Configuring ACL-based Redirection

Context

ACL-based redirection allows the device to redirect packets matching an ACL to the CPU, a specified interface, or a specified next hop address.

When ACL-based redirection is implemented in the system or in a VLAN, the ACL number is in the range of 2000 to 5999. When ACL-based redirection is implemented on the NAC network, the ACL number is in the range of 6000 to 9999. See traffic-redirect acl.

Procedure

Configuring ACL-based redirection globally or in a VLAN
1. Run system-view
  The system view is displayed.
2. Run the following commands as required.
  - Run traffic-redirect [ vlan vlan-id ] inbound acl { [ ipv6 ] { bas-acl | adv-acl | name acl-name } | l2-acl | user-acl } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching an ACL.
  - Run traffic-redirect [ vlan vlan-id ] inbound acl l2-acl [ rule rule-id ] acl { bas-acl | adv-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching Layer 2 and Layer 3 ACLs.
  - Run traffic-redirect [ vlan vlan-id ] inbound acl { bas-acl | adv-acl } [ rule rule-id ] acl { l2-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching Layer 2 and Layer 3 ACLs.
  - Run traffic-redirect [ vlan vlan-id ] inbound acl name acl-name [ rule rule-id ] acl { bas-acl | adv-acl | l2-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching Layer 2 and Layer 3 ACLs.
  Only the S5720-EI, S5720-HI, S5720I-SI, S5720S-SI, S5720-SI, S5735-S, S5735S-S, S5735-S-I, S5730-HI, S5730S-EI, S5730-SI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6720S-SI, S6720-SI, S6730-H, S6730S-H, S6730-S, and S6730S-S support vpn-instance vpn-instance-name.
Configuring ACL-based redirection on an interface
1. Run system-view
  The system view is displayed.
2. Run interface interface-type interface-number
  The interface view is displayed.
3. Run the following commands as required.
  - Run traffic-redirect inbound acl { [ ipv6 ] { bas-acl | adv-acl | name acl-name } | l2-acl | user-acl } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching an ACL.
  - Run traffic-redirect inbound acl l2-acl [ rule rule-id ] acl { bas-acl | adv-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching Layer 2 and Layer 3 ACLs.
  - Run traffic-redirect inbound acl { bas-acl | adv-acl } [ rule rule-id ] acl { l2-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching Layer 2 and Layer 3 ACLs.
  - Run traffic-redirect inbound acl name acl-name [ rule rule-id ] acl { bas-acl | adv-acl | l2-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
    
    The device is configured to redirect incoming packets matching Layer 2 and Layer 3 ACLs.
  Only the S5720-EI, S5720-HI, S5720I-SI, S5720S-SI, S5720-SI, S5735-S, S5735S-S, S5735-S-I, S5730-HI, S5730S-EI, S5730-SI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6720S-SI, S6720-SI, S6730-H, S6730S-H, S6730-S, and S6730S-S support vpn-instance vpn-instance-name.