基于acl的簡化流策略配置

ACL的簡化流策略配關(guān)于基于ACL介紹基于ACL的簡化流策略的配置注意事配置基于ACL的報(bào)文過配置基于ACL的流量（S1720、S2720、S2750、S5700LI、S5700S-LI、X-LI、S5720LI、S5720S-LI、S5720SI、S5720S-配置基于ACL的流 （S5720EI、S5720HI、S6720EI、S6720S-通過配置基于ACL的流 ，對匹配ACL規(guī)則的報(bào)文進(jìn)行限速配置基于ACL的重定向（S1720GFR、S2720、S2750、S5700LI、S5700S-LIS5710-X-通過配置基于ACL的重定向，將匹配ACL規(guī)則的報(bào)文重定向到CPU或指定接配置基于ACL的重定向（S1720GW-E、S1720GWR-E、S1720GW、S1720GWRS5720LI、S5720S-LI、S5720SI、S5720S-SI、S5720EI、S5720HI、S6720EI、配置基于ACL的重標(biāo)配置基于ACL的流量統(tǒng)通過配置基于ACL的流量統(tǒng)計(jì)，對匹配指定ACL規(guī)則的報(bào)文進(jìn)行配置基于ACL的流鏡基于ACL通過示例介紹如何應(yīng)用基于ACL的簡化流策略ACL介紹基于ACL的簡化流策略的配置注意事涉及License支版本支持基于ACL的簡化流策略的軟件版本如表11-1系產(chǎn)支持版V200R006C10、V200R009C00、系產(chǎn)支持版V200R006C10、V200R009C00、V100R006C01、V200R001C00、V200R002C00、S5700S-S5710-C-S5710-X-V200R008C00、V200R009C00、V200R001C00、V200R002C00、V200R003C00、S5720S-S5720S-V200R008C00、V200R009C00、V200R002C00、V200R003C00、V200R003C00、V200R002C00、V200R003C00、系產(chǎn)支持版V200R008C00、V200R009C00、S6720S-V200R009C00、說明如需了解交換機(jī)軟件配套詳細(xì)信息，請參看以太網(wǎng)交換機(jī)版本配套速查特性依 當(dāng)S1720、S2720EI、S2750、S5700LI、S5700S-LI、S5710-X-LI、S5720LI文過濾、流量、重標(biāo)記或流量統(tǒng)計(jì)功能不生效：出方向配置了基于ACL的報(bào)文過濾、流量、重標(biāo)記或流量統(tǒng)計(jì)功能ACL規(guī)則是基于VLANID接口上配置了VLANMap功能，且映射后的VLANID與ACL規(guī)則中的VLANID相同。 S5720HI不支持基于用戶自定義ACL的簡化流策 如果ACL規(guī)則匹配了報(bào)文的實(shí)例名稱，則簡化流策略下發(fā)不成功 ACL背景

用戶可以根據(jù)以下原則選用traffic-filter或traffic-secure命令配置報(bào)l如果traffic-filter或traffic-secure關(guān)聯(lián)的ACL沒有同時(shí)被其他基于ACL的簡化流策 為Deny時(shí)，僅traffic-secure、traffic-mirror和traffic-statistics命令生效，報(bào)文說明S2720、S2750EI、S5700-10P-LI-AC和S5700-10P-PWR-LI-AC使能IPv4報(bào)文三層硬件轉(zhuǎn)發(fā)功后，不支持配置traffic-secure 前置

l配置相關(guān)接口的鏈路層屬性，保證接口正常工作。l配置相應(yīng)的ACL規(guī)則。說明在全局或上實(shí)現(xiàn)的基于的報(bào)文過濾，范圍為2000～5999。在網(wǎng)絡(luò)中用于對用戶控制的基于C的報(bào)文過濾，范圍為6000～9999，參考traffic-ilercl。操作

在全局或VLAN上配置報(bào)文過執(zhí)行命令system-viewn執(zhí)行命令traffic-filter[vlanvlan-id]inboundaclipv6bas-acl|adv-acl|nameacl-name}|l2-acl|user-aclrulerule-id]，對匹配單個(gè)ACLn執(zhí)行命令traffic-securevlanvlan-idinboundaclbas-acl|adv-acl|l2–acl|nameacl-namerulerule-id]，對匹配單個(gè)ACL規(guī)則的入方向的報(bào) 執(zhí)行命令traffic-filtervlanvlan-idoutboundaclipv6bas-acl|adv-acl|nameacl-name}|l2-acl}[rulerule-id]，對匹配單個(gè)ACL規(guī)則的出 執(zhí)行命令traffic-filtervlanvlan-idinbound|outboundacll2-aclnameacl-namerulerule-idaclbas-acl|adv-acl|nameacl-name}rulerule-id]或traffic-filtervlanvlan-idinbound|outboundbas-acl|adv-acl|nameacl-namerulerule-idacll2-acl|nameacl-namerulerule-id]，對同時(shí)匹配二層ACL和三層ACL規(guī)則的報(bào)文進(jìn)行n執(zhí)行命令traffic-securevlanvlan-idinboundacll2–acl|nameacl-namerulerule-idaclbas-acl|adv-acl|nameacl-namerulerule- 執(zhí)行命令system-viewn執(zhí)行命令traffic-filterinboundaclipv6]{bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-id]，對匹配單個(gè)ACL規(guī)則的入方向n執(zhí)行命令traffic-secureinboundacl{bas-acl|adv-acl|l2–acl|nameacl-namerulerule-id]，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行過濾。n執(zhí)行命令traffic-filteroutboundaclipv6bas-acl|adv-acl|nameacl-name|l2-aclrulerule-id]，對匹配單個(gè)ACL規(guī)則的出方向的報(bào)文進(jìn) 執(zhí)行命令traffic-filterinbound|outboundacll2-acl|nameacl-name}[rulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]或traffic-filter{inbound|outbound}acl{bas-acl|adv-acl|nameacl-namerulerule-idacll2-acl|nameacl-namerulerule-id]，對同時(shí)n執(zhí)行命令traffic-secureinboundacl{l2–acl|nameacl-name}[rulerule-idaclbas-acl|adv-acl|nameacl-namerulerule-id]，對同時(shí)匹配二----配置基于ACL的流量（S1720、S2720、S2750、前置

在配置基于ACL的流量之前，需要完成以下任務(wù)： 操作

在全局或VLAN上配置流量執(zhí)行命令system-viewn執(zhí)行命令traffic-limitvlanvlan-idinboundaclipv6bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-idcircir-valuepirpir-valuecbscbs-valuepbspbs-valuegreenpassyellowdrop|passremark-8021p8021p-value|remark-dscpdscp-valuereddrop|passremark-8021p8021p-value|remark-dscpdscp-value，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行流量。n執(zhí)行命令traffic-limitvlanvlan-id]outboundaclipv6bas-acl|adv-acl|nameacl-name|l2-aclrulerule-idcircir-valuepirpir-value[cbscbs-valuepbspbs-value][greenpass][yellowpass][red{droppass}]，對匹配單個(gè)ACL規(guī)則的出方向的報(bào)文進(jìn)行流量 執(zhí)行命令traffic-limitvlanvlan-idinboundacll2-acl|nameacl-name}[rulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]circir-value[pirpir-value][cbscbs-valuepbspbs-value][greenpass][yellow{drop|pass[remark-8021p8021p-value|remark-dscpdscp-value]}][red{drop|pass[remark-8021p8021p-value|remark-dscp量。 執(zhí)行命令traffic-limit[vlanvlan-id]outboundacl{l2-acl|nameacl-namerulerule-idaclbas-acl|adv-acl|nameacl-namerulerule-id]circir-value[pirpir-value][cbscbs-valuepbspbs-value][greenpassyellowpassreddrop|pass，對同時(shí)匹配二層ACL和三層ACL的出方向的報(bào)文進(jìn)行流量。說明 <lcbs-value≤<pbs-value ≥ 執(zhí)行命令system-viewn執(zhí)行命令traffic-limitinboundaclipv6bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-idcircir-valuepirpir-valuecbscbs-valuepbspbs-value][greenpass][yellow{drop|pass[remark-8021p8021p-value|remark-dscpdscp-value]}][red{drop|passremark-8021p8021p-value|remark-dscpdscp-value，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行流量。n執(zhí)行命令traffic-limitoutboundaclipv6bas-acl|adv-acl|nameacl-name|l2-aclrulerule-idcircir-valuepirpir-valuecbscbs-valuepbspbs-valuegreenpassyellowpassreddrop|pass，對匹配單個(gè)ACL規(guī)則的出方向的報(bào)文進(jìn)行流量。 執(zhí)行命令traffic-limitinboundacll2-acl|nameacl-namerulerule-id]aclbas-acl|adv-acl|nameacl-namerulerule-idcircir-valuepirpir-valuecbscbs-valuepbspbs-valuegreenpassyellowdrop|passremark-8021p8021p-value|remark-dscpdscp-valuereddrop|passremark-8021p8021p-value|remark-dscpdscp-value，對同時(shí)匹配二層ACL和三層ACL的入方向的報(bào)文進(jìn)行流量。 執(zhí)行命令traffic-limitoutboundacl{l2-acl|nameacl-name}[rulerule-idaclbas-acl|adv-acl|nameacl-namerulerule-idcircir-valuepirpir-valuecbscbs-valuepbspbs-valuegreenpassyellowpassred{drop|pass}]，對同時(shí)匹配二層ACL和三層ACL的出方向的報(bào)文進(jìn)行流 說明 <lcbs-value≤<pbs-value ≥----配置基于 的流量（S5720EI、S5720HIS6720EI、S6720S-通過配置基于ACL的流量，對匹配ACL規(guī)則的報(bào)文進(jìn)行限速前置在配置基于ACL的流量之前，需要完成以下任務(wù)：l配置相關(guān)接口的鏈路層屬性，保證接口正常工作。l配置相應(yīng)的ACL規(guī)則。操作

在全局或VLAN上配置流量執(zhí)行命令system-viewn執(zhí)行命令traffic-limitvlanvlan-idinboundaclipv6bas-acl|adv-acl|nameacl-name}|l2-acl|user-acl}[rulerule-id]circir-value[pirpir-valuecbscbs-valuepbspbs-valuegreendrop|passdrop|passreddrop|pass，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行流量。 執(zhí)行命令traffic-limitvlanvlan-idoutboundaclipv6bas-acl|adv-acl|nameacl-name}|l2-acl}[rulerule-id]circir-value[pirpir-value][cbscbs-valuepbspbs-value][[green{drop|pass}][yellow{drop|pass}][red{drop|pass}]]，對匹配單個(gè)ACL規(guī)則的出方向的報(bào)文進(jìn)行流量。 執(zhí)行命令traffic-limitvlanvlan-idinboundacll2-acl|nameacl-name}[rulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]circir-value[pirpir-value][cbscbs-valuepbspbs-value][[green{drop|passyellowdrop|passreddrop|pass，對同時(shí)匹配二層ACL和三層ACL的入方向的報(bào)文進(jìn)行流量。 執(zhí)行命令traffic-limit[vlanvlan-id]outboundacl{l2-acl|nameacl-namerulerule-idaclbas-acl|adv-acl|nameacl-namerulerule-id]circir-value[pirpir-value][cbscbs-valuepbspbs-valuedrop|passyellowdrop|passreddrop|pass，對同時(shí)匹配二層和三層ACL的出方向的報(bào)文進(jìn)行流量。n執(zhí)行命令traffic-limitvlanvlan-idoutboundaclbas-acl|adv-acl|nameacl-namerulerule-idacll2-acl|nameacl-namerulerule-idcircir-value[pirpir-valuecbscbs-valuepbspbs-valuedrop|passyellowdrop|passreddrop|pass，對同時(shí)匹配二層和三層ACL的出方向的報(bào)文進(jìn)行流量。說明 <lcbs-value≤<pbs-value ≥ 執(zhí)行命令system-viewn執(zhí)行命令traffic-limitinboundaclipv6bas-acl|adv-acl|nameacl-name}|l2-acl|user-acl}[rulerule-id]circir-value[pirpir-value][cbscbs-valuepbspbs-valuegreendrop|passyellowdrop|passreddrop|pass，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行流量監(jiān)n執(zhí)行命令traffic-limitoutboundaclipv6bas-acl|adv-acl|nameacl-name|l2-aclrulerule-idcircir-valuepirpir-valuecbscbs-valuepbspbs-value][[green{drop|pass}][yellow{drop|pass}][red{drop|pass}]]，對匹配單個(gè)ACL規(guī)則的出方向的報(bào)文進(jìn)行流量n執(zhí)行命令traffic-limitinboundacl{bas-acl|adv-acl|nameacl-name}rulerule-idacll2-acl|nameacl-namerulerule-idcircir-valuepirpir-valuecbscbs-valuepbspbs-valuegreendrop|passyellowdrop|passreddrop|pass，對同時(shí)匹配二層ACL和三層ACL規(guī)則的入方向的報(bào)文進(jìn)行流量。 執(zhí)行命令traffic-limitinboundacll2-acl|nameacl-namerulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]circir-value[pirpir-valuecbscbs-valuepbspbs-valuegreendrop|passdrop|passreddrop|pass，對同時(shí)匹配二層ACL和三層 執(zhí)行命令traffic-limitoutboundacl{l2-acl|nameacl-name}[rulerule-idaclbas-acl|adv-acl|nameacl-namerulerule-idcircir-valuepirpir-value][cbscbs-valuepbspbs-valuegreen{drop|pass}][yellowdrop|passreddrop|pass，對同時(shí)匹配二層ACL和三層n執(zhí)行命令traffic-limitoutboundaclbas-acl|adv-acl|nameacl-name}[rulerule-id]acl{l2-acl|nameacl-namerulerule-idcircir-valuepirpir-value][cbscbs-valuepbspbs-valuegreen{drop|passyellowdrop|passreddrop|pass，對同時(shí)匹配二層ACL和三層ACL規(guī)則的出方向的報(bào)文進(jìn)行流量。說明 <lcbs-value≤<pbs-value ≥----配置基于 的重定向（S1720GFR、S2720、S2750S5700LI、S5700S-LI、S5710-X-通過配置基于ACL的重定向，將匹配ACL規(guī)則的報(bào)文重定向到CPU或指定接前置在配置基于ACL的重定向之前，需要完成 操作

在全局或VLAN上配置重定執(zhí)行命令system-view 執(zhí)行命令traffic-redirect[vlanvlan-id]inboundacl{[ipv6]{bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-idcpu|interfaceinterface-typeinterface-number}，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn) 執(zhí)行命令traffic-redirect[vlanvlan-id]inboundacll2-acl[rulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]{cpu|interface 執(zhí)行命令traffic-redirectvlanvlan-idinboundaclbas-acl|adv-aclrulerule-idacll2-acl|nameacl-namerulerule-idcpu|interfaceinterface-typeinterface-number}，對同時(shí)匹配二層和三層ACL規(guī)則的入方 執(zhí)行命令traffic-redirectvlanvlan-idinboundaclnameacl-namerule-id]acl{bas-acl|adv-acl|l2-acl|nameacl-name}[rulerule-idcpu|interfaceinterface-typeinterface-number}，對同時(shí)匹配二層和三層 執(zhí)行命令system-viewn執(zhí)行命令traffic-redirectinboundaclipv6bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-idcpu|interfaceinterface-typeinterface-number}，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行重定向。 執(zhí)行命令traffic-redirectinboundacll2-acl[rulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]{cpu|interfaceinterface-type 執(zhí)行命令traffic-redirectinboundaclbas-acl|adv-aclrulerule-id{l2-acl|nameacl-name}[rulerule-id]{cpu|interfaceinterface-type 執(zhí)行命令traffic-redirectinboundaclnameacl-namerulerule-id{bas-acl|adv-acl|l2-acl|nameacl-namerulerule-idcpu|interfaceinterface-typeinterface-number}，對同時(shí)匹配二層和三層ACL規(guī)則的入方----前置

說明操作

在全局或VLAN上配置重定執(zhí)行命令system-view 執(zhí)行命令traffic-redirect[vlanvlan-id]inboundacl{[ipv6]{bas-acl|adv-acl|nameacl-name}|l2-acl|user-acl}[rulerule-id]{cpu|interfaceinterface-typeinterface-number|[-instance -instance-name]ip-nexthopip-nexthop|ipv6-nexthopipv6-nexthop}，對匹配單個(gè)ACL規(guī)則的 執(zhí)行命令traffic-redirectvlanvlan-idinboundacll2-aclrulerule-idacl{bas-acl|adv-acl|nameacl-name}[rulerule-id]{cpu|interface-typeinterface-number|[ -instance-name]ip-nexthopip-nexthop|ipv6-nexthopipv6-nexthop}，對同時(shí)匹配二層ACL和 執(zhí)行命令traffic-redirectvlanvlan-idinboundaclbas-acl|adv-aclrulerule-idacll2-acl|nameacl-namerulerule-idcpu|interfaceinterface-typeinterface-number|[ -instance-name]ip-nexthopip-nexthop|ipv6-nexthopipv6-nexthop}，對同時(shí)匹配二層ACL和 執(zhí)行命令traffic-redirectvlanvlan-idinboundaclnameacl-namerule-id]acl{bas-acl|adv-acl|l2-acl|nameacl-name}[rulerule-id{cpu|interfaceinterface-typeinterface-number|[ instance-nameip-nexthopip-nexthop|ipv6-nexthopipv6-nexthop}，對同說明S1720GW-E、S1720GWR-E、S1720GW、S1720GWR、S5720LI、S5720S-LI不支- -instance-name 執(zhí)行命令system-viewn執(zhí)行命令traffic-redirectinboundacl{[ipv6]{bas-acl|adv-acl|nameacl-name}|l2-acl|user-acl}[rulerule-idcpu|interfaceinterface-typeinterface-number|[-instance-instance-nameip-nexthopip- 執(zhí)行命令traffic-redirectinboundacll2-acl[rulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]{cpu|interfaceinterface-typeinterface-number|[ -instance-name]ip-nexthopip-nexthop 執(zhí)行命令traffic-redirectinboundaclbas-acl|adv-aclrulerule-id{l2-acl|nameacl-name}[rulerule-id]{cpu|interfaceinterface-typeinterface-number|[ -instance-name]ip-nexthopip-nexthop|ipv6-nexthopipv6-nexthop}，對同時(shí)匹配二層ACL和三層ACL的入方向 執(zhí)行命令traffic-redirectinboundaclnameacl-namerulerule-idbas-acl|adv-acl|l2-acl|nameacl-namerulerule-idcpu|interfaceinterface-typeinterface-number|[ -instance-name]ip-nexthopip-nexthop|ipv6-nexthopipv6-nexthop}，對同時(shí)匹配二層ACL和說明S1720GW-E、S1720GWR-E、S1720GW、S1720GWR、S5720LI、S5720S-LI不支- -instance-name----ACL的重前置 操作

在全局或VLAN上配置重標(biāo)執(zhí)行命令system-viewn執(zhí)行命令traffic-remark[vlanvlan-id]inboundaclipv6bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-id8021p8021p-value|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan-id}，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行重標(biāo)記。n執(zhí)行命令traffic-remark[vlanvlan-idoutboundacl{[ipv6]{bas-acl|adv-acl|nameacl-name}|l2-acl}[rulerule-id]{8021p8021p-value|cvlan-idcvlan-id|dscpdscp-name|dscp-value|vlan-idvlan-id}，對匹n執(zhí)行命令traffic-remarkvlanvlan-idinboundacll2-aclrulerule-idacl{bas-acl|adv-acl|nameacl-name}[rulerule-id]{8021p8021p-|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan-id}，對同時(shí)匹配二層ACL和三層ACL規(guī)則的入方向的報(bào)文 執(zhí)行命令traffic-remarkvlanvlan-idinboundaclbas-acl|adv-aclrulerule-idacll2-acl|nameacl-namerulerule-id8021p8021p-value|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan-id}，對同時(shí)匹配二層ACL和三層ACL規(guī)則的入方向的報(bào)文 執(zhí)行命令traffic-remarkvlanvlan-idinboundaclnameacl-namerule-id]acl{bas-acl|adv-acl|l2-acl|nameacl-name}[rulerule-id{8021p8021p-value|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan-id}，對同時(shí)匹配二層ACL和三層ACL規(guī)則 執(zhí)行命令traffic-remarkvlanvlan-idoutboundacll2-aclrulerule-idacl{bas-acl|adv-acl|nameacl-name}[rulerule-id]{8021p8021p-|cvlan-idcvlan-id|dscpdscp-name|dscp-value|vlan-idvlan-id}，對同n執(zhí)行命令traffic-remarkvlanvlan-idoutboundacl{bas-acl|adv-acl}rulerule-idacll2-acl|nameacl-namerulerule-id8021pvalue|cvlan-idcvlan-id|dscp{dscp-name|dscp-value}|vlan-id 執(zhí)行命令traffic-remarkvlanvlan-idoutboundaclnameacl-namerule-id]acl{bas-acl|adv-acl|l2-acl|nameacl-name}[rulerule-id{8021p8021p-value|cvlan-idcvlan-id|dscp{dscp-name|dscp-value}|說明S1720、S2720、S2750、S5700LI、S5700S-LI、S5710-X-LI、S5720LI、S5720S-LIS1720、S2720、S2750、S5700LI、S5700S-LI、S5710-X-LI、S5720LI、S5720S-LI 執(zhí)行命令system-view 執(zhí)行命令traffic-remarkinboundacl{[ipv6]{bas-acl|adv-acl|nameacl-name}|l2-acl|user-acl}[rulerule-id]{8021p8021p-value|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan-id}，對匹配單個(gè)ACL規(guī)則的入方向的報(bào)文進(jìn)行重標(biāo)記。n執(zhí)行命令traffic-remarkoutboundaclipv6bas-acl|adv-acl|nameacl-name|l2-aclrulerule-id8021p8021p-value|cvlan-idcvlan-id|dscpdscp-name|dscp-value|vlan-idvlan-id}，對匹配單個(gè)ACL規(guī)則的 執(zhí)行命令traffic-remarkinboundacll2-acl[rulerule-id]acl{bas-acl|adv-acl|nameacl-namerulerule-id8021p8021p-value|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan- 執(zhí)行命令traffic-remarkinboundaclbas-acl|adv-aclrulerule-idl2-acl|nameacl-namerulerule-id8021p8021p-value|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan- 執(zhí)行命令traffic-remarkinboundaclnameacl-namerulerule-idbas-acl|adv-acl|l2-acl|nameacl-namerulerule-id8021p8021p-value|destination-macmac-address|dscp{dscp-name|dscp-value}|ip-precedenceip-precedence-value|local-precedencelocal-precedence-value|vlan-idvlan-id}，對同時(shí)匹配二層ACL和三層ACL規(guī)則的入方向的報(bào)文 執(zhí)行命令traffic-remarkoutboundacll2-acl[rulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]{8021p8021p-value|cvlan-idcvlan-id|dscpdscp-name|dscp-value|vlan-idvlan-id}，對同時(shí)匹配二n執(zhí)行命令traffic-remarkoutboundacl{bas-acl|adv-aclrulerule-id]acll2-acl|nameacl-namerulerule-id8021p8021p-value|cvlan-idcvlan-id|dscpdscp-name|dscp-value|vlan-idvlan-id}，對同時(shí)匹配二 執(zhí)行命令traffic-remarkoutboundaclnameacl-namerulerule-id{bas-acl|adv-acl|l2-acl|nameacl-name}[rulerule-id]{8021p8021p-value|cvlan-idcvlan-id|dscp{dscp-name|dscp-value}|vlan-idvlan-----

說明S1720、S2720、S2750、S5700LI、S5700S-LI、S5710-X-LI、S5720LI、S5720S-LIS1720、S2720、S2750、S5700LI、S5700S-LI、S5710-X-LI、S5720LI、S5720S-LIACL通過配置基于ACL的流量統(tǒng)計(jì)，對匹配指定ACL規(guī)則的報(bào)文進(jìn)行前置l配置相關(guān)接口的鏈路層屬性，保證接口正常工作。l配置相應(yīng)的ACL規(guī)則。操作

在全局或VLAN上配置流量統(tǒng)執(zhí)行命令system-view 執(zhí)行命令traffic-statistic[vlanvlan-id]inboundacl{[ipv6]{bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-idby-bytes]，對n執(zhí)行命令traffic-statistic[vlanvlan-id]outboundaclipv6]{bas-acl|adv-acl|nameacl-name}|l2-acl|user-aclrulerule-id]，對匹配單個(gè)n執(zhí)行命令traffic-statistic[vlanvlan-id]inboundacll2-acl[rulerule-id]aclbas-acl|adv-acl|nameacl-namerulerule-idby-bytes]，對同時(shí)n執(zhí)行命令traffic-statisticvlanvlan-idinboundaclbas-acl|adv-aclrulerule-idacll2-acl|nameacl-namerulerule-idby-bytes]，對 執(zhí)行命令traffic-statistic[vlanvlan-id]inboundaclnameacl-name[rulerule-idaclbas-acl|adv-acl|l2-acl|nameacl-namerulerule-idby-bytes]，對同時(shí)匹配二層ACL和三層ACL規(guī)則的入方向的報(bào)文進(jìn)行流量n執(zhí)行命令traffic-statisticvlanvlan-idoutboundacll2-aclrulerule-id]acl{bas-acl|adv-acl|nameacl-name}[rulerule-id]，對同時(shí)匹配二層 執(zhí)行命令traffic-statistic[vlanvlan-id]outboundacl{bas-acl|adv-acl}rulerule-idacll2-acl|nameacl-namerulerule-id]，對同時(shí)匹配二n執(zhí)行命令traffic-statistic[vlanvlan-id]outboundaclnameacl-name[rulerule-id]aclbas-acl|adv-acl|l2-acl|nameacl-name}[rulerule-id]，對 執(zhí)行命令system-viewn執(zhí)行命令traffic-statisticinboundaclipv6bas-acl|adv-acl|nameacl-name|l2-acl|user-aclrulerule-idby-bytes]，對匹配單個(gè)ACL 執(zhí)行命令traffic-statisticoutboundacl{[ipv6]{bas-acl|adv-acl|nameacl-name|l2-aclrulerule-id]，對匹配單個(gè)ACL規(guī)則的出方向的報(bào)文n執(zhí)行命令traffic-statisticinboundacll2-acl[rulerule-id]acl{bas-acl|adv-acl|nameacl-namerulerule-idby-bytes]，對同時(shí)匹配二層n執(zhí)行命令traffic-statisticinboundaclbas-acl|adv-aclrulerule-idl2-acl|nameacl-namerulerule-idby-bytes]，對同時(shí)匹配二層n執(zhí)行命令traffic-statisticinboundaclnameacl-namerulerule-id]bas-acl|adv-acl|l2-acl|nameacl-namerulerule-idby-bytes]，對 執(zhí)行命令traffic-statisticoutboundacll2-aclrulerule-idaclbas-acl|adv-acl|nameacl-name}[rulerule-id]，對同時(shí)匹配二層ACL和三層n執(zhí)行命令traffic-statisticoutboundacl{bas-acl|adv-acl}[rulerule-id]acll2-acl|nameacl-namerulerule-id]，對同時(shí)匹配二層ACL和三層n執(zhí)行命令traffic-statisticoutboundaclnameacl-namerulerule-idbas-acl|adv-acl|l2-acl|nameacl-namerulerule-id]，對同時(shí)匹配二----ACL的流有關(guān)基于ACL的流鏡像的配置，請參見《S1720&S2700&S5700&S6720V200R010C00配置指南-網(wǎng)絡(luò)管理與》鏡像配置中的“配置基于ACL的本地流鏡像”和“配置ACL查看基于ACL的報(bào)文過濾的流量統(tǒng)計(jì)信背景

操作

執(zhí)行以下命令查看設(shè)備上基于ACL的報(bào)文過濾的流量統(tǒng)計(jì)信息disytraffic-statistics[vlanvlan-id|interfaceinterface-typeinterface-number]{inbound|outbound}[acl{bas-acl|adv-acl|user-acl}[rulerule-id]]disytraffic-statistics[vlanvlan-id|interfaceinterface-typeinterface-number]{inbound|outbound}[acl{acl-name|l2-acl}[rulerule-id][acl{bas-acl|adv-acl|acl-name}[rulerule-id]]disytraffic-statisticsinterface{inbound|outbounddisytraffic-statistics[vlanvlan-id|interfaceinterface-typeinterface-number]{inbound|outbound}[aclipv6{bas-acl|adv-acl|acl-name}[rulerule-id]]----清除基于ACL的報(bào)文過濾的流量統(tǒng)計(jì)信背景

注注操作

執(zhí)行以下命令清除設(shè)備上基于ACL的報(bào)文過濾的流量統(tǒng)計(jì)信息resettraffic-statistics[vlanvlan-id|interfaceinterface-typeinterface-number{inbound|outbound}[acl{bas-acl|adv-acl|user-acl}[rulerule-id]resettraffic-statistics[vlanvlan-id|interfaceinterface-typeinterface-number{inbound|outbound}[acl{acl-name|l2-acl}[rulerule-id][acl{bas-acladv-acl|acl-name}[rulerule-id]]resettraffic-statistics{interface|vlan}{inbound|outboundresettraffic-statistics[vlanvlan-id|interfaceinterface-typeinterface-number{inbound|outbound}[aclipv6{bas-acl|adv-acl|acl-name}[rulerule-id]----配置通過示例介紹如何應(yīng)用基于ACL的簡化流策略配置指定主機(jī)網(wǎng)絡(luò)示組網(wǎng)

如圖11-1所示，企業(yè)用戶通過Switch的接口GE0/0/2連接到外部網(wǎng)絡(luò)設(shè)備圖11-1配置指定主機(jī)網(wǎng)絡(luò)組網(wǎng)IP:IP:IP:IP:配置

配置各接口，實(shí)現(xiàn)企業(yè)用戶能通過Switch外部網(wǎng)絡(luò)配置時(shí)間范圍，用于在ACL中配置ACL，在工作時(shí)間段報(bào)文通過在接口GE0/0/1操作

步驟1創(chuàng)建VLAN#在Switch上創(chuàng)建VLAN10<<[>system-]sysname[Switch]vlan[Switch-vlan10]#[Switch][Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/1]portlink-type[Switch-GigabitEthernet0/0/1]porttrunkallow-passvlan10[Switch-GigabitEthernet0/0/1]quit[Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/2]portlink-type[Switch-GigabitEthernet0/0/2]porttrunkallow-passvlan10[Switch-GigabitEthernet0/0/2]quit說明請配置LSW與Switch對接的接口為Trunk類型，并加入VLAN10#[Switch][Switch]interfacevlanif[Switch-Vlanif10]ipaddress192.168.1.124[Switch-Vlanif10]quit說明請配置Router與Switch對接的接口IP地址為192.168.1.2/24步驟2創(chuàng)建周期時(shí)間段working_time，時(shí)間范圍為每天的8:30～18:00[Switch]time-rangeworking_time08:30to18:00working- 步驟3配置ACL3001，配置三條規(guī)則，分別為源IP地址為192.168.1.10、192.168.1.11[Switch]acl[Switch]aclnumber[Switch-acl-adv-3001]ruledenyipsource192.168.1.100time-range[Switch-acl-adv-3001]ruledenyipsource192.168.1.110time-rangeworking_time[Switch-acl-adv-3001]ruledenyipsource192.168.1.120time-rangeworking_time[Switch-acl-adv-3001]quit步驟4在接口GE0/0/1[Switch][Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/1]traffic-filterinboundacl3001[Switch-GigabitEthernet0/0/1]quit步驟5#[Switch][Switch] ytraffic-appliedinterfacegigabitethernet0/0/1ACLappliedinboundinterfaceGigabitEthernet0/0/1ACL3001rule5denyipsource192.168.1.100time-rangeworking_time(match-counterACLrule10denyipsource192.168.1.110time-rangeworking_time(match-counter0)ACLrule15denyipsource192.168.1.120time-rangeworking_time(match-counter0)----配置

Switch的配置文##time-rangeworking_time08:30to18:00working-dayaclnumberrule5denyipsource192.168.1.100time-rangerule10denyipsource192.168.1.110time-rangerule15denyipsource192.168.1.120time-range#interfaceipaddress192.168.1.1#portlink-typetrunkporttrunkallow-passvlan10traffic-filterinboundacl3001portlink-typetrunkporttrunkallow-passvlan#配置對不VLAN組網(wǎng)

應(yīng)的VLANID為100。具體配置需求如表11-2所示流量類圖11-2流量配置組網(wǎng)VLANVLAN配置創(chuàng)建VLAN，并配置各接口，使企業(yè)能夠通過Switch網(wǎng)絡(luò)在Switch上配置ACL匹配不同的VLANID在Switch上配置基于ACL的流量，對來自企業(yè)的報(bào)文分別限速操作

步驟1創(chuàng)建VLAN <<[>system-]sysname[Switch]vlanbatch100110#GE0/0/2加入VLAN100、VLAN110、VLAN120[Switch][Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/1]portlink-type[Switch-GigabitEthernet0/0/1]porttrunkallow-passvlan100110120[Switch-GigabitEthernet0/0/1]quit[Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/2]portlink-type[Switch-GigabitEthernet0/0/2]porttrunkallow-passvlan100110120[Switch-GigabitEthernet0/0/2]quit步驟2配置#[Switch][Switch]acl[Switch-acl-L2-4001]rule1permitvlan-id120[Switch-acl-L2-4001]quit[Switch]acl[Switch-acl-L2-4002]rule1permitvlan-id[Switch]acl4003[Switch-acl-L2-4003]rule1permitvlan-id100[Switch-acl-L2-4003]quit步驟3#在Switch的接口GE0/0/1入方向上配置流量，對來自企業(yè)的報(bào)文進(jìn)行限速[Switch][Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/1]traffic-limitinboundacl4001cir2000pir[Switch-GigabitEthernet0/0/1]traffic-limitinboundacl4002cir4000pir[Switch-GigabitEthernet0/0/1]traffic-limitinboundacl4003cir4000pir10000[Switch-GigabitEthernet0/0/1]quit步驟4#[Switch]disytraffic-appliedinterface0/0/1ACLappliedinboundinterfaceACLrule1permitvlan-id120limitcir2000,cbspir10000,pbsgreen:passyellow:passred:dropACLrule1permitvlan-id110limitcir4000,cbspir10000,pbsgreen:passyellow:passred:dropACLrule1permitvlan-id100limitcir4000,cbspir10000,pbsgreen:passyellow:passred:drop----配置

Switch的配置文##vlanbatch100110120aclnumberrule1permitvlan-idaclnumberrulerule1permitvlan-idaclnumberrule1permitvlan-id#portlink-typetrunkporttrunkallow-passvlan100110traffic-limitinboundacl4001cir2000pir10000cbs250000traffic-limitinboundacl4002cir4000pir10000cbs500000traffic-limitinboundacl4003cir4000pir10000cbs500000#portlink-typetrunkporttrunkallow-passvlan100110#配置基ACL的重定向示組網(wǎng)

LayLaySwitchALaySwitch用戶用戶配置

為了防止出現(xiàn)環(huán)路，在SwitchA與相連的接口上配置端口，并配MAC地址學(xué)習(xí)防止MAC漂移操作

步驟1創(chuàng)建VLAN#<<[>system-]sysname[SwitchB]vlanbatch100#配置SwitchB上接口GE0/0/2和GE0/0/3的接口類型為Access，并將GE0/0/2加入[SwitchB][SwitchB]interfacegigabitethernet[SwitchB-GigabitEthernet0/0/2]portlink-typeaccess[SwitchB-GigabitEthernet0/0/2]portdefaultvlan200[SwitchB-GigabitEthernet0/0/2]quit[SwitchB]interfacegigabitethernet[SwitchB-GigabitEthernet0/0/3]portlink-typeaccess[SwitchB-GigabitEthernet0/0/3]portdefaultvlan100[SwitchB-GigabitEthernet0/0/3]quit[SwitchB]interfacegigabitethernet[SwitchB-GigabitEthernet0/0/1]portlink-type[SwitchB-GigabitEthernet0/0/1]porttrunkallow-passvlan100200[SwitchB-GigabitEthernet0/0/1]quit#<<[>system-]sysname[SwitchA]vlanbatch100配置SwitchA上接口GE0/0/1、GE0/0/2、GE0/0/3和GE0/0/4接口類型為Trunk，并將它[SwitchA][SwitchA]interfacegigabitethernet[SwitchA-GigabitEthernet0/0/1]portlink-type[SwitchA-GigabitEthernet0/0/1]porttrunkallow-passvlan100200[SwitchA-GigabitEthernet0/0/1]quit[SwitchA]interfacegigabitethernet[SwitchA-GigabitEthernet0/0/2]portlink-type[SwitchA-GigabitEthernet0/0/2]porttrunkallow-passvlan100200[SwitchA-GigabitEthernet0/0/2]quit[SwitchA]interfacegigabitethernet[SwitchA-GigabitEthernet0/0/3]portlink-type[SwitchA-GigabitEthernet0/0/3]porttrunkallow-passvlan100200[SwitchA-GigabitEthernet0/0/3]port-isolateenable[SwitchA-GigabitEthernet0/0/3]quit[SwitchA]interfacegigabitethernet0/0/4[SwitchA-GigabitEthernet0/0/4]portlink-type[SwitchA-GigabitEthernet0/0/4]porttrunkallow-passvlan100200[SwitchA-GigabitEthernet0/0/4]port-isolateenable[SwitchA-GigabitEthernet0/0/4]quit步驟2配置基于ACL的重定向?qū)崿F(xiàn)流量過#[SwitchA][SwitchA]acl[SwitchA-acl-L2-4001]rulepermitvlan-id100[SwitchA-acl-L2-4001]rulepermitvlan-id200[SwitchA-acl-L2-4001]quit#[SwitchA][SwitchA]interfacegigabitethernet[SwitchA-GigabitEthernet0/0/1]traffic-redirectinboundacl4001interfacegigabitethernet0/0/3[SwitchA-GigabitEthernet0/0/1]quit步驟3#[SwitchA]disytraffic-appliedinterface0/0/1ACLappliedinboundinterfaceACLrule5permitvlan-id100redirectinterfaceACLrule10permitvlan-id200redirectinterface----配置

SwitchA的配置文##vlanbatch100200aclnumberrule5permitvlan-idrule10permitvlan-id#portlink-typetrunkporttrunkallow-passvlan100traffic-redirectinboundacl4001interface#portlink-typetrunkporttrunkallow-passvlan100#portlink-typetrunkporttrunkallow-passvlan100200port-isolateenablegroup1#portlink-typetrunkmac-addresslearningporttrunkallow-passvlan100200port-isolateenablegroup1# SwitchB的配置文##vlanbatch100200portlink-typetrunkporttrunkallow-passvlan100#portlink-typeaccessportdefaultvlan#portlink-typeaccessportportdefaultvlan#配置基于 的簡化流策略進(jìn)行優(yōu)先級映射示組網(wǎng)

如圖11-4所示，Switch通過接口GE0/0/3與路由器互連，企業(yè)部門1和企業(yè)部門2可經(jīng)Switch和路由器網(wǎng)絡(luò)。企業(yè)部門1和企業(yè)部門2的VLANID分別為100、200CoreCore VLAN100 配置創(chuàng)建VLAN，并配置各接口，企業(yè)部門1和企業(yè)部門2都能夠通過Switch網(wǎng)絡(luò)配置ACL，根據(jù)不同的VLAN在Switch入接口GE0/0/1和GE0/0/2操作

步驟1創(chuàng)建VLAN#<<[>system-]sysname[Switch]vlanbatch100#將接口GE0/0/1、GE0/0/2、GE0/0/3的接入類型分別配置為trunk，并分別將接口[Switch][Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/1]portlink-type[Switch-GigabitEthernet0/0/1]porttrunkallow-passvlan100[Switch-GigabitEthernet0/0/1]quit[Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/2]portlink-type[Switch-GigabitEthernet0/0/2]porttrunkallow-passvlan200[Switch-GigabitEthernet0/0/2]quit[Switch]interfacegigabitethernet[Switch-GigabitEthernet0/0/3]portlink-type[Switch-GigabitEthernet0/0/3]porttrunkallow-passvlan100200[Switch-GigabitEthernet0/0/3]quit步驟2在Switch上配置ACL4001和ACL4002，根據(jù)VLANID[Switch][Switch]acl[Switc