Configuring ACL6-based Packet Filtering
Pre-configuration Tasks
Configure link layer attributes of interfaces to ensure that the interfaces work properly.
Configure an ACL6.
Context
ACL6-based packet filtering enables the device to control network traffic by permitting or rejecting packets matching ACL6 rules.
If the traffic-filter (system view), traffic-filter (VLAN view), and traffic-filter (interface view) commands are configured simultaneously, the ACL6-based simplified traffic policies applied to the interface, VLAN, and system take effect in descending order of priority.
- The CE12800E does not support the priority { low | high } parameter.
- If an ACL-based/ACL6-based simplified traffic policy needs to be applied to multiple VLANs and interfaces or multiple rules for matching packets from different source IP addresses need to be bound to the same ACL-based/ACL6-based simplified traffic policy, you are advised to add these VLANs, source IP addresses, and interfaces to the same QoS group and apply the ACL-based/ACL6-based simplified traffic policy to the QoS group.
Procedure
- Configure packet filtering in the system.
When outbound ACL6-based packet filtering is configured in the system view on the CE12800, first run the traffic-policy ipv6-enhance-mode command in the system view.
- Configure packet filtering in a VLAN.
- Configure packet filtering on an interface.
- Run traffic-filter ipv6 acl { { basic-acl | acl-name } | { advanced-acl | acl-name } } { inbound [ priority { low | high } ] | outbound }
ACL6-based packet filtering is configured on the interface.
The ACL6-based simplified traffic policy can be configured on only the physical interface and Eth-Trunk in the outbound direction of the CE12800.
- Run traffic-filter ipv6 acl { { basic-acl | acl-name } | { advanced-acl | acl-name } } { inbound [ priority { low | high } ] | outbound }
- Configure packet filtering in a QoS group.
- Run traffic-filter ipv6 acl { { basic-acl | acl-name } | { advanced-acl | acl-name } } { inbound [ priority { low | high } ] | outbound }
ACL6-based packet filtering is configured in the QoS group.
Outbound ACL6-based packet filtering can be configured for only a QoS group containing Ethernet or Eth-Trunk member interfaces.
- Run traffic-filter ipv6 acl { { basic-acl | acl-name } | { advanced-acl | acl-name } } { inbound [ priority { low | high } ] | outbound }
Verifying the Configuration
Run the display traffic-policy applied-record traffic-filter [ global [ slot slot-id ] | interface interface-type interface-number | vlan vlan-id | qos group group-id ] [ inbound | outbound ] command to check the application record of a specified traffic policy.
Follow-up Procedure
For the CE12800, if a low-priority traffic policy takes effect before you apply a high-priority traffic policy, ACL6 rules may be slow to take effect. Consequently, service processing will be delayed. You can run the traffic-policy fast-mode command in the system view to enable fast delivery of ACL6s. This ensures that ACL6 rules take effect rapidly and services can be processed in real time.