IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

ACL statistics counter

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes how the ACL statistics counter feature on the Cisco 8000 Series Router tracks the count of packets that a router permits or denies based on the ACL rules configured on an interface.

The ACL statistics counter is an ACL monitoring feature that

  • tracks the quantity of packets the router permits or denies

  • facilitates ACL-based traffic mirroring, and

  • identifies specific ACE matches for permitted traffic.

By default, the ACL statistics counter allows you to track only the count of packets that are denied. By configuring the hw-module profile stats acl-permit command, you can also track the count of packets that are permitted. Routers use this knowledge of the count of packets for ACL-based traffic mirroring.

Restrictions for the ACL statistics counter

These restrictions apply for the ACL statistics counter:

  • After you configure the hw-module profile stats acl-permit command on the router, you must reload the router or the line cards based on the requirement. Configuring the command followed by reloading the router or line cards enables tracking of the permitted packet count on the router or line cards.

  • Starting with Cisco IOS XR Release 26.2.1, MPLS-to-IP packet-accounting counters may not update when hw-module profile stats acl-permit is enabled. If MPLS-to-IP packet accounting is required, do not enable ACL permit statistics.

  • To restore MPLS-to-IP packet accounting, remove the ACL permit statistics profile and reload the affected line cards or router.

  • If the hardware module statistics for ACL (hw-module profile stats acl-permit ) is enabled, the flowspec drop counter functionality does not work for the NP1-based platforms.

  • ACL named counter configuration is not supported. Although configurations with named counters are accepted, you cannot query counters by their names. Starting with Cisco IOS XR Release 25.4.1, a log message is displayed similar to pfilter_ea[225]: %PKT_INFRA-DPA_FM-4-ACL_NAMED_COUNTER_NOT_SUPPORTED : ACL Named counter is not supported.

Configure the ACL statistics counter

Use this procedure to configure an ACL, attach it to an interface, and enable tracking of the permitted packet count on the router.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

  2. Configure an ACL by using the ipv4 access-list acl-name command and add the required access control entries.

    Example:

    Router(config)# ipv4 access-list TEST
Router(config-ipv4-acl)# 10 permit ipv4 any any
Router(config-ipv4-acl)# 20 deny udp any any
Router(config-ipv4-acl)# commit
Router(config-ipv4-acl)# exit

  3. Enter interface configuration mode and attach the configured ACL to the interface by using the ipv4 access-group acl-name ingress command.

    Example:

    Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv4 access-group TEST ingress
Router(config-if)# commit
Router(config-if)# exit

  4. Enable tracking of the permitted packet count by configuring the hw-module profile stats acl-permit command.

    Example:

    Router(config)# hw-module profile stats acl-permit
Router(config)# commit

  5. Reload the router or the line cards to activate the stats profile.

    Example:

    Router# reload location 0/0/CPU0

  6. Verify whether tracking of the permitted packet count is enabled by using the show access-lists ipv4 acl-name hardware ingress location node-id command.

    Example:

    Router# show access-lists ipv4 TEST hardware ingress location 0/0/CPU0
ipv4 access-list test-v4-ttl
 10 permit ipv4 any any ttl eq 100
 20 deny ipv4 any any ttl eq 200 (44043 matches)
Router# configure
Router(config)# hw-module profile stats acl-permit
In order to activate/deactivate this stats profile, you must manually reload the chassis/all line cards
Router(config)# commit
Router# reload location 0/0/CPU0


Router# show access-lists ipv4 TEST hardware ingress location 0/0/CPU0
ipv4 access-list test-v4-ttl
 10 permit ipv4 any any ttl eq 100 (346318 matches)
 20 deny ipv4 any any ttl eq 200 (44043 matches)

    You have successfully configured the ACL statistics counter and verified that the router tracks the count of permitted packets based on the ACL rules.