Access control lists

Accept IPv4 traffic matching specified IP address and source/destination port

The following is an example IPv4 ACL that has one entry. This example creates an IPv4 ACL named ip_tcp. Within the ip_tcp ACL, an entry with sequence ID 1000 is configured. The action is specified as accept, with logging set to true.

The filter matches packets with IP destination address 10.1.3.1/32; for TCP traffic, if the source address 10.1.5.1/32, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.

--{ * candidate shared default }--[  ]--
# info acl 
    ipv4-filter ip_tcp {
        entry 1000 {
            description Match_IP_Address_TCP_Protocol_Ports
            action {
                accept {
                    log true
                }
            }
            match {
                protocol tcp
                destination-ip {
                    prefix 10.1.3.1/32
                }
                source-ip {
                    prefix 10.1.5.1/32
                }
                destination-port {
                    value 6789
                }
                source-port {
                    value 6722
                }
            }
        }
    }

Drop all matching traffic

The following is an example of an entry added to the ip_tcp ACL that causes all traffic to be dropped. Because it has the highest sequence ID, traffic that matches any of the lower-sequenced ACL entries would have been accepted before being evaluated by this entry. Only traffic that did not match any of the other ACL entries would be dropped by this entry.

--{ * candidate shared default }--[  ]--
# info acl
    ipv4-filter ip_tcp {
        entry 65535 {
            action {
                drop {
                    log true
                }
            }
        }
    }

Note that the drop action with logging set to true is not supported on 7220 IXR-D1, D2, D3, and D5 systems when it is attached as an egress filter.

The following is an example IPv6 ACL that has one entry. This example creates an IPv6 ACL named ipv6_tcp. Within the ipv6_tcp ACL, an entry with sequence ID 100 is configured. The action is specified as accept, with logging set to true.

The filter matches packets with IPv6 destination address 2001:db8:1:3::1/120; for TCP traffic, if the source address 2001:db8:1:5::1/120, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.

--{ * candidate shared default }--[  ]--
# info acl
    ipv6-filter ipv6_tcp {
        entry 100 {
            description Match_Dest_Address_TCP_Src_Address_DP_SP
            action {
                accept {
                    log true
                }
            }
            match {
                next-header tcp
                destination-ip {
                    prefix 2001:db8:1:3::/120
                }
                source-ip {
                    prefix 2001:db8:1:5::/120
                }
                destination-port {
                    value 6789
                }
                source-port {
                    value 6722
                }
            }
        }
    }

Drop traffic from a source MAC

This example creates a MAC ACL named mac01. Within the mac01 ACL, an entry with sequence ID 100 is configured. The filter matches Ethernet frames with a source MAC address of AA:BB:19:DD:EE:FF. The action is specified as drop, with logging set to true.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 100 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    source-mac {
                        address AA:BB:19:DD:EE:FF
                    }
                }
            }
        }
    }

Accept traffic using MAC address mask

The following example uses an address mask to specify the source MAC address. The address mask, entered in MAC address format such as ff:ff:ff:ff:00:00, indicates the bit values that must be matched exactly (FF value in the mask) and the bit values that can be 0 or 1 (00 value in the mask).

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 200 {
                action {
                    accept {
                    }
                }
                match {
                    source-mac {
                        address AA:BB:19:DD:EE:FF
                        mask FF:FF:FF:FF:00:00
                    }
                }
            }
        }
    }

Drop traffic of specific Ethertype

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 300 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    ethertype 0x0806
                }
            }
        }
    }

Drop traffic with specific outermost VLAN ID

You can configure a specific VLAN ID or range of VLAN IDs as match criteria. The match is based on the outermost VLAN ID of the Ethernet frame. The VLAN ID can be specified as an integer from 0 to 4095 or none. Specifying 0 as the VLAN ID matches priority-tagged frames; specifying none matches untagged frames.

The following example drops Ethernet frames with VLAN ID 4095.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 400 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    vlan {
                        outermost-vlan-id {
                            value 4095
                        }
                    }
                }
            }
        }
    }

The following example configures a range of VLAN IDs, 100 to 999 inclusive, as match criteria.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        mac-filter mac01 {
            entry 500 {
                action {
                    drop {
                        log true
                    }
                }
                match {
                    vlan {
                        outermost-vlan-id {
                           range {
                                start 100
                                end 999
                            }
                        }
                    }
                }
            }
        }
    }

Attach IPv4/IPv6 ACLs to a subinterface

The following example applies IPv4 and IPv6 ACLs to inbound traffic on a subinterface:

--{ * candidate shared default }--[  ]--
# info interface ethernet-1/16 subinterface 1 acl
    interface ethernet-1/16 {
        subinterface 1 {
            acl {
                input {
                    ipv4-filter ip_tcp
                    ipv6-filter ipv6_tcp
                }
            }
        }
    }

Attach a MAC ACL to a subinterface

The following example applies a MAC ACL to outbound traffic on a subinterface. To apply a MAC ACL to traffic in the outbound direction on any subinterface, you must set the acl egress-mac-filtering command to true.

--{ * candidate shared default }--[  ]--
# info interface ethernet-1/1 subinterface 1 acl
    interface ethernet-1/1 {
        subinterface 1 {
            acl {
                output {
                    mac-filter mac01
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        egress-mac-filtering true
    }

Attach an ACL to the mgmt0 interface

--{ * candidate shared default }--[  ]--
# interface mgmt0
--{ * candidate shared default }--[ interface mgmt0 ]—
# subinterface 0
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 ]--
# acl
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 acl ]—
# input ipv4-filter ip_tcp
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 acl ]—
# input ipv6-filter ipv6_tcp

Verify the configuration

To verify the configuration for the management interface ACL:

--{ * candidate shared default }--[  ]--
# info interface mgmt0
    interface mgmt0     {
        admin-state enable
            subinterface 0 {
                admin-state enable
                ipv4 {
                    dhcp-client true
                }
                ipv6 {
                    dhcp-client true
                }
                acl {
                    input {
                        ipv4-filter ip_tcp
                        ipv6-filter ipv6_tcp
                    }
                }
            }
        }

Detach an ACL from a subinterface

--{ * candidate shared default }--[  ]--
# interface ethernet-1/16
--{ * candidate shared default }--[ interface ethernet-1/16 ]—
# subinterface 1
--{ * candidate shared default }--[ interface ethernet-1/16 subinterface 1 ]—
# delete acl input ipv4-filter
--{ * candidate shared default }--[ interface ethernet-1/16 subinterface 1 ]--

Verify the configuration

Use the info interface command to verify that the ACL is no longer part of the subinterface configuration. For example:

--{ * candidate shared default }--[  ]--
# info interface ethernet-1/16  
    interface ethernet-1/16 {
        description dut1-dut-2
        subinterface 1 {
            ipv4 {
                admin-state enable
                address 10.1.5.2/24 {
                }
                arp {
                    neighbor 10.1.5.1 {
                        link-layer-address 00:00:64:01:05:05
                   }
                }
            }
            ipv6 {
                admin-state enable
                address 2001:db8:1:5::2/120 {
                }
                neighbor-discovery {
                    neighbor 2001:db8:1:5::1 {
                        link-layer-address 00:00:64:01:05:05
                    }
                }
            }
            acl {
                input {
                    ipv6-filter ipv6_tcp
                }
            }
        }
    }

Detach an ACL from the management interface

--{ * candidate shared default }--[  ]--
# interface mgmt0
--{ * candidate shared default }--[ interface mgmt0 ]—
# subinterface 0
--{ * candidate shared default }--[ interface mgmt0 subinterface 0 ]--
# delete acl input ipv4-filter

Verify the configuration

To verify that the ACL was detached from the management interface:

--{ * candidate shared default }--[  ]--
# info interface mgmt0
    interface mgmt0     {
        admin-state enable
            subinterface 0 {
                admin-state enable
                ipv4 {
                    dhcp-client true
                }
                ipv6 {
                    dhcp-client true
                }
                acl {
                    input {
                        ipv6-filter ipv6_tcp
                    }
                }
            }
        }

Add an entry to an ACL

To add an entry to an ACL, enter the context for the ACL, then add the entry. For example, the following commands add an entry to IPv4 ACL ip_tcp:

--{ * candidate shared default }--[  ]--
# acl ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# entry 65535
--{ candidate shared default }--[ acl ipv4-filter ip_tcp entry 65535 ]--
# action drop
--{ candidate shared default }--[ acl ipv4-filter ip_tcp entry 65535 action drop ]--
# log true
--{ candidate shared default }--[ acl ipv4-filter ip_tcp entry 65535 action drop ]--

Delete an entry in an ACL

To delete an entry in an ACL, use the delete command under the context for the ACL and specify the sequence ID of the entry to be deleted. For example, the following commands delete the entry in IPv4 ACL ip_tcp with sequence ID 65535:

--{ candidate shared default }--[  ]--
# acl ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# delete entry 65535

Delete an entire ACL

To delete the entire ACL, use the delete command under the acl context. For example, the following commands delete the ip_tcp ACL:

--{ * candidate shared default }--[  ]--
# acl
--{ candidate shared default }--[ acl ]--
# delete ipv4-filter ip_tcp

The following is an example of an ACL with three entries:

--{ candidate shared default }--[ acl ]—
# info ipv4-filter ip_tcp
    ipv4-filter ip_tcp {
        entry 123 {
            action {
                drop {
                    log true
                }
            }
            match {
                destination-address 10.1.2.1/24
            }
        }
        entry 124 {
            action {
                accept {
                    log true
                }
            }
            match {
                destination-address 10.1.3.1/24
            }
        }
        entry 301 {
            action {
                drop {
                }
            }
            match {
                destination-address 10.1.4.1/24
            }
        }

To resequence the entries in the ACL so that the first entry has sequence ID 100, and the next two entries are incremented by 10, enter the context for the ACL, issue the tools resequence command, then specify the initial sequence ID and the increment for the subsequent entries. For example:

--{ candidate shared default }--[  ]--
# acl ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# tools resequence start 100 increment 10

After you enter the command, the ACL entries are renumbered. For example:

--{ candidate shared default }--[ acl ]—
# info ipv4-filter ip_tcp
    ipv4-filter ip_tcp {
        entry 100 {
            action {
                drop {
                    log true
                }
            }
            match {
                destination-address 10.1.2.1/24
            }
        }
        entry 110 {
            action {
                accept {
                    log true
                }
            }
            match {
                destination-address 10.1.3.1/24
            }
        }
        entry 120 {
            action {
                drop {
                }
            }
            match {
                destination-address 10.1.4.1/24
            }
        }

The resequence command is only available inside an ACL configuration context, and it only applies to the entries of the ACL associated with that context.

Creating an IPv4 CPM filter

The following example creates a CPM filter for IPv4 traffic. IPv4 traffic extracted to the CPM that matches the rule in the filter is processed according to the action configured in the rule. In this example, the matching CPM-bound IPv4 traffic is accepted and rate-limited according to the limit specified by the sp1 system-cpu-policer.

--{ * candidate shared default }--[  ]--
# info acl cpm-filter 
    acl {
        cpm-filter {
            ipv4-filter {
                entry 1000 {
                    action {
                        accept {
                            rate-limit {
                                system-cpu-policer 1000
                            }
                        }
                    }
                    match {
                        protocol tcp
                        destination-ip {
                            address 10.1.3.1
                            mask 255.255.255.255
                        }
                        source-ip {
                            address 10.1.5.1
                            mask 255.255.255.255
                        }
                        destination-port {
                            value 6789
                        }
                        source-port {
                            value 6722
                        }
                    }
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl policers system-cpu-policer sp1
    acl {
        policers {
            system-cpu-policer sp1 {
                peak-packet-rate 1000000
                max-packet-burst 16
            }
        }
    }

Creating a MAC CPM filter

The following example creates a MAC CPM filter. Non-IP traffic extracted to the CPM that matches the filter rule is processed according to the configured action. In this example, the matching CPM-bound Ethernet frames are accepted and rate-limited according to the limit specified by the dp1 policer setting.

--{ * candidate shared default }--[  ]--
# info acl cpm-filter
    acl {
        cpm-filter {
            mac-filter {
                entry 100 {
                    action {
                        accept {
                            rate-limit {
                                policer dp1
                            }
                        }
                    }
                    match {
                        source-mac {
                            address 00:00:5e:00:53:FF
                            mask 00:00:5e:00:53:00
                        }
                    }
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl policers policer dp1
    acl {
        policers {
            policer dp1 {
                peak-rate 500000
                max-burst 100000
            }
        }
    }

The following is an example of a system filter ACL that filters IPv4 traffic.

--{ * candidate shared default }--[  ]--
# info acl system-filter
    acl
       system-filter {
            ipv4-filter {
                entry 44 {
                    action {
                        drop {
                            log true
                        }
                    }
                    match {
                        source-ip {
                            address 10.1.5.1
                            mask 10.0.0.255
                        }
                    }
                }
            }
        }

Configure a rate-limit action for an interface ACL

The following example configures an ACL policer template and specifies it as an action in an IPv4 ACL entry. Traffic that matches this entry on the interface where this ACL is applied is subject to the rate-limiting settings configured in the ACL policer template.

--{ * candidate shared default }--[  ]--
# info acl policers policer po1
    acl {
        policers {
            policer po1 {
                peak-rate 1000000
                max-burst 500000
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl ipv4-filter a2
    acl {
        ipv4-filter a2 {
            entry 101 {
                action {
                    accept {
                        rate-limit {
                            policer po1
                        }
                    }
                }
            }
        }
    }

CPU generated traffic is not subject to the egress subinterface rate-limit action; packets still match the entry, but are not subject to the rate-limit.

Configure a rate-limit action for a CPM filter

The following example configures an ACL policer template and specifies it as an action in a CPM filter entry. The entry-specific parameter is set to true, which creates a policer instance for each ACL entry that specifies this policer template as an action.

--{ * candidate shared default }--[  ]--
# info acl policers policer po2
    acl {
        policers {
            policer po2 {
                entry-specific true
                peak-rate 1000000
                max-burst 500000
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl cpm-filter ipv4-filter entry 101
    acl {
        cpm-filter {
            ipv4-filter {
                entry 101 {
                    action {
                        accept {
                            rate-limit {
                                policer po2
                            }
                        }
                    }
                }
            }
        }
    }

Display ACL policer statistics

To display statistics for traffic subject to the ACL policer template, use the info from state command.

--{ * candidate shared default }--[  ]--
# info from state acl policers policer po2
    acl {
        policers {
            policer po2 {
                peak-rate 500000
                max-burst 100000
                statistics {
                    aggregate {
                        conforming-packets 6
                        conforming-octets 516
                        exceeding-packets 0
                        exceeding-octets 0
                    }
                }
            }
        }
    }

The following configuration specifies that the log file for the ACL subsystem be stored in the file dut1_file, located in the /opt/srlinux/bin/logs/srbase directory. The log file can be a maximum of 1 Mb. When the log file reaches this size, it is renamed using dut1_file as its base name. The five most recent log files are kept.

--{ candidate shared default }--[  ]--
# system
--{ candidate shared default }--[ system ]--
# info logging file dut1_file
    logging {
        file dut1_file {
            directory /opt/srlinux/bin/logs/srbase/
            rotate 5
            size 1M
            subsystem acl {
            }
        }
    }

Ensure that write permission is set for the specified directory path.

The following example sets thresholds for resource usage by input IPv4 filter instances. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.

--{ * candidate shared default }--[  ]--
# info platform resource-monitoring
    platform {
        resource-monitoring {
            acl {
                resource input-ipv4-filter-instances {
                    rising-threshold-log 90
                    falling-threshold-log 90
                }
            }
        }
    }

The following example sets thresholds for TCAM resource usage by IPv4 CPM filters. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.

--{ * candidate shared default }--[  ]--
# info platform resource-monitoring
    platform {
        resource-monitoring {
            tcam {
                resource cpm-capture-ipv4 {
                    rising-threshold-log 90
                    falling-threshold-log 90
                }
            }
        }
    }

The following example configures the ACL to record the number of matching packets for each entry:

--{ candidate shared default }--[ acl ]-- 
# ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# statistics-per-entry true

By default, if two or more subinterfaces on the same line card reference the same ACL for filtering the same direction of traffic, they use a shared instance of the same ACL in hardware. This means that per-entry statistics (including the number of matched packets and the time stamp of the last matching packet), if enabled, reflect the aggregate of the data gathered for the multiple subinterfaces.

To collect per-entry, per-subinterface statistics, instead of the aggregate of the subinterfaces where the ACL is applied, you can configure an ACL to operate in subinterface-specific mode.

If you change an ACL from subinterface-specific mode to shared mode, or the other way around, during the transition from one mode to the next, traffic continues to be subject to the previous mode until the system resources (TCAM) entries are programmed for the new mode.

The following example configures the ACL to collect statistics for matching packets inbound and outbound on each subinterface:

--{ candidate shared default }--[ acl ]-- 
# ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# subinterface-specific input-and-output

You can configure the following values for the subinterface-specific parameter:

• disabled (the default) – All subinterfaces on a single line card that reference the ACL as an input ACL use a shared filter instance, and all subinterfaces on a single line card that reference the ACL as an output ACL use a shared filter instance.

• input-only – All subinterfaces on a single line card that reference the ACL as an output ACL use a shared filter instance, but each subinterface that references the ACL as an input ACL uses its own separate instance of the filter.

• output-only – All subinterfaces on a single line card that reference the ACL as an input ACL use a shared filter instance, but each subinterface that references the ACL as an output ACL uses its own separate instance of the filter.

• input-and-output – Each subinterface that references the ACL as either an input ACL or an output ACL uses its own separate instance of the filter.

In the following example, the ACL is attached to two interfaces, and statistics are collected for each subinterface:

--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# info from state
    subinterface-specific input-and-output
    statistics-per-entry true
    entry 1000 {
        description Match_IP_Address_TCP_Protocol_Ports
        action {
            accept {
                log true
            }
        }
        match {
            destination-address 10.1.3.1/32
            protocol tcp
            source-address 10.1.5.1/32
            destination-port {
                value 6789
            }
            source-port {
                value 6722
            }
        }
        statistics {
            aggregate {
                in-matched-packets 3000
                in-last-match 2019-07-16T10:53:00.1563Z
                out-matched-packets 0
            }
            per-interface {
                subinterface ethernet-1/16.1 {
                    in-matched-packets 3000
                    in-last-match 2019-07-16T10:53:00.1563Z
                }
            }
        }
    }
    entry 65535 {
        action {
            drop {
                log true
            }
        }
        statistics {
            aggregate {
                in-matched-packets 1000
                in-last-match 2019-07-16T10:53:30.1563Z
            }
            per-interface {
                subinterface ethernet-1/16.1 {
                    in-matched-packets 1000
                    in-last-match 2019-07-16T10:53:30.1563Z
                }
            }
        }
    }

If the match criteria changes for an ACL entry, the statistics counter does not reset to zero. To reset the statistics counter for an ACL entry to zero, use the tools acl clear command, as described in Clearing ACL statistics.

Display free-static and free-dynamic resources

The following example shows two different numbers for the remaining (free) TCAM entry resources that are available for input IPv4 ACLs on the line card. The free-static value refers to the available number of resources assuming no additional TCAM banks are dynamically assigned to the ACL type. The free-dynamic value refers to the available number of resources assuming all unallocated TCAM banks are dedicated to the specified ACL type.

--{ candidate shared default }--[  ]--
# info from state platform linecard 1 forwarding-complex 0 tcam resource if-input-ipv4
    platform {
        linecard 1 {
            forwarding-complex 0 {
                tcam {
                    resource if-input-ipv4 {
                        free-static 2046
                        free-dynamic 18430
                        reserved 2
                        programmed 2
                    }
                }
            }
        }
    }

Display system resources allocated to input IPv4 ACLs

The following example shows the amount of system resources allocated to input IPv4 ACLs on the line card and how much is used and free:

--{ candidate shared default }--[  ]--
# info from state platform linecard 1 forwarding-complex 0 acl resource input-ipv4-filter-instances
    platform {
        linecard 1 {
            forwarding-complex 0 {
                acl {
                    resource input-ipv4-filter-instances {
                        used 1
                        free 254
                    }
                }
            }
        }
    }

Clear statistics for an IPv4 filter

--{ candidate shared default }--[ acl ]-- 
# tools acl ipv4-filter tcp_ip clear

After this command is executed, the info from state output for the IPv4 filter includes a timestamp indicating when the statistics were cleared. For example:

--{ candidate shared default }--[ acl ipv4-filter tcp_ip ]-- 
# info from state 
    subinterface-specific output-only
    statistics-per-entry true
    entry 1000 {
        description Match_IP_Address_TCP_Protocol_Ports
        action {
            accept {
                log true
            }
        }
        match {
            destination-address 100.1.3.1/32
            protocol tcp
            source-address 10.1.5.1/32
            destination-port {
                value 6789
            }
            source-port {
                value 6722
            }
        }
        statistics {
            last-clear 2021-10-03T13:53:51.000Z
        }
    }

Clears statistics for a specific IPv4 filter entry

The following example clears statistics for a specific entry in the IPv4 filter:

--{ candidate shared default }--[ acl ]-- 
# tools acl ipv4-filter tcp_ip entry 1000 statistics clear

Clears statistics for a subinterface for a IPv4 filter entry

The following example clears statistics for a specified subinterface for a specified entry in the IPv4 filter:

--{ candidate shared default }--[ acl ]-- 
# tools acl ipv4-filter tcp_ip entry 1000 statistics per-interface subinterface 1 clear

Display all active ACLs

To display information about all active ACLs, use the show acl summary command. For example:

--{ candidate shared default }--[  ]--
# show acl summary
--------------------------------------------------------------------------------
CPM Filter ACLs
--------------------------------------------------------------------------------
ipv4-entries: 1
ipv6-entries: 0
mac-entries : 1
--------------------------------------------------------------------------------
Capture Filter ACLs
--------------------------------------------------------------------------------
ipv4-entries: 0
ipv6-entries: 0
--------------------------------------------------------------------------------
IPv4 Filter ACLs
--------------------------------------------------------------------------------
Filter : ip_tcp
Active on : 1 subinterfaces (input) and 0 subinterfaces (output)
Entries : 2
--------------------------------------------------------------------------------
IPv6 Filter ACLs
--------------------------------------------------------------------------------
Filter : ipv6_tcp
Active on : 1 subinterfaces (input) and 0 subinterfaces (output)
Entries : 1
--------------------------------------------------------------------------------
MAC Filter ACLs
--------------------------------------------------------------------------------
Filter   : mac01
Active On: 1 subinterfaces (input) and 0 subinterfaces (output)
Entries  : 5
--------------------------------------------------------------------------------

Display statistics for a specific ACL

You can display statistics for a specific ACL, including how many times each ACL entry was matched on all subinterfaces to which the ACL was applied. For example:

--{ candidate shared default }--[  ]--
# show acl ipv4-filter ip_tcp
====================================================================================
Filter        : ip_tcp
SubIf-Specific: input-and-output
Entry-stats   : yes
Entries       : 2
------------------------------------------------------------------------------------
 Subinterface     Input   Output
ethernet-1/16.1   yes     no    
------------------------------------------------------------------------------------
Entry 1000
  Match               : protocol=tcp, 10.1.5.1/32(6722-6722)->10.1.3.1/32(6789-
6789)
  Action              : accept
  Input Match Packets : 3000
  Input Last Match    : 18 seconds ago
  Output Match Packets: 0
  Output Last Match   : never
Entry 65535
  Match               : protocol=<undefined>, any(*)->any(*)
  Action              : drop
  Input Match Packets : 1000
  Input Last Match    : 6 minutes ago
  Output Match Packets: 0
  Output Last Match   : never

Display per-interface statistics for each ACL entry

To display per-interface statistics for packets matching each ACL entry, specify the interface name in addition to the ACL name. For example:

--{ candidate shared default }--[  ]--
# show acl ipv4-filter ip_tcp interface ethernet-1/16
====================================================================================
Filter        : ip_tcp
SubIf-Specific: input-and-output
Entry-stats   : yes
Entries       : 2
------------------------------------------------------------------------------------
 Subinterface     Input   Output
ethernet-1/16.1   yes     no    
------------------------------------------------------------------------------------
Entry 1000
  Match               : protocol=tcp, 10.1.5.1/32(6722-6722)->10.1.3.1/32(6789-
6789)
  Action              : accept
  Input Match Packets : 3000
  Input Last Match    : 5 minutes ago
  Output Match Packets: 0
  Output Last Match   : never
Entry 65535
  Match               : protocol=<undefined>, any(*)->any(*)
  Action              : drop
  Input Match Packets : 1000
  Input Last Match    : 10 minutes ago
  Output Match Packets: 0
  Output Last Match   : never

Display statistics for a CPM filter

To display statistics for packets matching a CPM filter, specify the CPM filter type (IPv4 or IPv6). For example:

--{ candidate shared default }--[  ]--
# show acl cpm-filter ipv4-filter
================================================================================
Filter     : CPM IPv4-filter
Entry-stats: no
Entries    : 1
--------------------------------------------------------------------------------
Entry 1001
  Match          : protocol=<undefined>, any(*)->10.1.2.1/24(*)
  Action         : none
  Matched Packets: 0
--------------------------------------------------------------------------------