ACL流量统计主要分为两大技术定位法，分别是Counter-only ACL计数定位法和传统ACL计数定位法。这两个计
数定位法都分别存在四个相同类型的计数（IP ACL计数、MAC ACL计数、Expert ACL计数、IPv6 ACL计数）。
每个计数都是固定分为四个步骤：流量计数部署、流量计数查看、流量计数清零、流量统计配置清除。
5.1 Counter-only ACL 计数定位法（11.X 推荐）
Sequence大等于1000的ACE为可选配置，未配置不会影响Counter-only ACL计数功能和业务。本章节依旧列出
的原因是数据中心各个版本各个型号设备均有，建议保持一致的ACE配置习惯，避免出错。
5.1.1 IPv4 ACL 计数
图5-1 IPv4 ACL 计数网络拓扑图
Leaf 5.5.5.5
Device A Device B Device C
Leaf 7.7.7.7
流量统计设备
FG 6/13 FG 6/31
up down
升级手册 ACL 流量统计典型部署方法详解及分析
13
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了ip access-group。若已配置了ip access-group，再
配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
show ip access-group
show running-config interface FortyGigabitEthernet 6/13
show running-config interface FortyGigabitEthernet 6/31
(3) 创建IPv4 ACL流量统计匹配规则。通信两端主机IP地址为5.5.5.5和7.7.7.7。
ip access-list extended counter_up_in
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
ip access-list extended counter_up_out
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
ip access-list extended counter_down_in
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
ip access-list extended counter_down_out
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
(4) 在流量经过的接口in和out方向按需调用ACL。
升级手册 ACL 流量统计典型部署方法详解及分析
14
注意
必须配置counter-only关键字，否则可能造成业务中断。
interface FortyGigabitEthernet 6/13
ip access-group counter_up_in in counter-only
ip access-group counter_up_out out counter-only
!
interface FortyGigabitEthernet 6/31
ip access-group counter_down_in in counter-only
ip access-group counter_down_out out counter-only
!
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
interface FortyGigabitEthernet 6/13
no ip access-group counter_up_in in
no ip access-group counter_up_out out
!
interface FortyGigabitEthernet 6/31
no ip access-group counter_down_in in
no ip access-group counter_down_out out
!
(3) 检查配置是否还原。
升级手册 ACL 流量统计典型部署方法详解及分析
15
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
5.1.2 MAC ACL 计数
图5-2 MAC ACL 计数网络拓扑图
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了mac access-group。若已配置了mac accessgroup，再配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
show mac access-group
show running-config interface AggregatePort 100
show running-config interface AggregatePort 99
(3) 创建MAC ACL流量统计匹配规则。通信两端主机MAC地址为c0b8.e672.c2f5和c0b8.e6fe.c7fe。
mac access-list extended counter_down_in
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_down_out
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_up_in
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
Leaf 5.5.5.5
Device A Device B Device C
Leaf 5.5.5.6
流量统计设备
FG 6/13
AG 100
FG 6/31
AG 99
up down
MAC: c0b8.e6fe.c7fe MAC: c0b8.e672.c2f5
升级手册 ACL 流量统计典型部署方法详解及分析
16
!
mac access-list extended counter_up_out
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
(4) 在流量经过的接口in和out方向按需调用ACL。
注意
必须配置counter-only关键字，否则可能造成业务中断。
interface AggregatePort 99
mac access-group counter_down_in in counter-only
mac access-group counter_down_out out counter-only
interface AggregatePort 100
mac access-group counter_up_in in counter-only
mac access-group counter_up_out out counter-only
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
interface AggregatePort 99
no mac access-group counter_up_in in
no mac access-group counter_up_out out
!
interface AggregatePort 100
升级手册 ACL 流量统计典型部署方法详解及分析
17
no mac access-group counter_down_in in
no mac access-group counter_down_out out
!
(3) 检查配置是否还原。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
5.1.3 Expert ACL 计数
图5-3 Expert ACL 计数网络拓扑图
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了expert access-group。若已配置了expert accessgroup，再配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
show expert access-group
show running-config interface FortyGigabitEthernet 6/13
show running-config interface FortyGigabitEthernet 6/31
(3) 创建Expert ACL流量统计匹配规则，统计携带VLAN标签的二层数据。通信两端主机MAC地址为
c0b8.e672.c2f5和c0b8.e6fe.c7fe，属于VLAN 11。
expert access-list extended l2_counter_down_in
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
Leaf 5.5.5.5
Device A Device B Device C
Leaf 5.5.5.6
流量统计设备
FG 6/13
AG 100
FG 6/31
AG 99
VLAN 11 up down VLAN 11
MAC: c0b8.e6fe.c7fe MAC: c0b8.e672.c2f5
升级手册 ACL 流量统计典型部署方法详解及分析
18
!
expert access-list extended l2_counter_down_out
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
!
expert access-list extended l2_counter_up_in
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
!
expert access-list extended l2_counter_up_out
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
(4) 创建Expert ACL流量统计匹配规则，统计携带统计VXLAN内层IPv4报文数据。通信两端主机在VXLAN隧道
中的内层IPv4地址为5.5.5.5和5.5.5.6。
expert access-list extended counter_up_in
10 permit vxlan-ignore-dport ip host 5.5.5.5 host 5.5.5.6
20 permit vxlan-ignore-dport ip host 5.5.5.6 host 5.5.5.5
30 permit vxlan ip host 5.5.5.5 host 5.5.5.6
40 permit vxlan ip host 5.5.5.6 host 5.5.5.5
50 permit ip host 5.5.5.5 any host 5.5.5.6 any
60 permit ip host 5.5.5.6 host any 5.5.5.5 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended counter_down_in
10 permit vxlan-ignore-dport ip host 5.5.5.5 host 5.5.5.6
20 permit vxlan-ignore-dport ip host 5.5.5.6 host 5.5.5.5
30 permit vxlan ip host 5.5.5.5 host 5.5.5.6
40 permit vxlan ip host 5.5.5.6 host 5.5.5.5
升级手册 ACL 流量统计典型部署方法详解及分析
19
50 permit ip host 5.5.5.5 any host 5.5.5.6 any
60 permit ip host 5.5.5.6 host any 5.5.5.5 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
(5) 在流量经过的接口in和out方向按需调用ACL。仅以统计携带统计VXLAN内层IPv4报文数据作为举例。
注意
必须配置counter-only关键字，否则可能造成业务中断。
interface AggregatePort 99
expert access-group counter_up_in in counter-only
expert access-group counter_up_out out counter-only
!
interface AggregatePort 100
expert access-group counter_down_in in counter-only
expert access-group counter_down_out out counter-only
!
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
interface AggregatePort 99
升级手册 ACL 流量统计典型部署方法详解及分析
20
no expert access-group counter_up_in in
no expert access-group counter_up_out out
!
interface AggregatePort 100
no expert access-group counter_down_in in
no expert access-group counter_down_out out
!
(3) 检查配置是否还原。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
5.1.4 IPv6 ACL 计数
图5-4 IPv6 ACL 计数网络拓扑图
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了ipv6 traffic-filter。若已配置了ipv6 traffic-filter，再
配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
show ipv6 traffic-filter
show running-config interface AggregatePort 100
show running-config interface AggregatePort 99
(3) 创建IPv6 ACL流量统计匹配规则。通信两端主机IP地址为5555::5和5555::6。
ipv6 access-list counter_up_in
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
Leaf 5555::5
Device A Device B Device C
Leaf 5555::6
流量统计设备
FG 6/13
AG 100
FG 6/31
AG 99
up down
升级手册 ACL 流量统计典型部署方法详解及分析
21
ipv6 access-list counter_up_out
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_in
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_out
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
(4) 在流量经过的接口in和out方向按需调用ACL。
注意
必须配置counter-only关键字，否则可能造成业务中断。
interface AggregatePort 99
ipv6 traffic-filter counter_down_in in counter-only
ipv6 traffic-filter counter_down_out out counter-only
interface AggregatePort 100
ipv6 traffic-filter counter_up_in in counter-only
ipv6 traffic-filter counter_up_out out counter-only!
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
升级手册 ACL 流量统计典型部署方法详解及分析
22
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
interface AggregatePort 99
no ipv6 traffic-filter counter_up_in in
no ipv6 traffic-filter counter_up_out out
!
interface AggregatePort 100
no ipv6 traffic-filter counter_down_in in
no ipv6 traffic-filter counter_down_out out
!
(3) 检查配置是否还原。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
5.2 传统 ACL 计数定位法（12.X 推荐）
5.2.1 IPv4 ACL 计数
图5-5 IPv4 ACL 计数网络拓扑图
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了ip access-group。若已配置了ip access-group，再
配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
Leaf 5.5.5.5
Device A Device B Device C
Leaf 7.7.7.7
流量统计设备
FG 6/13 FG 6/31
up down
升级手册 ACL 流量统计典型部署方法详解及分析
23
show ip access-group
show running-config interface FortyGigabitEthernet 6/13
show running-config interface FortyGigabitEthernet 6/31
(3) 创建IPv4 ACL流量统计匹配规则。通信两端主机IP地址为5.5.5.5和7.7.7.7。
注意
ACE sequence 1000及大于1000的permit xx any any类别规则必须配置，否则会造成业务影响。
ip access-list extended counter_up_in
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
ip access-list extended counter_up_out
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
ip access-list extended counter_down_in
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
ip access-list extended counter_down_out
10 permit ip host 5.5.5.5 host 7.7.7.7
10 remark A_to_B
20 permit ip host 7.7.7.7 host 5.5.5.5
20 remark B_to_A
1000 permit ip any any
!
(4) 在全局配置模式下启用ACL流量统计。
ip access-list counter counter_down_in
ip access-list counter counter_down_out
ip access-list counter counter_up_in
ip access-list counter counter_up_out
(5) 在流量经过的接口in/out方向按需调用ACL。
interface FortyGigabitEthernet 6/13
ip access-group counter_up_in in
ip access-group counter_up_out out
升级手册 ACL 流量统计典型部署方法详解及分析
24
!
interface FortyGigabitEthernet 6/31
ip access-group counter_up_in in
ip access-group counter_up_out out
!
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
interface FortyGigabitEthernet 6/13
no ip access-group counter_up_in in
no ip access-group counter_up_out out
!
interface FortyGigabitEthernet 6/31
no ip access-group counter_down_in in
no ip access-group counter_down_out out
!
(3) 清除全局统计配置。
no ip access-list extended counter_up_in
no ip access-list extended counter_up_out
no ip access-list extended counter_down_in
no ip access-list extended counter_down_out
(4) 检查配置是否还原。
升级手册 ACL 流量统计典型部署方法详解及分析
25
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
5.2.2 MAC ACL 计数
图5-6 MAC ACL 计数网络拓扑图
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了mac access-group。若已配置了mac accessgroup，再配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
show mac access-group
show running-config interface AggregatePort 100
show running-config interface AggregatePort 99
(3) 创建MAC ACL流量统计匹配规则。通信两端主机MAC地址为c0b8.e672.c2f5和c0b8.e6fe.c7fe。
注意
ACE sequence 1000及大于1000的permit xx any any类别规则必须配置，否则会造成业务影响。
mac access-list extended counter_down_in
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_down_out
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_up_in
Leaf 5.5.5.5
Device A Device B Device C
Leaf 5.5.5.6
流量统计设备
FG 6/13
AG 100
FG 6/31
AG 99
up down
MAC: c0b8.e6fe.c7fe MAC: c0b8.e672.c2f5
升级手册 ACL 流量统计典型部署方法详解及分析
26
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
!
mac access-list extended counter_up_out
10 permit host c0b8.e672.c2f5 host c0b8.e6fe.c7fe etype-any
20 permit host c0b8.e6fe.c7fe host c0b8.e672.c2f5 etype-any
1000 permit any any etype-any
(4) 在全局配置模式下启用ACL流量统计。
mac access-list counter counter_down_in
mac access-list counter counter_down_out
mac access-list counter counter_up_in
mac access-list counter counter_up_out
(5) 在流量经过的接口in/out方向按需调用ACL。
interface AggregatePort 99
mac access-group counter_down_in in
mac access-group counter_down_out out
interface AggregatePort 100
mac access-group counter_up_in in
mac access-group counter_up_out out!
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
升级手册 ACL 流量统计典型部署方法详解及分析
27
interface AggregatePort 99
no mac access-group counter_up_in in
no mac access-group counter_up_out out
!
interface AggregatePort 100
no mac access-group counter_down_in in
no mac access-group counter_down_out out
!
(3) 清除全局统计配置。
no mac access-list extended counter_up_in
no mac access-list extended counter_up_out
no mac access-list extended counter_down_in
no mac access-list extended counter_down_out
(4) 检查配置是否还原。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
5.2.3 Expert ACL 计数
图5-7 Expert ACL 计数网络拓扑图
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了expert access-group。若已配置了expert accessgroup，再配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
show expert access-group
show running-config interface FortyGigabitEthernet 6/13
show running-config interface FortyGigabitEthernet 6/31
Leaf 5.5.5.5
Device A Device B Device C
Leaf 5.5.5.6
流量统计设备
FG 6/13
AG 100
FG 6/31
AG 99
VLAN 11 up down VLAN 11
MAC: c0b8.e6fe.c7fe MAC: c0b8.e672.c2f5
升级手册 ACL 流量统计典型部署方法详解及分析
28
(3) 创建Expert ACL流量统计匹配规则，统计携带VLAN标签的二层数据。通信两端主机MAC地址为
c0b8.e672.c2f5和c0b8.e6fe.c7fe，属于VLAN 11。
expert access-list extended l2_counter_down_in
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
!
expert access-list extended l2_counter_down_out
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
!
expert access-list extended l2_counter_up_in
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
!
expert access-list extended l2_counter_up_out
10 permit ip VID 11 any host c0b8.e672.c2f5 any host c0b8.e6fe.c7fe
20 permit ip VID 11 any host c0b8.e6fe.c7fe any host c0b8.e672.c2f5
1000 permit ip any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
(4) 创建Expert ACL流量统计匹配规则，统计携带统计VXLAN内层IPv4报文数据。通信两端主机在VXLAN隧道
中的内层IPv4地址为5.5.5.5和5.5.5.6。
注意
ACE sequence 1000及大于1000的permit xx any any类别规则必须配置，否则会造成业务影响。
expert access-list extended counter_up_in
10 permit vxlan-ignore-dport ip host 5.5.5.5 host 5.5.5.6
20 permit vxlan-ignore-dport ip host 5.5.5.6 host 5.5.5.5
升级手册 ACL 流量统计典型部署方法详解及分析
29
30 permit vxlan ip host 5.5.5.5 host 5.5.5.6
40 permit vxlan ip host 5.5.5.6 host 5.5.5.5
50 permit ip host 5.5.5.5 any host 5.5.5.6 any
60 permit ip host 5.5.5.6 host any 5.5.5.5 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
expert access-list extended counter_down_in
10 permit vxlan-ignore-dport ip host 5.5.5.5 host 5.5.5.6
20 permit vxlan-ignore-dport ip host 5.5.5.6 host 5.5.5.5
30 permit vxlan ip host 5.5.5.5 host 5.5.5.6
40 permit vxlan ip host 5.5.5.6 host 5.5.5.5
50 permit ip host 5.5.5.5 any host 5.5.5.6 any
60 permit ip host 5.5.5.6 host any 5.5.5.5 any
1000 permit ip any any any any
1010 permit arp any any
1020 permit 0x86DD any any
1030 permit etype-any any any
!
(5) 在全局配置模式下启用ACL流量统计。
expert access-list counter counter_down_in
expert access-list counter counter_down_out
expert access-list counter counter_up_in
expert access-list counter counter_up_out
(6) 在流量经过的接口in/out方向按需调用ACL。
interface AggregatePort 99
expert access-group counter_down_in in
expert access-group counter_down_out out
interface AggregatePort 100
expert access-group counter_up_in in
expert access-group counter_up_out out
!
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
升级手册 ACL 流量统计典型部署方法详解及分析
30
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
interface AggregatePort 99
no expert access-group counter_up_in in
no expert access-group counter_up_out out
!
interface AggregatePort 100
no expert access-group counter_down_in in
no expert access-group counter_down_out out
!
(3) 清除全局统计配置。
no expert access-list extended counter_up_in
no expert access-list extended counter_up_out
no expert access-list extended counter_down_in
no expert access-list extended counter_down_out
(4) 检查配置是否还原。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
5.2.4 IPv6 ACL 计数
图5-8 IPv6 ACL 计数网络拓扑图
Leaf 5555::5
Device A Device B Device C
Leaf 5555::6
流量统计设备
FG 6/13
AG 100
FG 6/31
AG 99
up down
升级手册 ACL 流量统计典型部署方法详解及分析
31
流量计数部署
(1) 查看现网设备ACL配置，确认新建ACL编号/名称和现网ACL配置无冲突，具体查询命令如下。
terminal length 0
terminal width 0
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
(2) 查看现网设备接口是否已经应用了ACL，即已经配置了ipv6 traffic-filter。若已配置了ipv6 traffic-filter，再
配置ACL流量统计将发生配置冲突，需结合业务需求临时删除原ACL或者在原ACL上新增ACE。
show ipv6 traffic-filter
show running-config interface AggregatePort 100
show running-config interface AggregatePort 99
(3) 创建IPv6 ACL流量统计匹配规则。通信两端主机IP地址为5555::5和5555::6。
注意
ACE sequence 1000及大于1000的permit xx any any类别规则必须配置，否则会造成业务影响。
ipv6 access-list counter_up_in
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_up_out
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_in
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
ipv6 access-list counter_down_out
10 permit ipv6 host 5555::5 host 5555::6
20 permit ipv6 host 5555::6 host 5555::5
1000 permit ipv6 any any
!
(4) 在全局配置模式下启用ACL流量统计。
ipv6 access-list counter ipv6_counter_down_in
ipv6 access-list counter ipv6_counter_down_out
ipv6 access-list counter ipv6_counter_up_in
ipv6 access-list counter ipv6_counter_up_out
升级手册 ACL 流量统计典型部署方法详解及分析
32
(5) 在流量经过的接口in/out方向按需调用ACL。
interface AggregatePort 99
ipv6 traffic-filter counter_down_in in
ipv6 traffic-filter counter_down_out out
interface AggregatePort 100
ipv6 traffic-filter counter_up_in in
ipv6 traffic-filter counter_up_out out
流量计数查看
精确查看流量计数
show access-lists counter_up_in
show access-lists counter_up_out
show access-lists counter_down_in
show access-lists counter_down_out
全局查看流量计数
show access-lists
流量计数清零
需在特权模式下执行，通过end命令强制回退到特权模式。
end
clear counters access-list
流量统计配置清除
(1) 保存全量配置信息。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
!
(2) 问题排查结束后，清除接口配置。
interface AggregatePort 99
no ipv6 access-group counter_up_in in
no ipv6 access-group counter_up_out out
!
interface AggregatePort 100
no ipv6 access-group counter_down_in in
no ipv6 access-group counter_down_out out
!
(3) 清除全局统计配置。
no ipv6 access-list extended counter_up_in
no ipv6 access-list extended counter_up_out
no ipv6 access-list extended counter_down_in
升级手册 ACL 流量统计典型部署方法详解及分析
33
no ipv6 access-list extended counter_down_out
(4) 检查配置是否还原。
show access-lists
show version
show tcam-mode status
show acl res
show acl res detail
