Configuring MQC-based Priority Re-marking
Background
Priority re-marking is a method of changing priority fields of the packets that match certain traffic classification rules. For example, you can configure priority mapping to change the 802.1p priority of VLAN packets or DSCP priority and local priority of IP packets.
Procedure
- Configure a traffic classifier.
Run system-view
The system view is displayed.
- Run traffic classifier classifier-name [ operator { and | or } ]
A traffic classifier is created and the traffic classifier view is displayed, or the view of an existing traffic classifier is displayed.
and is the logical operator between the rules in the traffic classifier, which means that:If the traffic classifier contains ACL rules, packets match the traffic classifier only when they match one ACL rule and all the non-ACL rules.
If the traffic classifier does not contain any ACL rules, packets match the traffic classifier only when they match all the rules in the classifier.
By default, the logical operator used between rules in a traffic classifier is OR.
- Configure matching rules according to the following table.
Only the S5720-EI, S6720-EI, and S6720S-EI support traffic classifiers with advanced ACLs containing the ttl-expired field.
When a traffic classifier contains if-match ipv6 acl { acl-number | acl-name }, the S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S do not support remark 8021p [ 8021p-value | inner-8021p ], remark cvlan-id cvlan-id, remark vlan-id vlan-id, or mac-address learning disable.
On the S5735-L, S5735S-L, S5735S-L-M, S5735-S, S5735-S-I, and S5735S-S, if a traffic policy is applied to the outbound direction and the relationship between rules in a traffic classifier is AND:- Rules for matching the source IPv6 address and those for matching destination IPv6 address cannot be configured in the same traffic classifier.
- Rules for matching IPv6 information (for example, if-match protocol ipv6 and if-match ipv6 acl) and those for matching the source MAC address, destination MAC address, source IPv6 address, or destination IPv6 address of packets cannot be configured in the same traffic classifier. (ACL6 rules can be used to match the source or destination IPv6 address of packets.)
- Rules for matching IPv4 information (IP address and UDP port number) and those for matching some Layer 2 information (for example, if-match source-mac, if-match destination-mac, and if-match l2-protocol { mpls | rarp | protocol-value }) cannot be configured in the same traffic classifier.
Matching Rule
Command
Remarks
Inner and outer VLAN IDs in QinQ packets
if-match cvlan-id start-vlan-id [ to end-vlan-id ] [ vlan-id vlan-id ]
-
802.1p priority in VLAN packets
if-match 8021p 8021p-value &<1-8>
If you enter multiple 802.1p priority values in the command, packets match the traffic classifier as long as they match one 802.1p priority, regardless of whether the relationship between rules in the traffic classifier is AND or OR.
Inner 802.1p priority in QinQ packets
if-match cvlan-8021p 8021p-value &<1-8>
-
Outer VLAN ID or inner and outer VLAN IDs of QinQ packets
if-match vlan-id start-vlan-id [ to end-vlan-id ] [ cvlan-id cvlan-id ]
-
Dropped packet
if-match discard
A traffic classifier containing such a matching rule can only be bound to traffic behaviors containing traffic statistics collection and traffic mirroring actions.
Double tags in QinQ packets
if-match double-tag
-
EXP priority in MPLS packets
if-match mpls-exp exp-value &<1-8>
If you specify multiple values for exp-value in one command, a packet matching any of the values matches the traffic classifier, regardless of whether the relationship between rules in the traffic classifier is AND or OR.
Destination MAC address
if-match destination-mac mac-address [ mac-address-mask ]
-
Source MAC address
if-match source-mac mac-address [ mac-address-mask ]
-
Protocol type field encapsulated in the Ethernet frame header
if-match l2-protocol { arp | ip | mpls | rarp | protocol-value }
-
All packets
if-match any
-
DSCP priority in IP packets
if-match dscp dscp-value &<1-8>
If you enter multiple DSCP priority values in the command, packets match the traffic classifier as long as they match one DSCP priority, regardless of whether the relationship between rules in the traffic classifier is AND or OR.
If the relationship between rules in a traffic classifier is AND, the if-match dscp and if-match ip-precedence commands cannot be configured in the traffic classifier simultaneously.
IP precedence in IP packets
if-match ip-precedence ip-precedence-value &<1-8>
If the relationship between rules in a traffic classifier is AND, the if-match dscp and if-match ip-precedence commands cannot be configured in the traffic classifier simultaneously.
If you enter multiple IP priority values in the command, packets match the traffic classifier as long as they match one IP priority, regardless of whether the relationship between rules in the traffic classifier is AND or OR.
Layer 3 protocol type
if-match protocol { ip | ipv6 }
-
SYN Flag in the TCP packet header
if-match tcp syn-flag { syn-flag-value | ack | fin | psh | rst | syn | urg }
-
Inbound interface
if-match inbound-interface interface-type interface-number
A traffic policy containing such a matching rule cannot be applied to the outbound direction, nor can it be applied to an interface view.
A traffic policy containing such a matching rule cannot be applied to an interface view.
Outbound interface
if-match outbound-interface interface-type interface-number
A traffic policy containing this matching rule cannot be applied to the inbound direction on the S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S.
A traffic policy containing such a matching rule cannot be applied to an interface view.
ACL rule
if-match acl { acl-number | acl-name }
NOTE:To use an ACL in a traffic classifier, you are advised to configure rules in the ACL first.
If an ACL used in a traffic classifier has multiple rules, packets match the ACL as long as they match any one of rules in the ACL, regardless of whether the relationship between rules in the traffic classifier is AND or OR.
ACL6 rule
if-match ipv6 acl { acl-number | acl-name }
NOTE:To use an ACL6 in a traffic classifier, you are advised to configure rules in the ACL6 first.
-
Flow ID
if-match flow-id flow-id
Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-S, S5731S-H, S5732-H, S5735-L, S5735S-L, S5735S-L-M, S5735-S, S5735-S-I, S5735S-S, S6720-EI, S6720-HI, S6730-H, S6730S-H, S6730-S, S6730S-S, and S6720S-EI support this matching rule.
The traffic classifier containing if-match flow-id and the traffic behavior containing remark flow-id must be bound to different traffic policies.
The traffic policy containing if-match flow-id can only be applied to an interface, a VLAN, or the system in the inbound direction.
Run quit
Exit from the traffic classifier view.
- Configure a traffic behavior.
- Run traffic behavior behavior-name
A traffic behavior is created and the traffic behavior view is displayed.
- Run the following commands as required:
- Run the remark 8021p [ 8021p-value | inner-8021p ] command to configure the device to re-mark 802.1p priorities of packets matching traffic classification rules.
A traffic policy containing the remark 8021p inner-8021p action can only be used in the inbound direction.
If a traffic policy containing remark 8021p is applied to the outbound direction on an interface, the VLAN of the outbound interface must work in tagged mode.
- Run the remark dscp { dscp-name | dscp-value } command to configure the device to re-mark DSCP priorities of packets matching traffic classification rules.
Run the remark local-precedence { local-precedence-name | local-precedence-value } [ green | yellow | red ] command to configure the device to re-mark local priorities of packets matching traffic classification rules.
- Run the remark ip-precedence ip-precedence command to re-mark the IP precedence field of packets matching the traffic classification rules.
- Run the remark 8021p [ 8021p-value | inner-8021p ] command to configure the device to re-mark 802.1p priorities of packets matching traffic classification rules.
- Run quit
Exit from the traffic behavior view.
- Run traffic behavior behavior-name
- Configure a traffic policy.
Run traffic policy policy-name [ match-order { auto | config } ]
A traffic policy is created and the traffic policy view is displayed, or the view of an existing traffic policy is displayed. If you do not specify a matching order for traffic classifiers in the traffic policy, the default matching order config is used.
After a traffic policy is applied, you cannot use the traffic policy command to modify the matching order of traffic classifiers in the traffic policy. To modify the matching order, delete the traffic policy, create a traffic policy, and then specify the matching order.
When creating a traffic policy, you can specify the matching order of matching rules in the traffic policy. The matching order can be either the automatic order (auto) or configuration order (config):- If the automatic order is used, traffic classifiers are matched based on the priorities of their types. If the traffic policy is applied to the inbound direction on the S5720-EI, S6720-EI, or S6720S-EI, traffic classifiers based on the following information are matched in descending order of priority: Layer 2 and IPv4 Layer 3 information > advanced ACL6 > basic ACL6 > IPv4 Layer 3 information > Layer 2 information > user-defined ACL information. In other cases, traffic classifiers based on the following information are matched in descending order of priority: Layer 2 and IPv4 Layer 3 information > advanced ACL6 information > basic ACL6 information > Layer 2 information > IPv4 Layer 3 information > user-defined ACL information. If data traffic matches multiple traffic classifiers and the bound traffic behaviors conflict with each other, the traffic behavior corresponding to the highest priority rule takes effect.
- If the configuration order is used, traffic classifiers are matched based on the sequence in which they are bound to traffic behaviors.
If more than 128 ACL rules defining CAR are configured, a traffic policy must be applied to an interface, a VLAN, and the system in sequence in the outbound direction. In the preceding situation, if ACL rules need to be updated, delete the traffic policy from the interface, VLAN, and system and re-configure a traffic policy in sequence.
Run classifier classifier-name behavior behavior-name
A traffic behavior is bound to a traffic classifier in the traffic policy.
Run quit
Exit from the traffic policy view.
Run quit
Exit from the system view.
- Apply the traffic policy.
- Applying a traffic policy to an interface
-
The system view is displayed.
Run interface interface-type interface-number [.subinterface-number ]
The interface view or sub-interface view is displayed.
Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support Ethernet sub-interfaces.
- Only hybrid and trunk interfaces on the preceding switches support Ethernet sub-interface configuration.
After you run the undo portswitch command to switch Layer 2 interfaces on the preceding series of switches into Layer 3 interfaces, you can configure Ethernet sub-interfaces on the interfaces.
After an interface is added to an Eth-Trunk, sub-interfaces cannot be configured on the interface.
- VLAN termination sub-interfaces cannot be created on a VCMP client.
Run traffic-policy policy-name { inbound | outbound }
A traffic policy is applied to the interface or sub-interface.
Each direction on an interface can be configured with only one traffic policy. A single traffic policy can be applied to both directions on one or more interfaces. After a traffic policy is applied to an interface, the system performs traffic policing for all the incoming or outgoing packets that match traffic classification rules on the interface.
Traffic policies can be applied to only the inbound direction of sub-interfaces on the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S.
You are not advised to apply a traffic policy containing remark 8021p, remark cvlan-id, or remark vlan-id to the outbound direction of an untagged interface. This configuration may cause incorrect information in the packets.
Applying traffic policies consumes ACL resources. If ACL resources are insufficient, some traffic policies will fail to be applied. For example, if an if-match rule in a traffic policy occupies one ACL, one ACL is occupied for each interface to which the traffic policy is applied. When a traffic policy is applied to multiple VLANs, one ACL is occupied for each VLAN to which the traffic policy is applied. When a traffic policy is applied to the system, one ACL is occupied. For details about ACLs occupied by if-match rules, see Table 3 in "Licensing Requirements and Limitations for MQC."
- Among the 2N interfaces on the S6720-EI or S6720S-EI, if an interface in the range from 1 to N and an interface in the range from N+1 to 2N are added to the same Eth-Trunk or VLAN, and outgoing traffic of the Eth-Trunk or VLAN is rate-limited by car, the outgoing traffic rate is two times the CAR value.
-
- Applying a traffic policy to a VLAN
-
The system view is displayed.
-
The VLAN view is displayed.
Run traffic-policy policy-name { inbound | outbound }
A traffic policy is applied to the VLAN.
Each direction of a VLAN can be configured with only one traffic policy.
After a traffic policy is applied to a VLAN, the system performs traffic policing for the packets that belong to the VLAN and match traffic classification rules in the inbound or outbound direction.
-
- Applying a traffic policy to a VLANIF interface
-
The system view is displayed.
-
The VLANIF interface view is displayed.
Run traffic-policy policy-name { inbound | outbound }
A traffic policy is applied to the VLANIF interface.
Each direction of a VLANIF interface can be configured with only one traffic policy. A single traffic policy can be applied to both directions on one or more VLANIF interfaces.
A traffic policy cannot be applied to a VLANIF interface corresponding to the super-VLAN or MUX VLAN.
On the S5720-EI, S6720-EI, and S6720S-EI, a traffic policy applied to a VLANIF interface takes effect only for unicast packets and Layer 3 multicast packets on the VLANIF interface.
On the S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S, a traffic policy applied to a VLANIF interface takes effect only for unicast packets on the VLANIF interface.
A traffic policy can be applied to a VLANIF interface only on the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S.
A traffic policy cannot be applied to the inbound direction of a VLANIF interface when the bound traffic behaviors define the following actions:- remark vlan-id
- remark cvlan-id
- remark 8021p
- remark flow-id
- mac-address learning disable
A traffic policy cannot be applied to the outbound direction of a VLANIF interface when the bound traffic behaviors define the following actions:- remark flow-id
- mac-address learning disable
-
- Applying a traffic policy globally
-
The system view is displayed.
Run traffic-policy policy-name global { inbound | outbound } [ slot slot-id ]
A traffic policy is applied to the system.
Each direction can be configured with only one traffic policy in the system or slot. A traffic policy cannot be applied to the same direction in both the system and slot.
- In a stack, a traffic policy applied to the system takes effect on all the interfaces and VLANs of all the member switches in the stack. The system then performs traffic policing for all the incoming and outgoing packets that match traffic classification rules on all the member switches. A traffic policy applied to a specified slot takes effect on all the interfaces and VLANs of the member switch with the specified stack ID. The system then performs traffic policing for all the incoming and outgoing packets that match traffic classification rules on this member switch.
- On a standalone switch, a traffic policy applied to the system takes effect on all the interfaces and VLANs of the local switch. The system then performs traffic policing for all the incoming and outgoing packets that match traffic classification rules on the local switch. Traffic policies applied to the slot and system have the same functions.
-
- Applying a traffic policy to an interface
Verifying the Configuration
- Run the display traffic classifier user-defined [ classifier-name ] command to check the traffic classifier configuration.
- Run the display traffic behavior user-defined [ behavior-name ] command to check the traffic behavior configuration.
Run the display traffic policy user-defined [ policy-name [ classifier classifier-name ] ] command to check the configuration of a specified user-defined traffic policy.
Run the display traffic-applied [ interface [ interface-type interface-number ] | vlan [ vlan-id ] ] { inbound | outbound } [ verbose ] command to check information about ACL-based simplified and MQC-based traffic policies applied to the system, a VLAN, or an interface.
The display traffic-applied command cannot be used to check information about ACL-based simplified and MQC-based traffic policies applied to a sub-interface. However, traffic policies can be applied to a sub-interface.
Run the display traffic policy { interface [ interface-type interface-number [.subinterface-number ] ] | vlan [ vlan-id ] | ssid-profile [ ssid-profile-name ] | global } [ inbound | outbound ] command to check the traffic policy configuration.
Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support sub-interfaces.
Only the S5720-HI, S5730-HI, S5731-H, S5731S-H, S5732-H, S6720-HI, S6730S-H, and S6730-H support ssid-profile [ ssid-profile-name ].
Run the display traffic-policy applied-record [ policy-name ] command to check the application records of a specified traffic policy.