Summary of ACL actions | HP 445946-001 guide

Quality of Service

•Packet Format

○Ethernet format (eth2, SNAP, LLC)

○Ethernet tagging format

•Egress port packets

Note that the egress port ACL will not match a broadcast, multicast, unknown unicast, or Layer 3 packet. The egress port ACL will not match packets if the destination port is a trunk member.

Summary of ACL actions

Actions determine how the traffic is treated. The HP 10GbE switch QoS actions include the following:

•Pass or Drop

•Re-mark a new DiffServ Code Point (DSCP)

•Re-mark the 802.1p field

•Set the COS queue

Understanding ACL precedence

Each ACL has a unique precedence level, based on its number. When an incoming packet matches the highest precedence ACL, the ACL’s configured action takes place. The other assigned ACLs also are considered, in order of precedence.

ACLs are divided into Precedence Groups, as shown in the following table.

	Precedence Group	ACLs	Precedence Level

	Precedence Group 1	ACL 1 – ACL 128	Low

	Precedence Group 2	ACL 129 – ACL 256

	Precedence Group 3	ACL 257 – ACL 384	High

NOTE: Precedence Groups are not related to ACL Groups.

Each Precedence Group has its own precedence level, such that Precedence Group 2 has a higher precedence level than Precedence Group 1. Within each Precedence Group, higher-numbered ACLs receive higher precedence, so that the lowest-numbered ACL has the lowest precedence level, and the highest-numbered ACL has the highest precedence level. However, the other ACLs within the Precedence Group have an unspecified precedence level, as follows:

ACL 1 = lowest precedence level within Precedence Group 1 ACL 2 = unspecified precedence level within Precedence Group 1 ACL 3 = unspecified precedence level within Precedence Group 1

...

ACL 126 = unspecified precedence level within Precedence Group 1 ACL 127 = unspecified precedence level within Precedence Group 1 ACL 128 = highest precedence level within Precedence Group 1

89

Image 89

HP 445946-001 manual Summary of ACL actions, Understanding ACL precedence, Precedence Group ACLs Precedence Level

Contents

Part number First edition June HP 10Gb Ethernet BL-c Switch Legal notices Contents 802.1x authentication process Configuring LacpConfiguring port-based traffic control 802.1x port states Bridge priority Port priority Port path cost Configuration guidelinesAdding a Vlan to a Spanning Tree Group Creating a Vlan Edge port Link type 105 100106 109 Internal versus external routing 134 131141 155 167 Configuring the switch for tracking 177173 175 Introduction Accessing the switchAccessing the switch Additional references Typeface or Meaning Example SymbolTypographical conventions Management Network Connecting through Secure Shell Connecting through the console portConnecting through Telnet Configuring an IP interface Using the command line interfaces Apply, verify, and save the configuration Using the Browser-based Interface Default configuration Using Simple Network Management ProtocolFor more details, see Configuring Snmp trap hosts Snmp Cfg/sys/ssnmp/snmpv3/usm x/auth md5sha User configuration CLI user equivalent View based configurations Configure a user with no authentication or password Configuring Snmp trap hostsCLI oper equivalent SNMPv1 trap host Sys/ssnmp/snmpv3/tparam x/uname Accessing the switch Configure an entry in the notify table SNMPv3 trap host configuration SNMPv2 trap host configuration Setting allowable source IP address ranges Secure access to the switch How Radius authentication works Radius authentication and authorizationConfiguring an IP address range for the management network Apply and save the configuration Configuring Radius on the switch CLI example Click Submit Configuring Radius on the switch BBI example User accounts for Radius users Radius authentication featuresUser account Description and tasks performed Accessing the switch User access levels TACACS+ authenticationUser name/access User service type Value Radius attributes for user privileges TACACS+ authentication features How TACACS+ authentication worksAuthorization User access level TACACS+ level Accounting Configure custom privilege-level mapping optional Configure the TACACS+ secret and second secret Configuring TACACS+ authentication on the switch BBI example Secure Shell and Secure Copy Enabling or disabling SSH Configuring SSH and SCP features CLI example Enter the following command to log in to the switch Using SSH and SCP client commandsSwitch prompts you for the scpadmin password For example SSH and SCP encryption of management messages Generating RSA host and server keys for SSH access User account Description Password User access controlSSH/SCP integration with Radius and TACACS+ authentication Enable the user ID Setting up user IDsDefine the user name and password Ports and trunking Ports on the switchPorts and trunking Port number Port alias Built-in fault tolerance Before you configure trunksPorts and trunking Ethernet switch port names Port trunk groups Cfg/port x/cur Trunk group configuration rules Port trunking example On Switch 2, configure trunk groups 4 Configuring trunk groups CLI exampleOn Switch 1, configure trunk groups 5 Configuring trunk groups BBI example Click Submit Page Link Aggregation Control Protocol Configurable Trunk Hash algorithmActor Switch Partner Switch Page Define the admin key on port Configuring LacpApply and verify the configuration Save your new configuration changes Port-based Network Access control Port-based Network Access and traffic controlExtensible authentication protocol over LAN Port-based Network Access and traffic control EAPoL Message Exchange 802.1x authentication process 802.1x port states Attribute Attribute Value Supported Radius attributes Port-based traffic control EAPoL configuration guidelines Configuring port-based traffic control Overview VLANsVLANs and port Vlan ID numbers Vlan numbers Port configuration Viewing and configuring PVIDsPvid numbers Viewing VLANs Vlan tagging VLANs VLANs Vlan topologies and design considerations VLANs and IP interfaces Vlan configuration rules Component Description Multiple Vlans with tagging VLANs Multiple VLANs with tagging Configuring the example networkConfiguring ports and VLANs on Switch 1 CLI example # add Add port 18 to Vlan Current Ports for Configuring ports and VLANs on Switch 2 CLI example Configuring ports and VLANs on Switch 1 BBI example VLANs Enable the port and enable Vlan tagging Cfg/l2/fdb/static FDB static entries Trunking support for FDB static entries Configuring a static FDB entry Spanning Tree Protocol Spanning Tree ProtocolBridge Protocol Data Units Determining the path for forwarding BPDUs Spanning Tree Group configuration guidelinesDefault Spanning Tree configuration Creating a Vlan Adding a Vlan to a Spanning Tree GroupRules for Vlan tagged ports Adding and removing ports from STGs Switch element Belongs to Why do we need Multiple Spanning Trees?Multiple Spanning Trees Assigning cost to ports and trunk groups Two VLANs on separate instances of Spanning Tree Protocol Vlan participation in Spanning Tree Groups Configuring Switch 2 CLI example Configuring Multiple Spanning Tree GroupsConfiguring Switch 1 CLI example Configuring Switch 1 BBI example Page Configuration guidelines Configuring Port Fast ForwardingConfiguring Fast Uplink Convergence Port Fast Forwarding Rapid Spanning Tree Protocol Rstp and MstpPort state changes Rstp and Mstp Port type and link type Rstp configuration guidelinesRstp configuration example Configuring Rapid Spanning Tree Protocol BBI example Multiple Spanning Tree Protocol Rstp and Mstp Apply, verify, and save the configurationMstp region Common Internal Spanning Tree Mstp configuration example Mstp configuration guidelinesConfiguring Multiple Spanning Tree Protocol CLI example Assign VLANs to Spanning Tree Groups Configuring Multiple Spanning Tree Protocol BBI example Click Submit Page Apply, verify, and save the configuration Quality of Service Quality of Service Number Protocol Name Using ACL filtersSummary of packet classifiers Number Quality of Service Well-known protocol typesApplication Well-krown TCP flag values Precedence Group ACLs Precedence Level Summary of ACL actionsUnderstanding ACL precedence Using ACL Groups Viewing ACL statistics ACL Metering and Re-markingMetering Re-marking Configure Access Control Lists CLI example ACL configuration examples Configure Access Control Lists and Groups BBI example Click Submit Page Quality of Service Add the ACL to the port Differentiated Services concepts Using Dscp values to provide QoSPer Hop Behavior Drop Precedence Class Service Level Default PHB 802.1p Priority Using 802.1p priorities to provide QoSQoS levels Class selector priority classesPage Configure a port’s default 802.1 priority 802.1p configuration CLI example802.1p configuration BBI example Quality of Service Select a port 101 102 Quality of Service Set the 802.1p priority value 103 Page Queuing and scheduling IP routing benefits Basic IP routingRouting between IP subnets Basic IP routingPage Page Interface Devices IP Interface Address Example of subnet routingSubnet Devices IP Addresses Enable, apply, and verify the configuration Using VLANs to segregate broadcast domainsDevices IP Interface Switch Port Add the switch ports to their respective VLANs 110 111 Dhcp relay agent Dynamic Host Configuration Protocol Dhcp relay agent configuration Routing Information Protocol Routing updatesDistance vector protocol Stability RIP Features RIPv2 in RIPv1 compatibility modeRIPv1 RIPv2 Authentication DefaultMulticast Metric Add VLANs for routing interfaces RIP configuration exampleAdd IP interfaces to VLANs Cfg/l3/frwd/on before you turn RIP on Igmp Snooping Igmp Snooping FastLeave IGMPv3 Igmp Filtering Configuring the rangeConfiguring the action Configuring Igmp Snooping CLI example Igmp Snooping configuration exampleEnable IGMPv3 Snooping optional Static multicast router Configuring a Static Mrouter CLI example Configuring Igmp Filtering CLI exampleEnable Igmp Filtering on the switch Define an Igmp Filter Configuring Igmp Snooping BBI example Apply, verify, and save the configuration 124 Igmp Snooping Enable Igmp Snooping Configuring Igmp Filtering BBI example 126 Igmp Snooping Define the Igmp FilterSelect Layer 3 Igmp Igmp Filters Add Filter Page Apply, verify, and save the configuration 128 Configure Static Mrouter Click the Configure context button Configuring a Static Multicast Router BBI example Apply, verify, and save the configuration Igmp Snooping 130 Types of Ospf areas Ospf overview Ospf area types Types of Ospf routing devices Shortest Path First Tree Neighbors and adjacenciesLink-State Database Internal versus external routing Ospf implementation in HP 10GbE switch softwareConfigurable parameters Area index set to an arbitrary value Defining areasAssigning the area index Attaching an area to a network Using the area ID to assign the Ospf area numberInterface cost Summarizing routes Default routesElecting the designated router and backup Router ID Virtual links Enable Ospf authentication for Area 2 on switch Assign MD5 key ID to Ospf interfaces on switches 1, 2, Configure MD5 key ID for Area 0 on switches 1, 2,Enable Ospf MD5 authentication for Area 2 on switch Assign MD5 key ID to Ospf virtual link on switches 2 Example 1 Simple Ospf domain CLI example Ospf configuration examplesOspf features not supported in this release Example 1 Simple Ospf domain BBI example Apply, verify, and save the configuration 143 Ospf Click Submit 146 Configure the Ospf areaClick Submit Select Add Ospf Area Ospf 148 Click Submit Select Add Ospf Interface Apply, verify, and save the configuration 149 Define the backbone Configuring Ospf for a virtual link on Switch aExample 2 Virtual links Configure the virtual link Configuring Ospf for a virtual link on Switch BSwitch B in step Attach the network interface to the transit area Define the transit area Example 3 Summarizing routesOther Virtual Link Options 153 Verifying Ospf configuration Remote monitoring Remote monitoringRmon group 1-statistics View Rmon statistics for the port Configuring Rmon Statistics CLI exampleConfiguring Rmon Statistics BBI example Remote monitoring Select a port 157 Rmon group 2-history Remote monitoring Enable Rmon on the port History MIB objects Configure the Rmon History parameters Apply, verify, and save the configuration 160 Configure Rmon History BBI example Alarm MIB objects Rmon group 3-alarms Configure the Rmon Alarm parameters to track Icmp messages Configure Rmon Alarms BBI example Apply, verify, and save the configuration 163 164 Remote monitoring Apply, verify, and save the configuration Configuring Rmon Events CLI exampleConfigure the Rmon Event parameters Rmon group 9-events Apply, verify, and save the configuration 166 Configuring Rmon Events BBI example High availability High availabilityUplink Failure Detection Spanning Tree Protocol with UFD Failure Detection Pair Monitoring Uplink Failure Detection Configuring Uplink Failure Detection Configuring UFD on Switch 2 CLI example Configuring UFD on Switch 1 CLI exampleTurn UFD on Create a trunk group of uplink ports 18-21 to monitor Configuring Uplink Failure Detection BBI example Apply, verify, and save the configuration 172 Vrrp components Vrrp overviewVirtual router Virtual router MAC address Vrrp operation Master and backup virtual routerSelecting the master Vrrp router Virtual Interface Router Active-Active redundancy Failover methods Parameter HP 10GbE switch extensions to VrrpTracking Vrrp router priority Assigning Vrrp virtual router ID Configuring the switch for trackingVirtual router deployment considerations Active-Active configuration High availability configurationsTask 1 Configure Switch a Configure ports Turn on Vrrp and configure two Virtual Interface Routers High availability Configure client and server interfacesTurn off Spanning Tree Protocol globally 179 Task 2 Configure Switch B Vrrp Virtual Router 1# Task 1 Configure Switch a BBI example Click Submit 183 184 Page High availability Enable Vrrp processing 187 Click Submit Select Add Virtual Router Click Submit High availability 189 Apply, verify, and save the configuration 190 Port Mirroring Troubleshooting toolsTroubleshooting tools Enable Port Mirroring Configuring Port Mirroring CLI exampleView the current configuration Select the ports that you want to mirror Configuring Port Mirroring BBI example Click Add Mirrored Port Other network troubleshooting techniques Page 197 IndexIndex 198