Access control lists

Accept IPv4 traffic matching specified IP address and source/destination port

The following is an example IPv4 ACL that has one entry. This example creates an IPv4 ACL named ip_tcp. Within the ip_tcp ACL, an entry with sequence ID 1000 is configured. The action is specified as accept, with logging set to true.

The filter matches packets with IP destination address 10.1.3.1/32; for TCP traffic, if the source address 10.1.5.1/32, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.

--{ * candidate shared default }--[  ]--
# info acl 
    acl {
        acl-filter ip_tcp type ipv4 {
            entry 1000 {
                description "Match IP Address TCP Protocol Ports"
                match {
                    ipv4 {
                        protocol tcp
                        destination-ip {
                            prefix 10.1.3.1/32
                        }
                        source-ip {
                            prefix 10.1.5.1/32
                        }
                    }
                    transport {
                        destination-port {
                            value 6789
                        }
                        source-port {
                            value 6722
                        }
                    }
                }
                action {
                    log true
                    accept {
                    }
                }
            }
        }
    }

Drop all matching traffic

The following is an example of an entry added to the ip_tcp ACL that causes all traffic to be dropped. Because it has the highest sequence ID, traffic that matches any of the lower-sequenced ACL entries would have been accepted before being evaluated by this entry. Only traffic that did not match any of the other ACL entries would be dropped by this entry.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter ip_tcp type ipv4 {
            entry 65535 {
                action {
                    log true
                    drop {
                    }
                }
            }
        }
    }

Note that the drop action with logging set to true is not supported on 7220 IXR-Dx, 7220 IXR-Hx, and 7215 IXS-A1 systems when it is attached as an egress filter.

Match based on IPv4 address and mask

The following example uses an address mask to specify the source IPv4 address. The address mask, entered in IPv4 address format such as 0.0.0.255, indicates the bit values that must be matched exactly (0 in the mask) and the bit values that act as a wildcard (255 in the mask).

In the example, the match condition is address 10.10.10.0 and mask 0.0.0.255. This is the equivalent of configuring the match condition prefix 10.10.10.0/24.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter ip_tcp type ipv4 {
            entry 1 {
                match {
                    ipv4 {
                        destination-ip {
                            address 10.10.10.0
                            mask 0.0.0.255
                        }
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
        }
    }

Match based on IPv4 prefix list

The following example matches based on the IPv4 prefixes configured in a prefix list. In this example, an IPv4 prefix list p1 is configured under match-list. This IPv4 prefix list is specified as the source IP match condition in an ACL filter entry. If the source address of a packet matches one of the prefixes in the list, the packet is dropped.

--{ * candidate shared default }--[  ]--
# info acl match-list ipv4-prefix-list pl1
    acl {
        match-list {
            ipv4-prefix-list pl1 {
                description "IPv4 prefix match list"
                prefix 10.10.0.0/16 {
                }
                prefix 10.20.0.0/16 {
                }
                prefix 10.30.0.0/16 {
                }
            }
        }
    }

--{ +* candidate shared default }--[  ]--
# info acl acl-filter pfilter type ipv4
    acl {
        acl-filter pfilter type ipv4 {
            entry 100 {
                match {
                    ipv4 {
                        source-ip {
                            prefix-list pl1 {
                            }
                        }
                    }
                }
                action {
                    drop {
                    }
                }
            }
        }
    }

Accept IPv6 traffic matching specified conditions

The following is an example IPv6 ACL that has one entry. This example creates an IPv6 ACL named ipv6_tcp. Within the ipv6_tcp ACL, an entry with sequence ID 100 is configured. The action is specified as accept, with logging set to true.

The filter matches packets with IPv6 destination address 2001:db8:1:3::1/120; for TCP traffic, if the source address 2001:db8:1:5::1/120, destination port 6789, and source port 6722 matches the filter, the traffic stream is accepted.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter ipv6_tcp type ipv6 {
            entry 100 {
                description "Match Dest Address TCP Src Address DP SP"
                match {
                    ipv6 {
                        next-header tcp
                        destination-ip {
                            prefix 2001:db8:1:3::/120
                        }
                        source-ip {
                            prefix 2001:db8:1:5::/120
                        }
                    }
                    transport {
                        destination-port {
                            value 6789
                        }
                        source-port {
                            value 6722
                        }
                    }
                }
                action {
                    log true
                    accept {
                    }
                }
            }
        }
    }

Match based on IPv6 prefix list

The following example matches based on the IPv6 prefixes configured in a prefix list. In this example, an IPv6 prefix list p2 is configured under match-list. This IPv6 prefix list is specified as the destination IP match condition in an ACL filter entry. If the destination address of a packet matches one of the prefixes in the list, the packet is dropped.

--{ * candidate shared default }--[  ]--
# info acl match-list ipv6-prefix-list p2
    acl {
        match-list {
            ipv6-prefix-list p2 {
                prefix 2001:db8:1:3::/120 {
                }
                prefix 2001:db8:1:5::/120 {
                }
                prefix 2001:db8:1:7::/120 {
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl acl-filter pfilter2 type ipv6
    acl {
        acl-filter pfilter2 type ipv6 {
            entry 100 {
                match {
                    ipv6 {
                        destination-ip {
                            prefix-list p2 {
                            }
                        }
                    }
                }
                action {
                    drop {
                    }
                }
            }
        }
    }

Drop traffic from a source MAC

This example creates a MAC ACL named mac01. Within the mac01 ACL, an entry with sequence ID 100 is configured. The filter matches Ethernet frames with a source MAC address of 00:00:5E:00:53:01. The action is specified as drop, with logging set to true.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter mac01 type mac {
            entry 100 {
                match {
                    l2 {
                        source-mac {
                            address 00:00:5E:00:53:01
                        }
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
        }
    }

Accept traffic using MAC address mask

The following example uses an address mask to specify the source MAC address. The address mask, entered in MAC address format such as ff:ff:ff:ff:00:00, indicates the bit values that must be matched exactly (FF value in the mask) and the bit values that can be 0 or 1 (00 value in the mask).

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter mac01 type mac {
            entry 200 {
                match {
                    l2 {
                        source-mac {
                            address 00:00:5E:00:53:01
                            mask FF:FF:FF:FF:00:00
                        }
                    }
                }
                action {
                    accept {
                    }
                }
            }
        }
    }

Drop traffic of specific Ethertype

The following example drops Ethernet frames with ARP Ethertype (0x0806).

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter mac01 type mac {
            entry 300 {
                match {
                    l2 {
                        ethertype arp
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
        }
    }

Drop traffic with specific outermost VLAN ID

You can configure a specific VLAN ID or range of VLAN IDs as match criteria. The match is based on the outermost VLAN ID of the Ethernet frame. The VLAN ID can be specified as an integer from 0 to 4095 or none. Specifying 0 as the VLAN ID matches priority-tagged frames; specifying none matches untagged frames.

The following example drops Ethernet frames with VLAN ID 4095.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter mac01 type mac {
            entry 400 {
                match {
                    l2 {
                        vlan {
                            outermost-vlan-id {
                                value 4095
                            }
                        }
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
        }
    }

The following example configures a range of VLAN IDs, 100 to 999 inclusive, as match criteria.

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        acl-filter mac01 type mac {
            entry 500 {
                match {
                    l2 {
                        vlan {
                            outermost-vlan-id {
                                range {
                                    start 100
                                    end 999
                                }
                            }
                        }
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
        }
    }

Attach IPv4/IPv6 ACLs to a subinterface

The following example applies IPv4 and IPv6 ACLs to inbound traffic on a subinterface.

--{ * candidate shared default }--[  ]--
# info acl interface ethernet-1/16.1
    acl {
        interface ethernet-1/16.1 {
            interface-ref {
                interface ethernet-1/16
                subinterface 1
            }
            input {
                acl-filter ipv4-filter type ipv4 {
                }
                acl-filter ipv6-filter type ipv6 {
                }
            }
        }
    }

Attach a MAC ACL to a subinterface

The following example applies a MAC ACL to outbound traffic on a subinterface. To apply a MAC ACL to traffic in the outbound direction on any subinterface, you must set the acl egress-mac-filtering command to true.

--{ * candidate shared default }--[  ]--
# info acl interface ethernet-1/16.1
    acl {
        interface ethernet-1/16.1 {
            interface-ref {
                interface ethernet-1/16
                subinterface 1
            }
            output {
                acl-filter mac01 type mac {
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl
    acl {
        egress-mac-filtering true
    }

Attach an ACL to the mgmt0 interface

--{ * candidate shared default }--[  ]--
# acl interface mgmt0.0
--{ * candidate shared default }--[ acl interface mgmt0.0 ]--
# interface-ref interface mgmt0 subinterface 0
--{ * candidate shared default }--[ acl interface mgmt0.0 ]--
# input acl-filter ip_tcp type ipv4
--{ * candidate shared default }--[ acl interface mgmt0.0 input acl-filter ip_tcp type ipv4 ]--
# exit
--{ * candidate shared default }--[ acl interface mgmt0.0 input]--
# input acl-filter ipv6_tcp type ipv6

Verify the configuration

To verify the configuration for the management interface ACL:

--{ * candidate shared default }--[  ]--
# info interface mgmt0 acl
    interface mgmt0 {
            acl {
                input {
                    ipv4-filter [
                        ip_tcp
                    ]
                    ipv6-filter [
                        ipv6_tcp
                    ]
                }
            }
        }
    }

Detach an ACL from a subinterface

--{ * candidate shared default }--[  ]--
# acl interface ethernet-1/16.1
--{ * candidate shared default }--[ acl interface ethernet-1/16.1 ]--
# delete input acl-filter ipv4-filter type ipv4

Verify the configuration

Use the info acl interface command to verify that the ACL is no longer part of the subinterface configuration. For example:

--{ * candidate shared default }--[  ]--
# info acl interface ethernet-1/16.1
    acl {
        interface ethernet-1/16.1 {
            interface-ref {
                interface ethernet-1/16
                subinterface 1
            }
        }
    }

Detach an ACL from the management interface

--{ * candidate shared default }--[  ]--
# acl interface mgmt0.0
--{ * candidate shared default }--[ acl interface mgmt0.0 ]--
# delete input acl-filter ip_tcp type ipv4

Verify the configuration

To verify that the ACL was detached from the management interface:

--{ * candidate shared default }--[  ]--
# info interface mgmt0 acl
    interface mgmt0 {
            acl {
                input {
                    ipv6-filter [
                        ipv6_tcp
                    ]
                }
            }
        }
    }

Add an entry to an ACL

To add an entry to an ACL, enter the context for the ACL, then add the entry. For example, the following commands add an entry to IPv4 ACL ip_tcp:

--{ * candidate shared default }--[  ]--
# acl acl-filter ip_tcp type ipv4
--{ candidate shared default }--[ acl acl-filter ip_tcp type ipv4 ]--
# entry 65535
--{ candidate shared default }--[ acl acl-filter ip_tcp type ipv4 entry 65535 ]--
# log true
--{ candidate shared default }--[ acl acl-filter ip_tcp type ipv4 entry 65535 ]--
# action drop

Delete an entry in an ACL

To delete an entry in an ACL, use the delete command under the context for the ACL and specify the sequence ID of the entry to be deleted. For example, the following commands delete the entry in IPv4 ACL ip_tcp with sequence ID 65535:

--{ candidate shared default }--[  ]--
# acl acl-filter ip_tcp type ipv4
--{ candidate shared default }--[ acl acl-filter ip_tcp type ipv4 ]--
# delete entry 65535

Delete an entire ACL

To delete the entire ACL, use the delete command under the acl context. For example, the following commands delete the ip_tcp ACL:

--{ * candidate shared default }--[  ]--
# acl
--{ candidate shared default }--[ acl ]--
# delete acl-filter ip_tcp type ipv4

The following is an example of an ACL with three entries:

--{ candidate shared default }--[ acl ]
# info acl acl-filter ip_tcp type ipv4
    acl {
        acl-filter ip_tcp type ipv4 {
            entry 123 {
                match {
                    ipv4 {
                        destination-ip {
                            prefix 10.1.2.0/24
                        }
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
            entry 124 {
                match {
                    ipv4 {
                        destination-ip {
                            prefix 10.1.3.0/24
                        }
                    }
                }
                action {
                    log true
                    accept {
                    }
                }
            }
            entry 301 {
                match {
                    ipv4 {
                        destination-ip {
                            prefix 10.1.4.0/24
                        }
                    }
                }
                action {
                    drop {
                    }
                }
            }
        }
    }

To resequence the entries in the ACL so that the first entry has sequence ID 100, and the next two entries are incremented by 10, enter the context for the ACL, issue the tools resequence command, then specify the initial sequence ID and the increment for the subsequent entries. For example:

--{ candidate shared default }--[  ]--
# acl acl-filter ip_tcp type ipv4
--{ candidate shared default }--[ acl acl-filter ip_tcp type ipv4 ]--
# tools resequence start 100 increment 10

After you enter the command, the ACL entries are renumbered. For example:

--{ candidate shared default }--[ acl ]
# info acl acl-filter ip_tcp type ipv4
    acl {
        acl-filter ip_tcp type ipv4 {
            entry 100 {
                match {
                    ipv4 {
                        destination-ip {
                            prefix 10.1.2.0/24
                        }
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
            entry 110 {
                match {
                    ipv4 {
                        destination-ip {
                            prefix 10.1.3.0/24
                        }
                    }
                }
                action {
                    log true
                    accept {
                    }
                }
            }
            entry 120 {
                match {
                    ipv4 {
                        destination-ip {
                            prefix 10.1.4.0/24
                        }
                    }
                }
                action {
                    drop {
                    }
                }
            }
        }
    }

Create an IPv4 CPM filter

The following example creates a CPM filter for IPv4 traffic. IPv4 traffic extracted to the CPM that matches the rule in the filter is processed according to the action configured in the rule. In this example, the matching CPM-bound IPv4 traffic is accepted and rate-limited according to the limit specified by the sp1 system-cpu-policer.

--{ * candidate shared default }--[  ]--
# info acl acl-filter cpm type ipv4
    acl {
        acl-filter cpm type ipv4 {
            entry 1000 {
                match {
                    ipv4 {
                        protocol tcp
                        destination-ip {
                            prefix 10.1.3.1/32
                        }
                        source-ip {
                            prefix 10.1.5.1/32
                        }
                    }
                    transport {
                        destination-port {
                            value 6789
                        }
                        source-port {
                            value 6722
                        }
                    }
                }
                action {
                    accept {
                        rate-limit {
                            system-cpu-policer sp1
                        }
                    }
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl policers system-cpu-policer sp1
    acl {
        policers {
            system-cpu-policer sp1 {
                peak-packet-rate 1000000
                max-packet-burst 16
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info system control-plane-traffic input
    system {
        control-plane-traffic {
            input {
                acl {
                    acl-filter cpm type ipv4 {
                    }
                }
            }
        }
    }

Create a MAC CPM filter

The following example creates a MAC CPM filter. Non-IP traffic extracted to the CPM that matches the filter rule is processed according to the configured action. In this example, the matching CPM-bound Ethernet frames are accepted and rate-limited according to the limit specified by the dp1 policer setting.

--{ * candidate shared default }--[  ]--
# info acl acl-filter mac01 type mac
    acl {
        acl-filter mac01 type mac {
            entry 100 {
                match {
                    l2 {
                        source-mac {
                            address 00:00:5E:00:53:FF
                            mask 00:00:5E:00:53:00
                        }
                    }
                }
                action {
                    accept {
                        rate-limit {
                            policer dp1
                        }
                    }
                }
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl policers policer dp1
    acl {
        policers {
            policer dp1 {
                peak-rate 500000
                max-burst 100000
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info system control-plane-traffic input
    system {
        control-plane-traffic {
            input {
                acl {
                    acl-filter mac01 type mac {
                    }
                }
            }
        }
    }

Filter CPM traffic using an IPv4 prefix list

The following example matches based on the IPv4 prefixes configured in a prefix list. In this example, if the source address of a packet matches one of the prefixes in the list, the packet is dropped.

--{ * candidate shared default }--[  ]--
# info acl match-list ipv4-prefix-list pl1
    acl {
        match-list {
            ipv4-prefix-list pl1 {
                description "IPv4 prefix match list"
                prefix 10.10.0.0/16 {
                }
                prefix 10.20.0.0/16 {
                }
                prefix 10.30.0.0/16 {
                }
            }
        }
    }

--{ +* candidate shared default }--[  ]--
# info acl acl-filter pfilter type ipv4
    acl {
        acl-filter pfilter type ipv4 {
            entry 100 {
                match {
                    ipv4 {
                        source-ip {
                            prefix-list pl1 {
                            }
                        }
                    }
                }
                action {
                    drop {
                    }
                }
            }
        }
    }

--{ +* candidate shared default }--[  ]--
# info system control-plane-traffic input
    system {
        control-plane-traffic {
            input {
                acl {
                    acl-filter pfilter type ipv4 {
                    }
                }
            }
        }
    }

Match traffic extracted to the CPM from a specific network-instance

On 7730 SXR systems, a CPM filter can use a network-instance as a match condition. The following example creates a CPM filter that matches IGMP protocol traffic in network-instance VRF 100.

--{ +* candidate shared default }--[  ]--
# info acl acl-filter cpm-igmp type ipv4
    acl {
        acl-filter cpm-igmp type ipv4 {
            entry 100 {
                match {
                    network-instance "VRF 100"
                    ipv4 {
                        protocol igmp
                    }
                }
                action {
                    accept {
                    }
                }
            }
        }
    }

--{ +* candidate shared default }--[  ]--
# info system control-plane-traffic input
    system {
        control-plane-traffic {
            input {
                acl {
                    acl-filter cpm-igmp type ipv4 {
                    }
                }
            }
        }
    }

The following is an example of a system filter ACL that filters IPv4 traffic.

--{ * candidate shared default }--[  ]--
# info acl acl-filter system type ipv4
    acl {
        acl-filter system type ipv4 {
            entry 44 {
                match {
                    ipv4 {
                        source-ip {
                            prefix 10.0.0.0/24
                        }
                    }
                }
                action {
                    log true
                    drop {
                    }
                }
            }
        }
    }

Configure a rate-limit action for an interface ACL

The following example configures an ACL policer template and specifies it as an action in an IPv4 ACL entry. Traffic that matches this entry on the interface where this ACL is applied is subject to the rate-limiting settings configured in the ACL policer template.

--{ * candidate shared default }--[  ]--
# info acl policers policer po1
    acl {
        policers {
            policer po1 {
                peak-rate 1000000
                max-burst 500000
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info acl acl-filter a2 type ipv4
    acl {
        acl-filter a2 type ipv4 {
            entry 101 {
                action {
                    accept {
                        rate-limit {
                            policer po1
                        }
                    }
                }
            }
        }
    }

CPU generated traffic is not subject to the egress subinterface rate-limit action; packets still match the entry, but are not subject to the rate-limit.

Configure a rate-limit action for a CPM filter

The following example configures an ACL policer template and specifies it as an action in a CPM filter entry. The entry-specific parameter is set to true, which creates a policer instance for each ACL entry that specifies this policer template as an action.

--{ * candidate shared default }--[  ]--
# info acl policers policer po2
    acl {
        policers {
            policer po2 {
                entry-specific true
                peak-rate 1000000
                max-burst 500000
            }
        }
    }

--{ * candidate shared default }--[  ]--
# info system control-plane-traffic input acl acl-filter cpm type ipv4
    acl {
        acl-filter cpm type ipv4 {
            entry 101 {
                action {
                    accept {
                        rate-limit {
                            policer po2
                        }
                    }
                }
            }
        }
    }

Display ACL policer statistics

To display statistics for traffic subject to the ACL policer template, use the info from state command.

--{ * candidate shared default }--[  ]--
# info from state acl policers policer po2
    acl {
        policers {
            policer po2 {
                peak-rate 500000
                max-burst 100000
                statistics {
                    aggregate {
                        conforming-packets 6
                        conforming-octets 516
                        exceeding-packets 0
                        exceeding-octets 0
                    }
                }
            }
        }
    }

The following configuration specifies that the log file for the ACL subsystem be stored in the file dut1_file, located in the /opt/srlinux/bin/logs/srbase directory. The log file can be a maximum of 1 Mb. When the log file reaches this size, it is renamed using dut1_file as its base name. The five most recent log files are kept.

--{ candidate shared default }--[  ]--
# system
--{ candidate shared default }--[ system ]--
# info logging file dut1_file
    logging {
        file dut1_file {
            directory /opt/srlinux/bin/logs/srbase/
            rotate 5
            size 1M
            subsystem acl {
            }
        }
    }

Ensure that write permission is set for the specified directory path.

The following example sets thresholds for resource usage by input IPv4 filter instances. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.

--{ * candidate shared default }--[  ]--
# info platform resource-monitoring
    platform {
        resource-monitoring {
            acl {
                resource input-ipv4-filter-instances {
                    rising-threshold-log 90
                    falling-threshold-log 90
                }
            }
        }
    }

The following example sets thresholds for TCAM resource usage by IPv4 CPM filters. If the resource usage percentage falls below the falling-threshold-log value, a log message of priority notice is generated. If the resource usage percentage falls below the rising-threshold-log value, a log message of priority warning is generated.

--{ * candidate shared default }--[  ]--
# info platform resource-monitoring
    platform {
        resource-monitoring {
            tcam {
                resource cpm-capture-ipv4 {
                    rising-threshold-log 90
                    falling-threshold-log 90
                }
            }
        }
    }

The following example configures the ACL to record the number of matching packets for each entry:

--{ candidate shared default }--[ acl ]-- 
# ipv4-filter ip_tcp
--{ candidate shared default }--[ acl ipv4-filter ip_tcp ]--
# statistics-per-entry true

By default, if two or more subinterfaces on the same line card reference the same ACL for filtering the same direction of traffic, they use a shared instance of the same ACL in hardware. This means that per-entry statistics (including the number of matched packets and the time stamp of the last matching packet), if enabled, reflect the aggregate of the data gathered for the multiple subinterfaces.

To collect per-entry, per-subinterface statistics, instead of the aggregate of the subinterfaces where the ACL is applied, you can configure an ACL to operate in subinterface-specific mode.

If you change an ACL from subinterface-specific mode to shared mode, or the other way around, during the transition from one mode to the next, traffic continues to be subject to the previous mode until the system resources (TCAM) entries are programmed for the new mode.

The following example configures the ACL to collect statistics for matching packets inbound and outbound on each subinterface:

--{ * candidate shared default }--[  ]--
# info acl acl-filter ip_tcp type ipv4
    acl {
        acl-filter ip_tcp type ipv4 {
            subinterface-specific input-and-output
        }
    }

You can configure the following values for the subinterface-specific parameter:

• disabled (the default) – All subinterfaces on a single line card that reference the ACL as an input ACL use a shared filter instance, and all subinterfaces on a single line card that reference the ACL as an output ACL use a shared filter instance.

• input-only – All subinterfaces on a single line card that reference the ACL as an output ACL use a shared filter instance, but each subinterface that references the ACL as an input ACL uses its own separate instance of the filter.

• output-only – All subinterfaces on a single line card that reference the ACL as an input ACL use a shared filter instance, but each subinterface that references the ACL as an output ACL uses its own separate instance of the filter.

• input-and-output – Each subinterface that references the ACL as either an input ACL or an output ACL uses its own separate instance of the filter.

In the following example, the ACL is attached to two interfaces, and statistics are collected for each subinterface:

--{ candidate shared default }--[  ]--
# info from state acl acl-filter ip_tcp type ipv4
    subinterface-specific input-and-output
    statistics-per-entry true
    entry 1000 {
        description "Match IP Address TCP Protocol Ports"
        action {
            accept {
                log true
            }
        }
        match {
            destination-address 10.1.3.1/32
            protocol tcp
            source-address 10.1.5.1/32
            destination-port {
                value 6789
            }
            source-port {
                value 6722
            }
        }
        statistics {
            aggregate {
                in-matched-packets 3000
                in-last-match 2019-07-16T10:53:00.1563Z
                out-matched-packets 0
            }
            per-interface {
                subinterface ethernet-1/16.1 {
                    in-matched-packets 3000
                    in-last-match 2019-07-16T10:53:00.1563Z
                }
            }
        }
    }
    entry 65535 {
        action {
            drop {
                log true
            }
        }
        statistics {
            aggregate {
                in-matched-packets 1000
                in-last-match 2019-07-16T10:53:30.1563Z
            }
            per-interface {
                subinterface ethernet-1/16.1 {
                    in-matched-packets 1000
                    in-last-match 2019-07-16T10:53:30.1563Z
                }
            }
        }
    }

If the match criteria changes for an ACL entry, the statistics counter does not reset to zero. To reset the statistics counter for an ACL entry to zero, use the tools acl clear command, as described in Clearing ACL statistics.

Display free-static and free-dynamic resources

The following example shows two different numbers for the remaining (free) TCAM entry resources that are available for input IPv4 ACLs on the line card. The free-static value refers to the available number of resources assuming no additional TCAM banks are dynamically assigned to the ACL type. The free-dynamic value refers to the available number of resources assuming all unallocated TCAM banks are dedicated to the specified ACL type.

--{ candidate shared default }--[  ]--
# info from state platform linecard 1 forwarding-complex 0 tcam resource if-input-ipv4
    platform {
        linecard 1 {
            forwarding-complex 0 {
                tcam {
                    resource if-input-ipv4 {
                        free-static 2046
                        free-dynamic 18430
                        reserved 2
                        programmed 2
                    }
                }
            }
        }
    }

Display system resources allocated to input IPv4 ACLs

The following example shows the amount of system resources allocated to input IPv4 ACLs on the line card and how much is used and free:

--{ candidate shared default }--[  ]--
# info from state platform linecard 1 forwarding-complex 0 acl resource input-ipv4-filter-instances
    platform {
        linecard 1 {
            forwarding-complex 0 {
                acl {
                    resource input-ipv4-filter-instances {
                        used 1
                        free 254
                    }
                }
            }
        }
    }

Clear statistics for an IPv4 filter

--{ candidate shared default }--[  ]-- 
# tools acl acl-filter tcp_ip type ipv4 statistics clear

After this command is executed, the info from state output for the IPv4 filter includes a timestamp indicating when the statistics were cleared. For example:

--{ candidate shared default }--[  ]-- 
# info from state acl acl-filter ip_tcp type ipv4
    subinterface-specific output-only
    statistics-per-entry true
    entry 1000 {
        description "Match IP Address TCP Protocol Ports"
        action {
            accept {
                log true
            }
        }
        match {
            destination-address 100.1.3.1/32
            protocol tcp
            source-address 10.1.5.1/32
            destination-port {
                value 6789
            }
            source-port {
                value 6722
            }
        }
        statistics {
            last-clear 2024-03-22T13:53:51.000Z
        }
    }

Clear statistics for a specific IPv4 filter entry

The following example clears statistics for a specific entry in the IPv4 filter:

--{ candidate shared default }--[  ]-- 
# tools acl acl-filter ip_tcp type ipv4 entry 10 statistics clear

Clear statistics for a subinterface for a IPv4 filter entry

The following example clears statistics for a specified subinterface for a specified entry in the IPv4 filter:

--{ candidate shared default }--[  ]-- 
# tools acl acl-filter ip_tcp type ipv4 entry 10 statistics per-interface subinterface 1 clear

Display all active ACLs

To display information about all active ACLs, use the show acl summary command. For example:

--{ candidate shared default }--[  ]--
# show acl summary
--------------------------------------------------------------------------------
CPM Filter ACLs
--------------------------------------------------------------------------------
ipv4-entries: 1
ipv6-entries: 0
mac-entries : 1
--------------------------------------------------------------------------------
Capture Filter ACLs
--------------------------------------------------------------------------------
ipv4-entries: 0
ipv6-entries: 0
--------------------------------------------------------------------------------
IPv4 Filter ACLs
--------------------------------------------------------------------------------
Filter : ip_tcp
Active on : 1 subinterfaces (input) and 0 subinterfaces (output)
Entries : 2
--------------------------------------------------------------------------------
IPv6 Filter ACLs
--------------------------------------------------------------------------------
Filter : ipv6_tcp
Active on : 1 subinterfaces (input) and 0 subinterfaces (output)
Entries : 1
--------------------------------------------------------------------------------
MAC Filter ACLs
--------------------------------------------------------------------------------
Filter   : mac01
Active On: 1 subinterfaces (input) and 0 subinterfaces (output)
Entries  : 5
--------------------------------------------------------------------------------

Display statistics for a specific ACL

You can display statistics for a specific ACL, including how many times each ACL entry was matched on all subinterfaces to which the ACL was applied. For example:

--{ candidate shared default }--[  ]--
# show acl ipv4-filter ip_tcp
====================================================================================
Filter        : ip_tcp
SubIf-Specific: input-and-output
Entry-stats   : yes
Entries       : 2
------------------------------------------------------------------------------------
 Subinterface     Input   Output
ethernet-1/16.1   yes     no    
------------------------------------------------------------------------------------
Entry 1000
  Match               : protocol=tcp, 10.1.5.1/32(6722-6722)->10.1.3.1/32(6789-
6789)
  Action              : accept
  Input Match Packets : 3000
  Input Last Match    : 18 seconds ago
  Output Match Packets: 0
  Output Last Match   : never
Entry 65535
  Match               : protocol=<undefined>, any(*)->any(*)
  Action              : drop
  Input Match Packets : 1000
  Input Last Match    : 6 minutes ago
  Output Match Packets: 0
  Output Last Match   : never

Display per-interface statistics for each ACL entry

To display per-interface statistics for packets matching each ACL entry, specify the interface name in addition to the ACL name. For example:

--{ candidate shared default }--[  ]--
# show acl ipv4-filter ip_tcp interface ethernet-1/16
====================================================================================
Filter        : ip_tcp
SubIf-Specific: input-and-output
Entry-stats   : yes
Entries       : 2
------------------------------------------------------------------------------------
 Subinterface     Input   Output
ethernet-1/16.1   yes     no    
------------------------------------------------------------------------------------
Entry 1000
  Match               : protocol=tcp, 10.1.5.1/32(6722-6722)->10.1.3.1/32(6789-
6789)
  Action              : accept
  Input Match Packets : 3000
  Input Last Match    : 5 minutes ago
  Output Match Packets: 0
  Output Last Match   : never
Entry 65535
  Match               : protocol=<undefined>, any(*)->any(*)
  Action              : drop
  Input Match Packets : 1000
  Input Last Match    : 10 minutes ago
  Output Match Packets: 0
  Output Last Match   : never

Display statistics for a CPM filter

To display statistics for packets matching a CPM filter, specify the CPM filter type (IPv4 or IPv6). For example:

--{ candidate shared default }--[  ]--
# show acl cpm-filter ipv4-filter
================================================================================
Filter     : CPM IPv4-filter
Entry-stats: no
Entries    : 1
--------------------------------------------------------------------------------
Entry 1001
  Match          : protocol=<undefined>, any(*)->10.1.2.1/24(*)
  Action         : none
  Matched Packets: 0
--------------------------------------------------------------------------------