H3C S5800交换机下发策略路由后display acl显示没有数据匹配的处理

H3C S5800交换机下发策略路由后display acl显示没有数据匹配的处理

一、   组网：

某重要局点采用省、市、县典型的三级网组网结构，下连9个地市，每个地市组网如图：

 

二、   问题描述：

S5800双上行到地市的MSR50，用策略路由实现视频业务和数据的分流，S5800下挂加密机，咨询加密机厂家，ipsec只加密数据部分，不加密IP头部，在S5800直接接一台PC，通过PC接收数据判断S5800的路由策略是生效的，但数据经过加密机后，display acl all显示没有数据匹配。

三、 过程分析：

S5800策略路由是根据源、目的IP进行ACL匹配来实现的。经过加密机加密报文源、目的IP都没有改变，策略路由应该是生效的。为何使用display acl all命令查看没有数据匹配策略路由呢？仔细分析交换机和路由器的差别以及交换机的包过滤动作中也无法查看ACL匹配报文数据，其原因就明确了。因为交换机基本硬件ASIC芯片实现，默认包过滤，策略路由仅仅实现过滤和策略动作但不做统计，因此使用display acl all命令没有数据匹配。

但使用交换机提供的隐藏和诊断命令却可以看到策略路由的规则已经下发：

1.检查策略路由ACL规则类型及规则数量：

[CC_S5800]en_diag

CAUTION : Now you enter a en_diag command view for developer's testing, some commands may be dangerous, please carefully use it with our engineer's direction.

[CC_S5800-diagnose]debug qacl show acl-resc 1 0

....

------------------------------------------------------

Group 13,usedEntries 3,physlice 2,mode Single

======================================

acl type usedEntries

======================================

[108]Policy Based Routing 3

------------------------------------------------------

2.确认策略路由规则的具体内容：

[CC_S5800-diagnose]debug qacl show 1 0 v 0 acl-type 108

Acl-Type Policy Based Routing, Stage IFP, GroupPri 13, EntryID 118, Active

Health 1, PoolFree 0, PoolID 0, Prio_Mjr 519, Prio_Sub 128909310,Slice 2,SliceIdx 0

PBR Policy video_data, Node Addr 0x1c26b1e0, VlanIntf 6, Node 10, ApplyIdx 0, Match ACl 1(Yes 1: No 0)

ACL GroupNo : 3000, RuleID : 0

Rule Match --------

Ports: 0x3c3fc3c7fffffe, 0x7c3fc3ffffffff

Lookup: STP forwarding, L2 dst L3 bit, 0x118, 0x118

Outer Vlan: 0x6, 0xfff

Dest IP: 10.22.10.0, 255.255.255.0

IP Type: Any IPv4 packet

Actions --------

L3Switch ipv4 addr 192.252.4.1, 255.255.255.255, nexthop_idx 0x186a3, ulRtnPbrIndex 1

Permit

========

Acl-Type Policy Based Routing, Stage IFP, GroupPri 13, EntryID 119, Active

Health 1, PoolFree 0, PoolID 0, Prio_Mjr 519, Prio_Sub 128909305,Slice 2,SliceIdx 1

PBR Policy video_data, Node Addr 0x1c26b1e0, VlanIntf 6, Node 10, ApplyIdx 0, Match ACl 1(Yes 1: No 0)

ACL GroupNo : 3000, RuleID : 5

Rule Match --------

Ports: 0x3c3fc3c7fffffe, 0x7c3fc3ffffffff

Lookup: STP forwarding, L2 dst L3 bit, 0x118, 0x118

Outer Vlan: 0x6, 0xfff

Source IP: 10.122.20.0, 255.255.255.0

IP Type: Any IPv4 packet

Actions --------

L3Switch ipv4 addr 192.252.4.1, 255.255.255.255, nexthop_idx 0x186a3, ulRtnPbrIndex 2

Permit

========

Acl-Type Policy Based Routing, Stage IFP, GroupPri 13, EntryID 311, Active

Health 1, PoolFree 0, PoolID 0, Prio_Mjr 519, Prio_Sub 123666430,Slice 2,SliceIdx 2

PBR Policy video_data, Node Addr 0x1c275f10, VlanIntf 6, Node 20, ApplyIdx 0, Match ACl 1(Yes 1: No 0)

ACL GroupNo : 3010, RuleID : 0

Rule Match --------

Ports: 0x3c3fc3c7fffffe, 0x7c3fc3ffffffff

Lookup: STP forwarding, L2 dst L3 bit, 0x118, 0x118

Outer Vlan: 0x6, 0xfff

Dest IP: 10.0.0.0, 255.0.0.0

IP Type: Any IPv4 packet

Actions --------

L3Switch ipv4 addr 192.252.3.1, 255.255.255.255, nexthop_idx 0x186a4, ulRtnPbrIndex 5

Permit

四、 解决方法：

采用QACL方式来实现数据与视频的分流，在traffic behavior中，以包计数统计匹配acl数据：

S5800简要配置如下：

#

acl number 3000 name video

rule 0 permit ip source 10.22.10.0 0.0.0.255

acl number 3010 name data

rule 0 permit ip source 10.0.0.0 0.255.255.255

#

traffic classifier video operator and

if-match acl 3000

traffic classifier data operator and

if-match acl 3010

#

traffic behavior video

accounting packet

 redirect next-hop 192.252.1.1 fail-action forward

traffic behavior test

accounting packet

traffic behavior data

accounting packet

redirect next-hop 192.252.0.1 fail-action forward

#

qos policy video_data

classifier video behavior video

classifier data behavior data

#

interface Vlan-interface10

description shengyuan-video

ip address 10.22.10.253 255.255.255.0

ip policy-based-route vide

#

interface GigabitEthernet1/0/3

port link-mode bridge

port access vlan 10

qos apply policy video_data inbound

#

然后使用QoS查看命令检查策略路由匹配统计即可看到统计结果，其具体查看命令为：

Dislpay qos policy interface GigabitEthernet1/0/3