An ACL contains various matching conditions. You can configure a time range and reference it in ACL rules on the device. This allows the device to match packets based on the time range, and the administrator can apply different policies to packets at different time ranges.
In this example, a basic ACL defines a time range and the basic ACL is referenced by the traffic policy module to limit Internet access rate during the specified time range.
For applicable product models and versions, see Applicable Product Models and Versions.
For details about software mappings, visit Hardware Query Tool and search for the desired product model.
In Figure 1, users connect to external network devices through GE2/0/1 of the switch.
During work hours from 8:30 to 18:00, the Internet access rate of employees needs to be limited to 4 Mbit/s.
# Create VLAN 10 on the Switch.
<HUAWEI> system-view [HUAWEI] sysname Switch [Switch] vlan 10 [Switch-vlan10] quit
# Configure GE1/0/1 and GE2/0/1 on the Switch as trunk interfaces and add them to VLAN 10.
[Switch] interface gigabitethernet 1/0/1 [Switch-GigabitEthernet1/0/1] port link-type trunk [Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10 [Switch-GigabitEthernet1/0/1] quit [Switch] interface gigabitethernet 2/0/1 [Switch-GigabitEthernet2/0/1] port link-type trunk [Switch-GigabitEthernet2/0/1] port trunk allow-pass vlan 10 [Switch-GigabitEthernet2/0/1] quit
Configure the interface of the LSW connected to the Switch as a trunk interface and add it to VLAN 10.
# Create VLANIF 10 and set its IP address to 192.168.1.1/24.
[Switch] interface vlanif 10 [Switch-Vlanif10] ip address 192.168.1.1 24 [Switch-Vlanif10] quit
On the router, set the IP address of the interface connected to the Switch to 192.168.1.2/24, and configure a sub-interface on the interface to terminate the VLAN.
[Switch] time-range working_time 08:30 to 18:00 working-day //Define the work hours.
[Switch] acl number 2001 [Switch-acl-basic-2001] rule permit source 192.168.1.10 0 time-range working_time //Limit the rate of packets from 192.168.1.10 at work hours. [Switch-acl-basic-2001] rule permit source 192.168.1.11 0 time-range working_time //Limit the rate of packets from 192.168.1.11 at work hours. [Switch-acl-basic-2001] rule permit source 192.168.1.12 0 time-range working_time //Limit the rate of packets from 192.168.1.12 at work hours. [Switch-acl-basic-2001] quit
[Switch] traffic classifier c1 [Switch-classifier-c1] if-match acl 2001 [Switch-classifier-c1] quit
[Switch] traffic behavior b1 [Switch-behavior-b1] car cir 4096 //Limit the Internet access rate to 4 Mbit/s at work hours. [Switch-behavior-b1] statistic enable [Switch-behavior-b1] quit
[Switch] traffic policy p1 [Switch-trafficpolicy-p1] classifier c1 behavior b1 [Switch-trafficpolicy-p1] quit [Switch] interface gigabitethernet 1/0/1 [Switch-GigabitEthernet1/0/1] traffic-policy p1 inbound [Switch-GigabitEthernet1/0/1] quit
# Check the traffic classifier configuration.
[Switch] display traffic classifier user-defined c1 User Defined Classifier Information: Classifier: c1 Precedence: 5 Operator: OR Rule(s) : if-match acl 2001
# Check the traffic policy configuration.
[Switch] display traffic policy user-defined p1 User Defined Traffic Policy Information: Policy: p1 Classifier: c1 Operator: OR Behavior: b1 Permit Committed Access Rate: CIR 4096 (Kbps), PIR 4096 (Kbps), CBS 770048 (byte), PBS 1282048 (byte) Color Mode: color Blind Conform Action: pass Yellow Action: pass Exceed Action: discard Statistic: enable
# Check the traffic policy that is applied to the interface. During work hours, when the rate of packets from each network segment on GE1/0/1 in the inbound direction is larger than 4 Mbit/s, packet loss occurs. The rate of packets from each network segment is limited within 4 Mbit/s.
[Switch] display traffic policy statistics interface gigabitethernet 1/0/1 inbound
Interface: GigabitEthernet1/0/1
Traffic policy inbound: p1
Rule number: 3
Current status: success
Statistics interval: 300
---------------------------------------------------------------------
Board : 1
---------------------------------------------------------------------
Matched | Packets: 38,761
| Bytes: -
| Rate(pps): 0
| Rate(bps): -
---------------------------------------------------------------------
Passed | Packets: 25,534
| Bytes: -
| Rate(pps): 0
| Rate(bps): -
---------------------------------------------------------------------
Dropped | Packets: 13,227
| Bytes: -
| Rate(pps): 0
| Rate(bps): -
---------------------------------------------------------------------
Filter | Packets: 0
| Bytes: -
---------------------------------------------------------------------
Car | Packets: 13,227
| Bytes: -
---------------------------------------------------------------------
Switch configuration file
# sysname Switch # vlan batch 10 # time-range working_time 08:30 to 18:00 working-day # acl number 2001 rule 5 permit source 192.168.1.10 0 time-range working_time rule 10 permit source 192.168.1.11 0 time-range working_time rule 15 permit source 192.168.1.12 0 time-range working_time # traffic classifier c1 operator or precedence 5 if-match acl 2001 # traffic behavior b1 permit car cir 4096 pir 4096 cbs 770048 pbs 1282048 mode color-blind green pass yellow pass red discard statistic enable # traffic policy p1 match-order config classifier c1 behavior b1 # interface Vlanif10 ip address 192.168.1.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-type trunk port trunk allow-pass vlan 10 traffic-policy p1 inbound # interface GigabitEthernet2/0/1 port link-type trunk port trunk allow-pass vlan 10 # return
Product |
Product Model |
Software Version |
---|---|---|
S2700 |
S2752EI |
V100R006C05 |
S2710-SI |
V100R006C05 |
|
S2720-EI |
V200R006C10, V200R009C00, V200R010C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S2750-EI |
V200R003C00, V200R005C00SPC300, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00 |
|
S3700 |
S3700-SI, S3700-EI |
V100R006C05 |
S3700-HI |
V200R001C00 |
|
S5700 |
S5700-LI |
V200R001C00, V200R002C00, V200R003(C00&C02&C10), V200R005C00SPC300, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00 |
S5700S-LI |
V200R001C00, V200R002C00, V200R003C00, V200R005C00SPC300, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00 |
|
S5700-SI |
V200R001C00, V200R002C00, V200R003C00, V200R005C00 |
|
S5700-EI |
V200R001(C00&C01), V200R002C00, V200R003C00, V200R005(C00&C01&C02&C03) |
|
S5700-HI |
V200R001(C00&C01), V200R002C00, V200R003C00, V200R005(C00SPC500&C01&C02) |
|
S5710-C-LI |
V200R001C00 |
|
S5710-X-LI |
V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00 |
|
S5710-EI |
V200R001C00, V200R002C00, V200R003C00, V200R005(C00&C02) |
|
S5710-HI |
V200R003C00, V200R005(C00&C02&C03) |
|
S5720-LI, S5720S-LI |
V200R010C00, V200R011C00, V200R011C10, V200R012(C00&C20), V200R013C00, V200R019C00, V200R019C10 |
|
S5720-SI, S5720S-SI |
V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S5720I-SI |
V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S5720-EI |
V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S5720-HI |
V200R006C00, V200R007(C00&C10), V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S5730-HI |
V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S5730-SI |
V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S5730S-EI |
V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S5731-H |
V200R013C02, V200R019C00, V200R019C10 |
|
S5731-S, S5731S-S |
V200R019C00, V200R019C10 |
|
S5731S-H |
V200R019C00, V200R019C10 |
|
S5732-H |
V200R019C00, V200R019C10 |
|
S5735-L, S5735S-L |
V200R019C00, V200R019C10 |
|
S5735S-L-M |
V200R019C00, V200R019C10 |
|
S5735-S, S5735S-S |
V200R019C00, V200R019C10 |
|
S5700 |
S5735-S-I |
V200R019C10 |
S6700 |
S6700-EI |
V200R001(C00&C01), V200R002C00, V200R003C00, V200R005(C00&C01&C02) |
S6720-LI, S6720S-LI |
V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S6720-SI, S6720S-SI |
V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S6720-EI |
V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S6720S-EI |
V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S6720-HI |
V200R012C00, V200R013C00, V200R019C00, V200R019C10 |
|
S6730-H |
V200R013C02, V200R019C00, V200R019C10 |
|
S6730-S, S6730S-S |
V200R019C00, V200R019C10 |
|
S6730S-H |
V200R019C10 |
|
S7700 |
S7703, S7706, S7712 |
V200R001(C00&C01), V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C10, V200R012C00, V200R013C00, V200R013C02, V200R019C00, V200R019C10 |
S7703 PoE |
V200R013C00, V200R019C00, V200R019C10 |
|
S7706 PoE |
V200R013C00, V200R019C00, V200R019C10 |
|
S9700 |
S9703, S9706, S9712 |
V200R001(C00&C01), V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007(C00&C10), V200R008C00, V200R009C00, V200R010C00, V200R011C10, V200R012C00, V200R013C00 |