IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

ACL-based forwarding

Updated: August 12, 2026

Want to summarize with AI?

This topic describes ACL-based forwarding (ABF) on the Cisco 8000 Series Router, which routes traffic through a specified next hop instead of the path computed by routing protocols.

The ACL-based forwarding (ABF) is a network feature that

enables routing of specific traffic through designated paths instead of the paths computed by routing protocols
uses next-hop addresses specified in ACL configurations for forwarding packets, and
provides service selection from multiple providers for various types of traffic such as broadcast TV over IP, IP telephony, and data.

Converged networks carry voice, video, and data. Users may need to route certain traffic through specific paths instead of using the paths computed by routing protocols. You can achieve this by specifying the next-hop address in ACL configurations, so that the configured next-hop address from the ACL is used to forward the packet towards its destination instead of routing by packet-based destination address lookup. This feature of using next hop in ACL configurations for forwarding is called ACL-based forwarding (ABF).

Feature History Table

Table 1. Feature History Table
Feature Name	Release Information	Description
Permit statistics for ACL-based Forwarding (ABF)	Release 26.2.1	Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):* *This feature is supported on: 88-LC1-48Y8H-EM
Permit statistics for ACL-based Forwarding (ABF)	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Permit statistics for ACL-based Forwarding (ABF)	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
Permit statistics for ACL-based Forwarding (ABF)	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Permit statistics for ACL-based Forwarding (ABF)	Release 7.3.2	This feature enables the inclusion of permitted packet count for ABF in the hardware profile statistics, thus providing the cumulative packet count of permit and deny ACL and ABF. This information helps you plan your traffic management and distribution more effectively. Modified command: hw-module profile stats acl-permit

Restrictions for ACL-based forwarding

Traffic outages can occur during transitions from an existing next hop to another next hop.
IPv4 and IPv6 ABF next hops routed over GRE interfaces are not supported.
VRF-select (where only the VRF is configured for the next hop) is not supported in ABF for IPv4 and IPv6 addresses in releases before Cisco IOS XR Release 7.3.3.
Logging of permit statistics for ABF is not supported in releases before Cisco IOS XR Release 7.3.2.
ACL-based forwarding (ABF) is not supported over BVI in releases before Cisco IOS XR Release 7.5.3.

Enabling the log keyword on access control entries (ACEs) configured for ABF next-hop redirection causes the ABF redirect to fail, resulting in traffic not being forwarded to the specified next hops.

! Working (no logging)
permit ipv4 any 52.108.1.32/30 \
  nexthop1 ipv4 101.15.52.1 \
  nexthop2 ipv4 101.15.52.11 \
  nexthop3 ipv4 101.15.52.13

! Problematic (logging enabled – redirect fails)
permit ipv4 any 52.108.1.32/30 log \
  nexthop1 ipv4 101.15.52.1 \
  nexthop2 ipv4 101.15.52.11 \
  nexthop3 ipv4 101.15.52.13

ACL-based forwarding behavior and logging

ABF supports next-hop modifications. You can modify a next hop, remove a next hop, or make changes between existing next hops.

Note

While you define an ACE rule, you must specify the VRF for all next hops unless the next hop is in the default VRF. This process ensures that the packets take the right path towards the next hop.
ABF is ACL-based. Packets that do not match an existing rule (ACE) in the ACL are subject to the default ACL rule (drop all). If the ACL is used only for ABF redirect (not for security), include an explicit ACE rule at the end of the ACL (lowest user priority) to match and permit all traffic. This ensures that all traffic that does not match an ABF rule is permitted and forwarded normally.
ABF is supported on permit rules only.
ABF default route is not supported.
Packets punted in the ingress direction from the NPU to the line card CPU are not subject to ABF treatment because ABF is not supported in the slow path. These packets are forwarded normally based on destination-address lookup by the software dataplane. Examples of these types of packets include, but are not limited to, packets with IPv4 options, IPv6 extension headers, and packets destined for glean (unresolved or incomplete) adjacencies.

Logging of permit statistics for ABF

Starting with Cisco IOS XR Release 7.3.2, ABF supports logging of permit statistics. This feature tracks the number of packets that an ACL permits in the routing traffic. To enable logging of permit statistics for ABF, configure hardware module statistics for ACL before you configure ACL-based forwarding. To enable hardware module statistics for ACL, use the hw-module profile stats acl-permit command in XR Config mode. To disable the tracking of permitted packet count, use the no form of this command.

Note

After you enable hardware module statistics for ACL, you must reboot the line cards or the router based on the requirement.

Use the show access-lists ipv4 or show access-lists ipv6 command to view the ABF statistics.

Configure logging of permit statistics

Use this procedure to enable the tracking of permitted packet count for ABF traffic and to verify the ABF statistics on a selected interface.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Enable the hardware module statistics profile for ACL permit by using the hw-module profile stats acl-permit command.

Example:

Router(config)# hw-module profile stats acl-permit
Fri Aug  7 05:52:58.052 UTC
In order to activate/deactivate this stats profile, you must manually reload the chassis/all line cards

Commit the configuration.

Example:

Router(config)# commit
Fri Aug 7 05:55:50.103 UTC
LC/0/4/CPU0:Aug 7 05:55:50.218 UTC: fia_driver[245]: %FABRIC-FIA_DRVR-4-STATS_HW_PROFILE_MISMATCH : Mismatch found, reload LC to activate the new stats profile
Router(config)#

Reload the line cards or the chassis to activate the stats profile.
Verify the ABF statistics on a selected interface by using the show access-lists ipv4 or show access-lists ipv6 command.
Example:
```
Router# show access-lists ipv4 test-acl-ipv4 hardware ingress location 0/0/CPU0
Tue Sep 21 07:37:41.297 UTC
ipv4 access-list test-acl-ipv4
10 permit ipv4 any any (14950)
```
You have successfully configured logging of permit statistics for ACL-based forwarding.

Configure ACL-based forwarding

Use this procedure to configure ACL-based forwarding (ABF) by defining IPv4 and IPv6 ACLs with next-hop addresses, and to verify the running configuration and next-hop state.

Procedure

Enter IPv4 access list configuration mode and configure an ACL with the required ACEs and next hops for ABF.

Example:

Router# configure
Router(config)# ipv4 access-list abf-acl
Router(config-ipv4-acl)# 10 permit ipv4 192.168.18.0 0.255.255.255 any nexthop1 ipv4 192.168.20.2
Router(config-ipv4-acl)# 15 permit ipv4 192.168.21.0 0.0.0.255 any
Router(config-ipv4-acl)# 20 permit ipv4 192.168.22.0 0.0.255.255 any nexthop1 ipv4 192.168.23.2
Router(config-ipv4-acl)# 25 permit tcp any range 2000 3000 any range 4000 5000 nexthop1 ipv4 192.168.23.1 nexthop2 ipv4 192.168.24.1 nexthop3 ipv4 192.168.25.1
Router(config-ipv4-acl)# 30 permit tcp any eq www host 192.168.12.2 precedence immediate nexthop1 vrf vrf1_ipv4 ipv4 192.168.13.2 nexthop2 vrf vrf1_ipv4 ipv4 192.168.14.2
Router(config-ipv4-acl)# 35 permit ipv4 any any
Router(config-ipv4-acl)# commit

Enter IPv6 access list configuration mode and configure an ACL with the required ACEs and next hops for ABF.

Example:

Router# configure
Router(config)# ipv6 access-list abf-acl
Router(config-ipv6-acl)# 10 permit ipv6 2001:db8::/32 any nexthop1 ipv6 2001:db8::2
Router(config-ipv6-acl)# 25 permit tcp any range 2000 3000 any range 4000 5000 nexthop1 ipv6 2001:db8::3 nexthop2 ipv6 2001:db8::4 nexthop3 ipv6 2001:db8::5
Router(config-ipv6-acl)# 30 permit tcp any eq www host 2001:db8::8 precedence immediate nexthop1 vrf vrf1_ipv6 ipv6 2001:db8::7 nexthop2 vrf vrf1_ipv6 ipv6 2001:db8::6
Router(config-ipv6-acl)# 35 permit ipv6 any any
Router(config-ipv6-acl)# commit

Verify the running configuration.

Example:

Router# show access-lists ipv4
ipv4 access-list abf-acl
10 permit ipv4 192.168.18.0 0.255.255.255 any nexthop1 192.168.20.2
15 permit ipv4 192.168.21.0 0.0.0.255 any
20 permit ipv4 192.168.22.0 0.0.255.255 any nexthop1 192.168.23.2
25 permit tcp any range 2000 3000 any range 4000 5000 nexthop1 ipv4 192.168.23.1 nexthop2 ipv4 192.168.24.1 nexthop3 ipv4 192.168.25.1
30 permit tcp any eq www host 192.168.12.2 precedence immediate nexthop1 vrf vrf1_ipv4 ipv4 192.168.13.2 nexthop2 vrf vrf1_ipv4 ipv4 192.168.14.2
35 permit ipv4 any any
!
Router# show access-lists ipv6
ipv6 access-list abf-acl-ipv6
 10 permit ipv6 2001:db8::/32 any nexthop1 ipv6 2001:db8::2
 25 permit tcp any range 2000 3000 any range 4000 5000 nexthop1 ipv6 2001:db8::3 nexthop2 ipv6 2001:db8::4 nexthop3 ipv6 2001:db8::5
 30 permit tcp any eq www host 2001:db8::8 precedence immediate nexthop1 vrf vrf1_ipv6 ipv6 2001:db8::7 nexthop2 vrf vrf1_ipv6 ipv6 2001:db8::6
 35 permit ipv6 any any

Verify the IP next-hop state in ABF to ensure that the expected next hop is up.

Example:

Router# show access-lists ipv4 abf nexthops client pfilter_ea location 0/3/CPU0
Tue May 17 22:25:05.940 UTC

 ACL name : abf-acl
  ACE seq.           NH-1                   NH-2                   NH-3
 ---------  ---------------------  ---------------------  ---------------------
        20    Global 192.168.23.2            Not present            Not present
    status                     UP            Not present            Not present
     exist                     No            Not present            Not present
    pd ctx                Present            Not present            Not present
                Track not present      Track not present                   --
        25    Global 192.168.23.1    Global 192.168.24.1        Global 192.168.25.1
    status                     UP                     UP            UP
     exist                    Yes                    Yes            Yes
    pd ctx                Present                Present            Present
                Track not present      Track not present            Track not present

Verify whether ABF is attached to any interfaces on any line card.

Example:

Router# show access-lists usage pfilter location all
sh access-lists ipv4 abf nexthops client pfilter_ea loc 0/RP0/CPU0
Wed Jul 29 20:48:18.559 UTC

ACL name : abf-1
  ACE seq.        NH-1             NH-2             NH-3
 ---------  ---------------  ---------------  ---------------
        10    27.138.216.32         28.0.0.2      Not present
    status               UP               UP      Not present
at status       Not Present      Not Present      Not present
     exist               No              Yes      Not present
       vrf          default          default      Not present
     track      Not present      Not present      Not present
    pd ctx          Present          Present      Not present

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.