traffic-redirect (interface view)
Function
The traffic-redirect command configures ACL-based redirection on an interface.
The undo traffic-redirect command cancels ACL-based redirection on an interface.
By default, ACL-based redirection is not configured on an interface.
Format
To configure a single ACL, use the following command:
traffic-redirect inbound acl { [ ipv6 ] { bas-acl | adv-acl | name acl-name } | l2-acl | user-acl } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
undo traffic-redirect inbound acl { [ ipv6 ] { bas-acl | adv-acl | name acl-name } | l2-acl | user-acl } [ rule rule-id ]
If both Layer 2 ACLs and Layer 3 ACLs are configured, use the following command:
traffic-redirect inbound acl l2-acl [ rule rule-id ] acl { bas-acl | adv-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
undo traffic-redirect inbound acl l2-acl [ rule rule-id ] acl { bas-acl | adv-acl | name acl-name } [ rule rule-id ]
traffic-redirect inbound acl { bas-acl | adv-acl } [ rule rule-id ] acl { l2-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
undo traffic-redirect inbound acl { bas-acl | adv-acl } [ rule rule-id ] acl { l2-acl | name acl-name } [ rule rule-id ]
traffic-redirect inbound acl name acl-name [ rule rule-id ] acl { bas-acl | adv-acl | l2-acl | name acl-name } [ rule rule-id ] { cpu | interface interface-type interface-number | [ vpn-instance vpn-instance-name ] ip-nexthop ip-nexthop | ipv6-nexthop ipv6-nexthop }
undo traffic-redirect inbound acl name acl-name [ rule rule-id ] acl { bas-acl | adv-acl | l2-acl | name acl-name } [ rule rule-id ]
Only the S5720-EI, S5720-HI, S5720I-SI, S5720S-SI, S5720-SI, S5735-S, S5735S-S, S5735-S-I, S5730-HI, S5730S-EI, S5730-SI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6720S-SI, S6720-SI, S6730-H, S6730S-H, S6730-S, and S6730S-S support vpn-instance vpn-instance-name.
Parameters
Parameter |
Description |
Value |
|---|---|---|
inbound |
Redirects packets in the inbound direction on an interface. |
- |
acl |
Redirects packets based on the IPv4 ACL. |
- |
ipv6 |
Redirects packets based on the IPv6 ACL. |
- |
bas-acl |
Redirects packets based on a specified basic ACL. |
The value is an integer that ranges from 2000 to 2999. |
adv-acl |
Redirects packets based on a specified advanced ACL. |
The value is an integer that ranges from 3000 to 3999. |
l2-acl |
Redirects packets based on a specified Layer 2 ACL. |
The value is an integer that ranges from 4000 to 4999. |
user-acl |
Redirects packets based on a specified user-defined ACL. |
The value is an integer that ranges from 5000 to 5999. |
name acl-name |
Redirects packets based on a specified named ACL. acl-name specifies the name of the ACL. |
The value must be the name of an existing ACL. |
rule rule-id |
Redirects packets based on a specified ACL rule. |
The value is an integer that ranges from 0 to 4294967294. |
cpu |
Redirects packets to the CPU. |
- |
interface interface-type interface-number |
Redirects packets to a specified interface.
|
- |
vpn-instance vpn-instance-name |
Redirects packets to a VPN instance. |
The value must be an existing VPN instance name. |
ip-nexthop ip-nexthop |
Redirects packets to a next-hop IPv4 address. |
The value is in dotted decimal notation. |
ipv6-nexthop ipv6-nexthop |
Redirects packets to a next-hop IPv6 address. |
The address is a 32-digit hexadecimal number, in the format X:X:X:X:X:X:X:X. |
Views
VLANIF interface view, Ethernet interface view, MultiGE interface view, GE interface view, XGE interface view, 25GE interface view, 40GE interface view, 100GE interface view, Eth-Trunk interface view, port group view
Usage Guidelines
Usage Scenario
After the traffic-redirect command is executed on an interface, the device redirects packets matching an ACL to the CPU, a specified interface, or a specified next hop address.
Precautions
If name acl-name is specified in the command, you need to run the acl name or acl ipv6 name command to create the corresponding ACL. Otherwise, the ACL-based simplified traffic policy fails to be configured.
If rule rule-id is specified in the command, you need to create an ACL and configure the corresponding rule. Otherwise, the ACL-based simplified traffic policy fails to be configured.
Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support ACL-based simplified traffic policy configuration on a VLANIF interface.
The VLAN corresponding to the VLANIF interface cannot be a Super-VLAN or MUX VLAN.
For the S5720-EI, S6720-EI, and S6720S-EI, an ACL-based simplified traffic policy that is applied to a VLANIF interface is only valid for unicast packets and Layer 3 multicast packets on the VLANIF interface.
For the S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S, an ACL-based simplified traffic policy that is applied to a VLANIF interface is only valid for unicast packets on the VLANIF interface.
If the traffic-redirect (system view) and traffic-redirect (interface view) commands are used simultaneously, the traffic-redirect (interface view) command takes effect.
When the traffic-redirect (interface view) command and the traffic-filter (interface view) command or the traffic-filter (system view) command are used simultaneously, and the two commands are associated with the same ACL rule:
- If the deny action is configured in the ACL rule, traffic is discarded.
- If the permit action is configured in the ACL rule, traffic is redirected.
On the S2720-EI, S5720I-SI, S5720-LI, S5720S-LI, S5720S-SI, S5720-SI, S5730S-EI, S5730-SI, S6720-LI, S6720S-LI, S6720S-SI, and S6720-SI, if traffic matching traffic-redirect (interface view) also matches traffic-secure (interface view) or traffic-secure (system view), traffic-redirect (interface view) takes effect. On the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S5735-L, S5735S-L, S5735S-L-M, S5735-S, S5735S-S, S5735-S-I, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S, if the ACL defines the permit action, traffic-secure (interface view) or traffic-secure (system view) and traffic-redirect (interface view) take effect.
Before redirecting packets to an IPv6 address using this command, run the ipv6 neighbor command to configure a static neighbor.
Redirection to a next hop only takes effect on L3 traffic for the S2720-EI, S5720I-SI, S5720-LI, S5735-L, S5735S-L, S5735S-L-M, S5720S-LI, S5720S-SI, S5720-SI, S5735-S, S5735-S-I, and S5735S-S.
If packets are redirected to the CPU, a large number of packets will be sent to the CPU, affecting normal services. Exercise caution when you configure redirection to the CPU.