Configuring Redirection
Background
A device configured with the redirection action redirects the packets matching traffic classification rules to the CPU, a Label Switching Path (LSP), an interface, or a VPN instance.
A traffic policy that contains redirection can only be applied in the inbound direction of the system, LPU, interface or VLAN.
NOTE: If redirect interface is configured in a traffic behavior, you are advised to apply the traffic policy containing the traffic behavior only to Layer 2 data traffic.
Procedure
- Configure a traffic classifier.
Run system-view
The system view is displayed.
Run traffic classifier classifier-name [ operator { and | or } ] [ precedence precedence-value ]
A traffic classifier is created and the traffic classifier view is displayed, or the view of an existing traffic classifier is displayed.
The logical operator and between the rules in the traffic classifier means that:If the traffic classifier contains ACL rules, packets match the traffic classifier only if they match one ACL rule and all the non-ACL rules.
If the traffic classifier does not contain any ACL rules, packets match the traffic classifier only if they match all the rules in the classifier.
By default, the relationship between rules in a traffic classifier is or.
- Configure matching rules in the traffic classifier according to the following table.
![]()
NOTE: The if-match ip-precedence and if-match tcp commands are valid only for IPv4 packets.
X series cards do not support traffic classifiers with advanced ACLs containing the ttl-expired field.
When a traffic classifier contains if-match ipv6 acl { acl-number | acl-name }, X series cards do not support add-tag vlan-id vlan-id, remark 8021p [ 8021p-value | inner-8021p ], remark cvlan-id cvlan-id, remark vlan-id vlan-id, or mac-address learning disable.
Run quit
Exit from the traffic classifier view.
- Configure a traffic behavior.
Run traffic behavior behavior-name
A traffic behavior is created and the traffic behavior view is displayed, or the view of an existing traffic behavior is displayed.
- Run the following commands as required.
Run redirect interface interface-type interface-number [ forced ]
The device is configured to redirect packets matching the traffic classifier to a specified interface.
![]()
NOTE: After traffic is redirected to an interface in Down state, if forced is specified, traffic is dropped on the interface and is not switched to the original forwarding path. If forced is not configured, traffic is switched to the original forwarding path.
The packets that are redirected to an interface will be discarded if the VLAN of the packets on the interface is not allowed.
Run redirect multi-trunk { eth-trunk trunk-id } &<1-4>
The device is configured to redirect packets matching the traffic classifier to one or more Eth-Trunks.
If the inbound interface is a high-speed interface (for example, XGE interface) but the outbound interface is a low-speed interface (for example, GE interface), packets need to be redirected to physical interfaces of multiple Eth-Trunks so that the traffic can be load balanced and packet loss is prevented. You can configure the device to redirect packets matching the traffic classifier to one or more Eth-Trunks.
![]()
NOTE: The traffic policy containing redirect-multi-trunk is valid for only IP packets.
Run redirect cpu
The device is configured to redirect packets matching the traffic classifier to the CPU.
![]()
After the traffic policy containing redirect cpu is applied, the device redirects traffic matching traffic classification rules to the CPU, affecting system performance. Exercise caution when you run the redirect cpu command.
Run redirect lsp public dest-address { nexthop-address | interface interface-type interface-number | secondary }
The device is configured to redirect packets matching the traffic classifier to the public LSP.
![]()
NOTE: Transparent transmission of Layer 2 protocol packets can be implemented through redirection to a specified interface or one or more Eth-Trunks. X series cards cannot redirect BPDUs, so BPDUs can be transparently transmitted only through the BPDU tunnel on these cards.
Run redirect vpn-instance vpn-instance-name
The device is configured to redirect packets matching the traffic classifier to a VPN instance.
Run quit
Exit from the traffic behavior view.
Run quit
Exit from the system view.
- Configure a traffic policy.
Run system-view
The system view is displayed.
Run traffic policy policy-name [ match-order { auto | config } ]
A traffic policy is created and the traffic policy view is displayed, or the view of an existing traffic policy is displayed.
If you do not specify the matching order of traffic classifiers when creating a traffic policy, the default matching order is config.
After a traffic policy is applied, you cannot use the traffic policy command to modify the matching order of traffic classifiers in the traffic policy. To modify the matching order, delete the traffic policy, create a traffic policy, and then specify the matching order.
When creating a traffic policy, you can specify the matching order of matching rules in the traffic policy. The matching order can be either the automatic order (auto) or configuration order (config):- If the automatic order is used, traffic classifiers are matched based on the priorities of their types. Traffic classifiers based on Layer 2 and IPv4 Layer 3 information, advanced ACL6 information, basic ACL6 information, Layer 2 information, IPv4 Layer 3 information, and user-defined ACL information are matched in descending order of priority. If data traffic matches multiple traffic classifiers and the bound traffic behaviors conflict with each other, the traffic behavior corresponding to the highest priority rule takes effect.
- If the configuration order is used, traffic classifiers are matched based on their priorities. The traffic classifier with the highest priority is matched first. A smaller priority value indicates a higher priority of a traffic classifier. If precedence-value is not specified when a traffic classifier is created, the system allocates a priority to the traffic classifier. The allocated priority value is [(max-precedence + 5)/5] x 5, where max-precedence specifies the maximum priority of a traffic classifier. For details about the priority of a traffic classifier, refer to the traffic classifier command.
Run classifier classifier-name behavior behavior-name
A traffic behavior is bound to a traffic classifier in the traffic policy.
Run quit
Exit from the traffic policy view.
Run quit
Exit from the system view.
- Apply the traffic policy.
![]()
NOTE: The traffic policy containing redirection cannot be applied in the outbound direction.
Applying traffic policies consumes ACL resources. If there are no sufficient ACL resources, some traffic policies will fail to be applied. For example, if an if-match rule in a traffic policy occupies one ACL, M ACL resources will be used to apply the traffic policy to M interfaces. When a traffic policy is applied to L VLANs on a device with N LPUs, L*N ACLs are occupied. When a traffic policy is applied globally on a device with N LPUs, N ACLs are occupied. For details about ACLs occupied by if-match rules, see Table 3 in "Licensing Requirements and Limitations for MQC" of MQC Configuration.
- Apply a traffic policy to an interface.
Run system-view
The system view is displayed.
Run interface interface-type interface-number[.subinterface-number ]
The interface view or sub-interface view is displayed.
![]()
NOTE: Only the E series, X series, and SC series cards on the S12700 support Ethernet sub-interface configuration. For details about the cards, see Cards in the Hardware Description.
- Only hybrid and trunk interfaces on the preceding series of cards support Ethernet sub-interface configuration.
After you run the undo portswitch command to switch Layer 2 interfaces on the preceding series of cards into Layer 3 interfaces, you can configure Ethernet sub-interfaces on the interfaces.
The SA series cards do not support Ethernet sub-interface configuration and cannot forward IP traffic to Ethernet sub-interfaces on other cards.
You are advised to add a member interface to an Eth-Trunk and then configure an Eth-Trunk sub-interface. The Eth-Trunk sub-interface can be successfully configured only when the card on which the member interface locates supports Ethernet sub-interface configuration.
- VLAN termination sub-interfaces cannot be created on a VCMP client.
Run traffic-policy policy-name inbound
A traffic policy is applied to the interface or sub-interface.
- Applying a traffic policy to a VLAN
- Applying a traffic policy to a
VLANIF interface
Run system-view
The system view is displayed.
Run interface vlanif vlan-id
The VLANIF interface view is displayed.
Run traffic-policy policy-name inbound
A traffic policy is applied to the VLANIF interface.
Only one traffic policy can be applied to the inbound direction on a VLANIF interface, but a traffic policy can be applied to the inbound direction on different VLANIF interfaces.
Only one traffic policy can be applied to the inbound direction on a VLANIF interface, but a traffic policy can be applied to the inbound direction on different VLANIF interfaces.
A traffic policy cannot be applied to a VLANIF interface corresponding to the super-VLAN or MUX VLAN.
- Apply a traffic policy to the system or an LPU.
- Apply a traffic policy to an interface.
Verifying the Configuration
- Run the display traffic classifier user-defined [ classifier-name ] command to check the traffic classifier configuration.
- Run the display traffic behavior user-defined [ behavior-name ] command to check the traffic behavior configuration.
Run the display traffic policy user-defined [ policy-name [ classifier classifier-name ] ] command to check the configuration of a specified user-defined traffic policy.
Run the display traffic-applied [ interface [ interface-type interface-number ] | vlan [ vlan-id ] ] { inbound | outbound } [ verbose ] command to check information about ACL-based simplified and MQC-based traffic policies applied to the system, a VLAN, or an interface.
![]()
NOTE: The display traffic-applied command cannot be used to check information about ACL-based simplified and MQC-based traffic policies applied to a sub-interface. However, traffic policies can be applied to a sub-interface.
Run the display traffic policy { interface [ interface-type interface-number [.subinterface-number ] ] | vlan [ vlan-id ] | ssid-profile [ ssid-profile-name ] | global } [ inbound | outbound ] command to check the traffic policy configuration.
Run the display traffic-policy applied-record [ policy-name ] command to check the application records of a specified traffic policy.
Previous
