ACL 流量统计配置元素介绍

4.1 根据报文类型配置 ACL 与 ACE
不同二三层报文类型建议使用的ACL计数类型不一样，ACL计数类型与ACL类型对应。因此，常见的ACL计数类
型包括：IPv4 ACL计数、MAC ACL计数、Expert ACL计数、IPv6 ACL计数。
同样的二三层报文，传输层和应用层的不同，使用的ACE配置不一样。比如：IPv4 ACL统计中，IPv4报文统计、
ICMPv4报文统计和TCP报文统计，它们的ACE配置都不一样。
4.1.1 IPv4 ACL 计数
IPv4 报文统计
# 以统计主机5.5.5.5和7.7.7.7之间的上下行IPv4流量为例，ACL配置如下：
!
ip access-list extended counter_up_in
10 permit ip host 5.5.5.5 host 7.7.7.7
20 permit ip host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
ip access-list extended counter_up_out
10 permit ip host 5.5.5.5 host 7.7.7.7
20 permit ip host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
ip access-list extended counter_down_in
10 permit ip host 5.5.5.5 host 7.7.7.7
20 permit ip host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
ip access-list extended counter_down_out
10 permit ip host 5.5.5.5 host 7.7.7.7
20 permit ip host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
ICMPv4 报文统计
# 以统计主机5.5.5.5和7.7.7.7之间的上下行ICMPv4流量为例，ACL配置如下：
!
ip access-list extended counter_up_in
10 permit icmp host 5.5.5.5 host 7.7.7.7
20 permit icmp host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
ip access-list extended counter_up_out
升级手册 ACL 流量统计配置元素介绍
4
10 permit icmp host 5.5.5.5 host 7.7.7.7
20 permit icmp host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
ip access-list extended counter_down_in
10 permit icmp host 5.5.5.5 host 7.7.7.7
20 permit icmp host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
ip access-list extended counter_down_out
10 permit icmp host 5.5.5.5 host 7.7.7.7
20 permit icmp host 7.7.7.7 host 5.5.5.5
1000 permit ip any any
!
TCP 三次握手统计
# 以统计主机5.5.5.5和7.7.7.7之间的Telnet协议进行TCP三次握手过程统计为例，ACL配置如下：
!
ip access-list extended counter_up_in
10 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all syn
20 permit tcp host 5.5.5.5 eq 23 host 7.7.7.7 match-all syn ack
30 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all ack
1000 permit ip any any
!
ip access-list extended counter_up_out
10 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all syn
20 permit tcp host 5.5.5.5 eq 23 host 7.7.7.7 match-all syn ack
30 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all ack
1000 permit ip any any
!
ip access-list extended counter_down_in
10 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all syn
20 permit tcp host 5.5.5.5 eq 23 host 7.7.7.7 match-all syn ack
30 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all ack
1000 permit ip any any
!
ip access-list extended counter_down_out
10 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all syn
20 permit tcp host 5.5.5.5 eq 23 host 7.7.7.7 match-all syn ack
30 permit tcp host 7.7.7.7 host 5.5.5.5 eq 23 match-all ack
1000 permit ip any any
!
升级手册 ACL 流量统计配置元素介绍
5
4.1.2 MAC ACL 计数
二层报文统计（不带 VLAN 标签）
# 以统计主机c0b8.e672.c2f5和c0b8.e6fe.c7fe之间所有二层报文为例，ACL配置如下：
!
mac access-list extended counter_down_in
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_down_out
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_up_in
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_up_out
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
4.1.3 Expert ACL 计数
二层报文统计（带 VLAN 标签）
# 以统计主机c0b8.e672.c2f5和c0b8.e6fe.c7fe之间VLAN 11二层报文为例，ACL配置如下：
!
expert access-list extended l2_counter_down_in
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended l2_counter_down_out
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
升级手册 ACL 流量统计配置元素介绍
6
!
expert access-list extended l2_counter_up_in
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended l2_counter_up_out
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
ARP 报文统计
# 以统计本机ARP查询为例，ACL配置如下。其中本机MAC地址为1212:1212:1212，VLAN ID为100，网关MAC
地址为0000.5e00.0101。
说明
ARP报文第一个报文是广播报文，源MAC是请求端的MAC，目的MAC是ffff.ffff.ffff。第二个报文源MAC地址是应
答的网关MAC，目的MAC是请求端的MAC。
!
expert access-list extended l2_counter_down_in
10 permit arp VID 100 host 1212.1212.1212 host ffff.ffff.ffff
20 permit arp VID 100 host 0000.5e00.0101 host 1212.1212.1212
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended l2_counter_down_out
10 permit arp VID 100 host 1212.1212.1212 host ffff.ffff.ffff
20 permit arp VID 100 host 0000.5e00.0101 host 1212.1212.1212
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended l2_counter_up_in
10 permit arp VID 100 host 1212.1212.1212 host ffff.ffff.ffff
20 permit arp VID 100 host 0000.5e00.0101 host 1212.1212.1212
1000 permit ip any any any any
升级手册 ACL 流量统计配置元素介绍
7
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended l2_counter_up_out
10 permit arp VID 100 host 1212.1212.1212 host ffff.ffff.ffff
20 permit arp VID 100 host 0000.5e00.0101 host 1212.1212.1212
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
VXLAN 报文统计（统计内层 IPv4 报文）
# 以统计VXLAN内层IPv4报文为例，ACL配置如下。其中VXLAN隧道两端的IP地址为5.5.5.5和5.5.5.6。
expert access-list extended counter_up_in
10 permit vxlan-ignore-dport ip host 5.5.5.5 host 5.5.5.6
20 permit vxlan-ignore-dport ip host 5.5.5.6 host 5.5.5.5
30 permit vxlan ip host 5.5.5.5 host 5.5.5.6
40 permit vxlan ip host 5.5.5.6 host 5.5.5.5
50 permit ip host 5.5.5.5 any host 5.5.5.6 any
60 permit ip host 5.5.5.6 host any 5.5.5.5 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended counter_down_in
10 permit vxlan-ignore-dport ip host 5.5.5.5 host 5.5.5.6
20 permit vxlan-ignore-dport ip host 5.5.5.6 host 5.5.5.5
30 permit vxlan ip host 5.5.5.5 host 5.5.5.6
40 permit vxlan ip host 5.5.5.6 host 5.5.5.5
50 permit ip host 5.5.5.5 any host 5.5.5.6 any
60 permit ip host 5.5.5.6 host any 5.5.5.5 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
VXLAN 报文统计（统计内层 ICMPv4 报文）
# 以统计VXLAN内层ICMPv4报文为例，ACL配置如下。其中VXLAN隧道两端的P地址为10.100.1.200和
192.100.1.2。
expert access-list extended counter_up_in
10 permit vxlan-ignore-dport icmp host 10.100.1.200 host 192.100.1.2
20 permit vxlan-ignore-dport icmp host 192.100.1.2 host 10.100.1.200
升级手册 ACL 流量统计配置元素介绍
8
30 permit vxlan icmp host 10.100.1.200 host 192.100.1.2
40 permit vxlan icmp host 192.100.1.2 host 10.100.1.200
50 permit icmp host 10.100.1.200 any host 192.100.1.2 any
60 permit icmp host 192.100.1.2 any host 10.100.1.200 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended counter_down_in
10 permit vxlan-ignore-dport icmp host 10.100.1.200 host 192.100.1.2
20 permit vxlan-ignore-dport icmp host 192.100.1.2 host 10.100.1.200
30 permit vxlan icmp host 10.100.1.200 host 192.100.1.2
40 permit vxlan icmp host 192.100.1.2 host 10.100.1.200
50 permit icmp host 10.100.1.200 any host 192.100.1.2 any
60 permit icmp host 192.100.1.2 any host 10.100.1.200 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
4.1.4 IPv6 ACL 计数
IPv6 报文统计
# 以统计主机5555::5和5555::6之间的上下行IPv4流量为例，ACL配置如下：
!
ipv6 access-list counter_up_in
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_up_out
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_in
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_out
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
升级手册 ACL 流量统计配置元素介绍
9
!
ICMPv6 报文统计
# 以统计主机5555::5和5555::6之间的上下行ICMPv6流量为例，ACL配置如下：
!
configure terminal
ipv6 access-list counter_up_in
10 permit icmp host 5555::5 host 5555::6
20 permit icmp host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_up_out
10 permit icmp host 5555::5 host 5555::6
20 permit icmp host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_in
10 permit icmp host 5555::5 host 5555::6
20 permit icmp host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_out
10 permit icmp host 5555::5 host 5555::6
20 permit icmp host 5555::6 host 5555::5
1000 permit ipv6 any any
!
IPv6 ND 报文统计
以图4-1为例介绍IPv6 ND报文统计，ND报文的第一个Echo报文是组播报文，其组播地址固定开头为ff02::1:ff
（104位），后24位取目的地址的后24位，图中的目的地址为2000::5678，那么组播地址就是ff02::1:ff00:5678。
ND报文的第二个Reply报文，是正常的单播报文，无需特殊配置。
图4-1 IPv6 ND 报文统计示例图
!
Device A Device B
1、发送NS报文（组播） 2、发送NA报文（单播）
源IP
2409:8086:8526:0181:1234:5678:00fd:4320
目的IP
ff02::1:fffd:4321
ICMPv6
Type：NS (135)
ICMPv6 Data
源MAC：00e0-fcf2-13c5
源IP
2409:8086:8526:0181:1234:5678:00fd:4321
目的IP
2409:8086:8526:0181:1234:5678:00fd:4320
ICMPv6
Type：NA (136)
ICMPv6 Data
源MAC：00e0-fcf2-13c5
升级手册 ACL 流量统计配置元素介绍
10
ipv6 access-list counter_down_in
10 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4320 host ff02::1:fffd:4321 135
20 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4321 host
2409:8086:8526:0181:1234:5678:00fd:4320 136
1000 permit ipv6 any any
!
ipv6 access-list counter_down_out
10 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4320 host ff02::1:fffd:4321 135
20 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4321 host
2409:8086:8526:0181:1234:5678:00fd:4320 136
1000 permit ipv6 any any
!
ipv6 access-list counter_up_in
10 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4320 host ff02::1:fffd:4321 135
20 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4321 host
2409:8086:8526:0181:1234:5678:00fd:4320 136
1000 permit ipv6 any any
!
ipv6 access-list counter_up_out
10 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4320 host ff02::1:fffd:4321 135
20 permit icmp host 2409:8086:8526:0181:1234:5678:00fd:4321 host
2409:8086:8526:0181:1234:5678:00fd:4320 136
1000 permit ipv6 any any
!
4.2 在不同接口应用 ACL
4.2.1 二层以太网接口
接口特征：
 接口名称为物理接口编号
 接口名称没有子接口ID
 接口配置存在switchport关键字
配置示例：
interface FortyGigabitEthernet 6/31
switchport mode trunk
switchport trunk allowed vlan only 10-20
4.2.2 三层以太网接口
接口特征：
 接口名称为物理接口编号
 接口名称没有子接口ID
 接口配置存在no switchport关键字
配置示例：
升级手册 ACL 流量统计配置元素介绍
11
interface FortyGigabitEthernet 6/31
no switchport
vrf forwarding PCAP-TEST
ip address 5.5.5.1 255.255.255.0
4.2.3 三层以太网子接口
接口特征：
 接口名称为物理接口编号
 接口名称有子接口ID
 接口配置存在encapsulation关键字
配置示例：
interface FortyGigabitEthernet 6/31.11
encapsulation dot1Q 11
vrf forwarding PCAP-TEST
ip address 5.5.5.1 255.255.255.0
4.2.4 二层聚合接口
接口特征：
 接口名称为AggregatePort打头
 接口名称无子接口ID
 接口配置存在switchport关键字
配置示例：
interface AggregatePort 99
switchport mode trunk
switchport trunk allowed vlan only 10-20
4.2.5 三层聚合接口
接口特征：
 接口名称为AggregatePort打头
 接口名称无子接口ID
 接口配置存在no switchport关键字
配置示例：
interface AggregatePort 99
no switchport
ip address 5.5.5.1 255.255.255.0
4.2.6 三层聚合子接口
接口特征：
 接口名称为AggregatePort打头
 接口名称有子接口ID
 接口配置存在encapsulation关键字
升级手册 ACL 流量统计典型部署方法详解及分析
12
配置示例：
interface AggregatePort 99.11
encapsulation dot1Q 11
vrf forwarding PCAP-TEST
ip address 5.5.5.1 255.255.255.0
4.2.7 SVI 接口
说明
SVI接口的出方向不支持ACL流量统计。
接口特征：
 接口名称为VLAN
配置示例：
interface VLAN 11
ip address 5.5.5.1 255.255.255.0
4.2.8 VXLAN 实例
配置示例：
vxlan 100
expert access-group counter_up_in in