Brocade Communications Systems Brocade ICX 6650 6650 - Manual (Page 169)

Brocade ICX 6650 Security Configuration Guide 149
53-1002601-01
Enabling and using ACL statistics
Enabling ACL statistics
The procedure for enabling ACL statistics is similar to the procedure for applying a rate limit: first
create a traffic policy, then reference the traffic policy in an extended ACL entry, and finally bind the
ACL to an interface. The ACL counting policy becomes effective on ports to which the ACLs are
bound.
You also can enable ACL statistics when you create a traffic policy for rate limiting. Refer to
“Enabling ACL statistics with rate limiting traffic policies” on page 150.
Follow these steps to enable ACL statistics without applying a rate limit.
1. Create a traffic policy. Enter a command such as the following.
Brocade(config)# traffic-policy TPD5 count
2. Create an extended ACL entry or modify an existing extended ACL entry that references the
traffic policy definition. Enter a command such as the following.
Brocade(config)# access-list 101 permit ip host 10.10.12.2 any traffic-policy
TPD5
3. Bind the ACL to an interface. Enter commands such as the following.
Brocade(config)# interface ethernet 1/1/4
Brocade(config-if-e10000-1/1/4)# ip access-group 101 in
Brocade(config-if-e10000-1/1/4)# exit
The previous commands configure an ACL counting policy and apply it to port e1/1/4. Port e1/1/4
counts the number of packets and the number of bytes on the port that were permitted or denied
by ACL filters.
Syntax: [no] traffic-policy TPD-name count
Syntax: access-list num permit | deny.... traffic policy TPD-name
Syntax: [no] ip access-group num in
NOTE
For brevity, some parameters were omitted from the access-list syntax.
ATTENTION
Brocade ICX 6650 allows you to add a reference to a non-existent TPD in an ACL statement and to
bind that ACL to an interface. Brocade ICX 6650 does not issue a warning or an error message for
non-existent TPDs.
Use the no form of the command to delete a traffic policy definition. Note that you cannot delete a
traffic policy definition if it is currently in use on a port. To delete a traffic policy, first unbind the
associated ACL.
The TPD-name variable is the name of the traffic policy definition. This value can be eight
alphanumeric characters or less.