged in ascending order automatically.

IP Precedence

Define a rule to match IP precedence values.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

You can configure up to eight IP precedence values each time. If multiple identical IP precedence values are specified, the system considers them as one. The relationship between different IP precedence values is OR. After such configurations, all the IP precedence values are arranged in ascending order automatically.

Classifier

Define a rule to match a QoS class.

Inbound Interface

Define a rule to match inbound interfaces.

RTP Port

Define a rule to match a range of RTP ports

Specify the start port in the from field and the end port in the to field.

Dot1p

Service 802.1p

Define a rule to match the service 802.1p priority values.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

You can configure up to eight 802.1p priority values each time. If multiple identical 802.1p priority values are specified, the system considers them as one. The relationship between different 802.1p priority values is OR. After such configurations, all the 802.1p priority values are arranged in ascending order automatically.

Customer 802.1p

Define a rule to match the customer 802.1p priority values.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

You can configure up to eight 802.1p priority values each time. If multiple identical 802.1p priority values are specified, the system considers them as one. The relationship between different 802.1p priority values is OR. After such configurations, all the 802.1p priority values are arranged in ascending order automatically.

MAC

Source MAC

Define a rule to match a source MAC address.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

A rule to match a source MAC address is significant only to Ethernet interfaces.

Destination MAC

Define a rule to match a destination MAC address.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

A rule to match a destination MAC address is significant only to Ethernet interfaces.

VLAN

Service VLAN

Define a rule to match service VLAN IDs.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

You can configure multiple VLAN IDs each time. If the same VLAN ID is specified multiple times, the system considers them as one. The relationship between different VLAN IDs is logical OR. After such a configuration. You can specify VLAN IDs in two ways:

·     Enter a range of VLAN IDs, such as 10-500. The number of VLAN IDs in the range is not limited.

·     Specify a combination of individual VLAN IDs and VLAN ID ranges, such as 3, 5-7, 10. You can specify up to eight VLAN IDs in this way.

Customer VLAN

Define a rule to match customer VLAN IDs.

If multiple such rules are configured for a class, the new configuration does not overwrite the previous one.

You can configure multiple VLAN IDs each time. If the same VLAN ID is specified multiple times, the system considers them as one. The relationship between different VLAN IDs is logical OR. You can specify VLAN IDs in two ways:

·     Enter a range of VLAN IDs, such as 10-500. The number of VLAN IDs in the range is not limited.

·     Specify a combination of individual VLAN IDs and VLAN ID ranges, such as 3, 5-7, 10. You can specify up to eight VLAN IDs in this way.

ACL

ACL IPv4

Define an IPv4 ACL-based rule.

ACL IPv6

Define an IPv6 ACL-based rule.

 IMPORTANT:

Support for this configuration item depends on your device model.

Please select a behavior

Select an existing behavior in the list.

Mirror To

Set the action of mirroring traffic to the specified destination port.

 IMPORTANT:

The device supports mirroring traffic to only one interface. The new configuration overwrites the previous one.

Redirect

Set the action of redirecting traffic to the specified destination port.

Please select a port

Specify the port to be configured as the destination port of traffic mirroring or traffic directing on the chassis front panel.

Please select a behavior

Select an existing behavior in the list.

CAR

Enable/Disable

Enable or disable CAR

CIR

Set the committed information rate (CIR), the average traffic rate.

CBS

Set the committed burst size (CBS), number of bytes that can be sent in each interval.

Red

Discard

Set the action to perform for exceeding packets.

After selecting the Red option, you can select one of the following options:

·     Discard: Drops the exceeding packet.

·     Pass: Permits the exceeding packet to pass through.

Pass

Remark

IP Precedence

Configure the action of marking IP precedence for packets.

Select the IP Precedence option and then select the IP precedence value to be marked for packets in the following list. Select Not Set to cancel the action of marking IP precedence.

Dot1p

Configure the action of marking 802.1p priority for packets.

Select the Dot1p option and then select the 802.1p priority value to be marked for packets in the following list. Select Not Set to cancel the action of marking 802.1p priority.

Local Precedence

Configure the action of marking local precedence for packets.

Select the Local Precedence option and then select the local precedence value to be marked for packets in the following list. Select Not Set to cancel the action of marking local precedence.

DSCP

Configure the action of marking DSCP value for packets.

Select the DSCP option and then select the DSCP value to be marked for packets in the following list. Select Not Set to cancel the action of marking DSCP value.

Queue

EF

Max Bandwidth

Configure the maximum bandwidth for expedited forwarding (EF).

CBS

Configure the CBS for EF.

Percent

Configure the percent of available bandwidth for EF.

CBS-Ratio

Configure the ratio of CBS to CIR for EF.

AF

Min Bandwidth

Configure the minimum guaranteed bandwidth for assured forwarding (AF).

Percent

Configure the percent of available bandwidth for AF.

WFQ

Configure WFQ for the default class by entering the total number of fair queues, which must be the power of two.

Filter

Configure the packet filtering action.

After selecting the Filter option, select one item in the following list:

·     Permit: Forwards the packet.

·     Deny: Drops the packet.

·     Not Set: Cancels the packet filtering action.

Accounting

Configure the traffic accounting action.

Select the Accounting option and select Enable or Disable in the following list to enable/disable the traffic accounting action.

Policy Name

Specify a name for the policy to be created.

Some devices have their own system-defined policies. The policy name you specify cannot overlap with system-defined ones. The system-defined policy is the policy default.

Please select a policy

Select an existing policy in the list.

Classifier Name

Select an existing classifier in the list.

Behavior Name

Select an existing behavior in the list.

Please select a policy

Select an existing policy in the list.

Direction

Set the direction in which the policy is to be applied.

·     Inbound: Applies the policy to the incoming packets of the specified ports.

·     Outbound: Applies the policy to the outgoing packets of the specified ports.

Please select port(s)

Click to select ports to which the QoS policy is to be applied on the chassis front panel.

WRR Setup

WRR

Enable or disable the WRR queue scheduling mechanism on selected ports. Two options are available:

·     Enable—Enables WRR on selected ports.

·     Not Set—Restores the default queuing algorithm on selected ports.

Queue

Select the queue to be configured.

A queue ID ranges from 0 to n-1 (n is the maximum number of queues on an interface and varies by device).

Group

Specify the group the current queue is to be assigned to.

This list is available after you select a queue ID. The following groups are available for selection:

·     SP—Assigns a queue to the SP group.

·     1—Assigns a queue to WRR group 1.

·     2—Assigns a queue to WRR group 2.

Weight

Set a weight for the current queue.

This option is available when group 1 or group 2 is selected.

Please select port(s)

Select ports to be configured with queuing on the chassis front panel.

Please select an interface type

Select the types of interfaces to be configured with line rate.

Rate Limit

Enable or disable line rate on the specified port.

Direction

Select a direction in which the line rate is to be applied.

·     Inbound: Limits the rate of packets received on the specified port.

·     Outbound: Limits the rate of packets sent by the specified port.

·     Both: Limits the rate of packets sent and packets received by the specified port.

CIR

Set the committed information rate (CIR), the average traffic rate.

CBS

Set the committed burst size (CBS), number of bits that can be sent in each interval.

EBS

Set the excess burst size (EBS).

EBS is available when the CBS option is selected.

Please select port(s)

Specify the ports to be configured with line rate

Click the ports to be configured with line rate in the port list. You can select one or more ports.

Mapping Type

Select the priority mapping table to be configured, which can be CoS to DSCP, CoS to Queue, DSCP to CoS, DSCP to DSCP, or DSCP to Queue.

Input Priority Value

Set the output priority value for an input priority value.

Output Priority Value

Restore

Click Restore to display the default settings of the current priority mapping table on the page.

To restore the priority mapping table to the default, click Apply.

Interface

The interface to be configured.

Priority

Set a local precedence value for the port.

Trust Mode

Select a priority trust mode for the port, which can be

·     Untrust: Not trusts packet priority.

·     CoS: Trusts the 802.1p priority of the incoming packets.

·     DSCP: Trusts the DSCP value of the incoming packets.