R3721-F3210-F3171-HP High-End Firewalls Network Management Configuration Guide-6PW101

534
Task Command Remarks
Display the PBR policy information.
display policy-based-route [ policy-name ]
[ | { begin | exclude | include }
regular-expression ]
Available in any view
Clear PBR statistics.
reset policy-based-route statistics
[ policy-name ]
Available in user view
NOTE:
• If a policy has a node with no if-match or apply clause configured, all packets can pass the policy.
However, no action is taken and the packets will not
g
o to the next policy node for a match. The statistics
of PBR will be changed.
• If a policy node has if-match clauses but no apply clauses confi
g
ured, packets will match a
g
ainst these
if-match clauses. However, no apply clauses are applicable to the permitted packets, and the packets
will not go to the next policy node for a match. The statistics of PBR will be changed.
• If a policy node has no if-match clause but apply clauses configured, all packets can pass the policy,
and then are forwarded according to the apply clauses if the permit keyword is specified for the node,
or are denied if the deny keyword is specified. The packets will not go to the next policy node for a
match. The statistics of PBR will be changed.
• If the match mode of a policy node is deny, no apply clause will be executed for the packets satisfyin
g
all the if-match clauses, and the packets will not go to the next policy node for a match. They will be
forwarded according to the routing table instead. Neither debu
gg
in
g
information nor statistics for the
deny match mode can be displayed.
Configuring local PBR based on packet type at the CLI
Network requirements
As shown in Figure 310, configure PBR on Firewall, so that all TCP packets are forwarded via
GigabitEthernet 0/1 and other packets are forwarded according to the routing table.
Firewall is directly connected to Router A and Router B. Router A and Router B are unreachable to each
other.
Figure 310 Network diagram
Configuration procedure
1. Configure Firewall.
# Define ACL 3101 to match TCP packets.
<Firewall> system-view
[Firewall] acl number 3101
[Firewall-acl-adv-3101] rule permit tcp
[Firewall-acl-adv-3101] quit