Contents

Packet filter commands· 1

display packet-filter 1

display packet-filter statistics· 2

display packet-filter statistics sum·· 5

display packet-filter verbose· 6

packet-filter 8

packet-filter default deny· 9

reset packet-filter statistics· 10

 

Packet filter commands

If you do not specify a VPN instance, whether an ACL rule applies to VPN packets varies by device model.

display packet-filter

Use display packet-filter to display ACL application information for packet filtering.

Syntax

display packet-filter interface [ interface-type interface-number ] [ inbound | outbound ] [ slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface [ interface-type interface-number ]: Specifies an interface by its type and number. If you do not specify an interface, this command displays ACL application information for packet filtering on all interfaces except VA interfaces. For information about VA interfaces, see PPP in Layer 2—WAN Access Configuration Guide. If you specify an Ethernet interface, you do not need to specify the slot slot-number option.

inbound: Specifies the inbound direction.

outbound: Specifies the outbound direction.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays ACL application information for packet filtering for the active MPU.

Usage guidelines

If neither the inbound keyword nor the outbound keyword is specified, this command displays ACL application information for packet filtering in both directions.

Examples

# Display ACL application information for inbound packet filtering on interface Ten-GigabitEthernet 0/0/6.

<Sysname> display packet-filter interface ten-gigabitethernet 0/0/6 inbound

Interface: Ten-GigabitEthernet0/0/6

 Inbound policy:

  IPv4 ACL 2001

  IPv6 ACL 2002 (Failed)

  MAC ACL 4003

Table 1 Command output

Field	Description
Interface	Interface to which the ACL applies.
Inbound policy	ACL used for filtering incoming traffic.
Outbound policy	ACL used for filtering outgoing traffic.
IPv4 ACL 2001	IPv4 basic ACL 2001 has been successfully applied.
IPv6 ACL 2002 (Failed)	The device has failed to apply IPv6 basic ACL 2002.
IPv4 default action	Packet filter default action for packets that do not match any IPv4 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.
IPv6 default action	Packet filter default action for packets that do not match any IPv6 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.
MAC default action	Packet filter default action for packets that do not match any Layer 2 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.

‌

display packet-filter statistics

Use display packet-filter statistics to display packet filtering statistics.

Syntax

display packet-filter statistics interface interface-type interface-number { inbound | outbound } [ default | [ ipv6 | mac ] { acl-number | name acl-name } ] [ brief ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number.

inbound: Specifies the inbound direction.

outbound: Specifies the outbound direction.

default: Displays the default action statistics for packet filtering.

ipv6: Specifies the IPv6 ACL type.

mac: Specifies the Layer 2 ACL type.

acl-number: Specifies an ACL by its number. The following are available value ranges:

·     2000 to 2999 for basic ACLs.

·     3000 to 3999 for advanced ACLs.

·     4000 to 4999 for Layer 2 ACLs.

name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.

brief: Displays brief statistics.

Usage guidelines

If you do not specify any parameters, this command displays packet filtering statistics for all ACLs.

To specify the IPv4 ACL type, do not specify the ipv6 keyword.

Examples

# Display packet filtering statistics for all ACLs on incoming packets of Ten-GigabitEthernet 0/0/6.

<Sysname> display packet-filter statistics interface ten-gigabitethernet 0/0/6 inbound

Interface: Ten-GigabitEthernet0/0/6

 Inbound policy:

  IPv4 ACL 2001

   From 2019-06-04 10:25:21 to 2019-06-04 10:35:57

   rule 0 permit source 2.2.2.2 0 (2 packets)

   rule 5 permit source 1.1.1.1 0 (Failed)

   rule 10 permit vpn-instance test (No resource)

   Totally 2 packets permitted, 0 packets denied

   Totally 100% permitted, 0% denied

 

  IPv6 ACL 2000

 

  MAC ACL 4000

   rule 0 permit

 

  IPv4 default action: Deny

   From 2019-06-04 10:25:21 to 2019-06-04 10:35:57

   Totally 7 packets

 

  IPv6 default action: Deny

   From 2019-06-04 10:25:41 to 2019-06-04 10:35:57

   Totally 0 packets

  MAC default action: Deny

   From 2019-06-04 10:25:34 to 2019-06-04 10:35:57

   Totally 0 packets

Table 2 Command output

Field	Description
Interface	Interface to which the ACL applies.
Inbound policy	ACL used for filtering incoming traffic.
Outbound policy	ACL used for filtering outgoing traffic.
IPv4 ACL 2001	IPv4 basic ACL 2001 has been successfully applied.
IPv4 ACL 2002 (Failed)	The device has failed to apply IPv4 basic ACL 2002.
From 2019-06-04 10:25:21 to 2019-06-04 10:35:57	Start time and end time of the statistics.
2 packets	Two packets matched the rule. This field is not displayed when no packets matched the rule.
No resource	Resources are not enough for counting matches for the rule. In packet filtering statistics, this field is displayed for a rule when resources are not sufficient for rule match counting.
rule 5 permit source 1.1.1.1 0 (Failed)	The device has failed to apply rule 5.
Totally 2 packets permitted, 0 packets denied	Number of packets permitted and denied by the ACL.
Totally 100% permitted, 0% denied	Ratios of permitted and denied packets to all packets.
IPv4 default action	Packet filter default action for packets that do not match any IPv4 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.
IPv6 default action	Packet filter default action for packets that do not match any IPv6 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.
MAC default action	Packet filter default action for packets that do not match any Layer 2 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.
Totally 7 packets	The default action has been executed on seven packets.

‌

Related commands

reset packet-filter statistics

display packet-filter statistics sum

Use display packet-filter statistics sum to display accumulated packet filtering statistics for an ACL.

Syntax

display packet-filter statistics sum { inbound | outbound } [ ipv6 | mac ] { acl-number | name acl-name } [ brief ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

inbound: Specifies the inbound direction.

outbound: Specifies the outbound direction.

ipv6: Specifies the IPv6 ACL type.

mac: Specifies the Layer 2 ACL type.

acl-number: Specifies an ACL by its number. The following are available value ranges:

·     2000 to 2999 for basic ACLs.

·     3000 to 3999 for advanced ACLs.

·     4000 to 4999 for Layer 2 ACLs.

name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.

brief: Displays brief statistics.

Usage guidelines

To specify the IPv4 ACL type, do not specify the ipv6 keyword.

Examples

# Display accumulated packet filtering statistics for IPv4 basic ACL 2001 on incoming packets.

<Sysname> display packet-filter statistics sum inbound 2001

Sum:

 Inbound policy:

  IPv4 ACL 2001

   rule 0 permit source 2.2.2.2 0 (2 packets)

   rule 5 permit source 1.1.1.1 0

   rule 10 permit vpn-instance test

   Totally 2 packets permitted, 0 packets denied

   Totally 100% permitted, 0% denied

# Display brief accumulated packet filtering statistics for IPv4 basic ACL 2000 on incoming packets.

<Sysname> display packet-filter statistics sum inbound 2000 brief

Sum:

 Inbound policy:

  IPv4 ACL 2000

   Totally 2 packets permitted, 0 packets denied

   Totally 100% permitted, 0% denied

Table 3 Command output

Field	Description
Sum	Accumulated packet filtering statistics.
Inbound policy	Accumulated packet filtering statistics in the inbound direction.
Outbound policy	Accumulated packet filtering statistics in the outbound direction.
IPv4 ACL 2001	Accumulated packet filtering statistics of IPv4 basic ACL 2001.
2 packets	Two packets matched the rule. This field is not displayed when no packets matched the rule.
Totally 2 packets permitted, 0 packets denied	Number of packets permitted and denied by the ACL.
Totally 100% permitted, 0% denied	Ratios of permitted and denied packets to all packets.

 

Related commands

reset packet-filter statistics

display packet-filter verbose

Use display packet-filter verbose to display ACL application details for packet filtering.

Syntax

display packet-filter verbose interface interface-type interface-number { inbound | outbound } [ [ ipv6 | mac ] { acl-number | name acl-name } ] [ slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface interface-type interface-number: Specifies an interface by its type and number. The slot slot-number option is not available for an Ethernet interface.

inbound: Specifies the inbound direction.

outbound: Specifies the outbound direction.

ipv6: Specifies the IPv6 ACL type.

mac: Specifies the Layer 2 ACL type.

acl-number: Specifies an ACL by its number. The following are available value ranges:

·     2000 to 2999 for basic ACLs.

·     3000 to 3999 for advanced ACLs.

·     4000 to 4999 for Layer 2 ACLs.

name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays ACL application details for packet filtering for the active MPU.

Usage guidelines

If acl-number, name acl-name, ipv6, or mac is not specified, this command displays application details of all ACLs for packet filtering.

To specify the IPv4 ACL type, do not specify the ipv6 keyword.

Examples

# Display application details of all ACLs for inbound packet filtering on Ten-GigabitEthernet 0/0/6.

<Sysname> display packet-filter verbose interface ten-gigabitethernet 0/0/6 inbound

Interface: Ten-GigabitEthernet0/0/6

 Inbound policy:

  IPv4 ACL 2001

   rule 0 permit

   rule 5 permit source 1.1.1.1 0 (Failed)

   rule 10 permit vpn-instance test (Failed)

 

  IPv6 ACL 2000

   rule 0 permit

 

  MAC ACL 4000

 

  IPv4 default action: Deny

 

  IPv6 default action: Deny

 

  MAC default action: Deny

Table 4 Command output

Field	Description
Interface	Interface to which the ACL applies.
Inbound policy	ACL used for filtering incoming traffic.
Outbound policy	ACL used for filtering outgoing traffic.
IPv4 ACL 2001	IPv4 basic ACL 2001 has been successfully applied.
IPv4 ACL 2002 (Failed)	The device has failed to apply IPv4 basic ACL 2002.
rule 5 permit source 1.1.1.1 0 (Failed)	The device has failed to apply rule 5.
IPv4 default action	Packet filter default action for packets that do not match any IPv4 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.
IPv6 default action	Packet filter default action for packets that do not match any IPv6 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.
MAC default action	Packet filter default action for packets that do not match any Layer 2 ACLs: ·     Deny—The default action deny has been successfully applied for packet filtering. ·     Deny (Failed)—The device has failed to apply the default action deny for packet filtering. The action permit still functions. ·     Permit—The default action permit has been successfully applied for packet filtering.

‌

packet-filter

Use packet-filter to apply an ACL to an interface to filter packets.

Use undo packet-filter to remove an ACL from an interface.

Syntax

packet-filter [ ipv6 | mac ] { acl-number | name acl-name } { inbound | outbound }

undo packet-filter [ ipv6 | mac ] { acl-number | name acl-name } { inbound | outbound }

Default

No ACL is applied to an interface to filter packets.

Views

Interface view

Predefined user roles

network-admin

Parameters

ipv6: Specifies the IPv6 ACL type.

mac: Specifies the Layer 2 ACL type.

acl-number: Specifies an ACL by its number. The following are available value ranges:

·     2000 to 2999 for basic ACLs.

·     3000 to 3999 for advanced ACLs.

·     4000 to 4999 for Layer 2 ACLs.

name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.

inbound: Filters incoming packets.

outbound: Filters outgoing packets.

Usage guidelines

To specify the IPv4 ACL type, do not specify the ipv6 keyword.

To the same direction of an interface, you can apply a maximum of 32 ACLs.

Examples

# Apply IPv4 basic ACL 2001 to filter incoming traffic on Ten-GigabitEthernet 0/0/6.

<Sysname> system-view

[Sysname] interface ten-gigabitethernet 0/0/6

[Sysname-Ten-GigabitEthernet0/0/6] packet-filter 2001 inbound

Related commands

display packet-filter

display packet-filter statistics

display packet-filter verbose

packet-filter default deny

Use packet-filter default deny to set the packet filtering default action to deny. The packet filter denies packets that do not match any ACL rule.

Use undo packet-filter default deny to restore the default.

Syntax

packet-filter default deny

undo packet-filter default deny

Default

The packet filtering default action is permit. The packet filter permits packets that do not match any ACL rule.

Views

System view

Predefined user roles

network-admin

Usage guidelines

The packet filter applies the default action to all ACL applications for packet filtering. The default action appears in the display command output for packet filtering.

Examples

# Set the packet filter default action to deny.

<Sysname> system-view

[Sysname] packet-filter default deny

Related commands

display packet-filter

display packet-filter statistics

display packet-filter verbose

reset packet-filter statistics

Use reset packet-filter statistics to clear the packet filtering statistics.

Syntax

reset packet-filter statistics interface [ interface-type interface-number ] { inbound | outbound } [ default | [ ipv6 | mac ] { acl-number | name acl-name } ]

Views

User view

Predefined user roles

network-admin

Parameters

interface [ interface-type interface-number ]: Specifies an interface by its type and number. If you do not specify an interface, this command clears packet filtering statistics for all interfaces.

inbound: Specifies the inbound direction.

outbound: Specifies the outbound direction.

default: Clears the default action statistics for packet filtering.

ipv6: Specifies the IPv6 ACL type.

mac: Specifies the Layer 2 ACL type.

acl-number: Specifies an ACL by its number. The following are available value ranges:

·     2000 to 2999 for basic ACLs.

·     3000 to 3999 for advanced ACLs.

·     4000 to 4999 for Layer 2 ACLs.

name acl-name: Specifies an ACL by its name. The acl-name argument is a case-insensitive string of 1 to 63 characters.

Usage guidelines

If default, acl-number, name acl-name, ipv6, or macis not specified, this command clears the packet filtering statistics for all ACLs.

To specify the IPv4 ACL type, do not specify the ipv6 keyword.

Examples

# Clear IPv4 basic ACL 2001 statistics for inbound packet filtering on Ten-GigabitEthernet 0/0/6.

<Sysname> reset packet-filter statistics interface ten-gigabitethernet 0/0/6 inbound 2001

Related commands

display packet-filter statistics

display packet-filter statistics sum