This section provides information to configure filter policies using the command line interface.
Topics in this section include:
This section provides a brief overview of the tasks that must be performed for both IP and MAC filter configurations and provides the CLI commands.
To configure a filter policy, perform the following tasks:
Configuring and applying filter policies is optional. Each filter policy must have the following:
Within a filter policy, configure filter entries which contain criteria against which ingress, egress, or network traffic is matched. The action specified in the entry determine how the packets are handled, such as dropping or forwarding.
The following displays an IPv4 filter entry configuration example.
If http-redirect is specified as an action, a corresponding forward entry must be specified before the redirect. Http-redirect is not supported on the 7450 ESS-1 model.
The following displays an http-redirect configuration example:
Within a filter entry, you can specify that traffic matching the associated IPv4 filter entry is sampled. if the IPv4 interface is set to cflowd acl mode. Enabling filter-sample enables the cflowd tool.
The following displays an IPv4 filter entry configuration example.
Within a filter entry, you can also specify that traffic matching the associated IPv4 filter entry is not sampled by cflowd if the IPv4 interface is set to cflowd interface mode. The following displays an IPv4 filter entry configuration example:
Configuring and applying IPv6 filter policies is optional. IPv6 Filter Policy must be configured separately from IP (IPv4) filter policy. The configuration mimics IP Filter policy configuration. Please see Creating an IPv4 Filter Policy.
Configuring and applying filter policies is optional. Each filter policy must have the following:
The following example displays a MAC filter policy configuration:
The following example displays an ISID filter configuration:
The following example displays a VID filter configuration:
Within a filter policy, configure filter entries which contain criteria against which ingress, egress, or network traffic is matched. The action specified in the entry determine how the packets are handled, such as dropping or forwarding.
The following displays a MAC filter entry configuration example:
IP filter policies support usage of match lists as a single match criteria. To create a match list you must:
Optionally a description can also be defined.
The following example displays an IPv4 address prefix list configuration and its usage in an IPv4 filter policy:
Filter policies can be associated with the following entities:
IP Filter Policies | MAC Filter Policies |
Epipe SAP, spoke SDP | Epipe SAP, spoke SDP |
Fpipe SAP, spoke SDP | N/A |
IES interface SAP | N/A |
Ipipe SAP, spoke SDP | N/A |
VPLS mesh SDP, spoke SDP, SAP | VPLS mesh SDP, spoke SDP, SAP |
VPRN interface SAP, spoke SDP | N/A |
IP and MAC filter policies are applied by associating them with a SAP and/or spoke-sdp in ingress and/or egress direction as desired. Filter ID is used to associate an existing filter policy, or if defined, a Filter Name for that Filter ID policy can be used in the CLI.
The following output displays IP and MAC filters assigned to an ingress and egress SAP and spoke SDP:
The following output displays an IPv6 filters assigned to an IES service interface:
IP filter policies can be applied to network IP (v4/v6) interfaces. MAC filters cannot be applied to network IP interfaces or to routable IES services. Similarly to applying filter policies to service, IP (v4/v6) filter policies are applied to network interfaces by associating a policy with ingress and/or egress direction as desired. Filter ID is used to associate an existing filter policy, or if defined, a Filter Name for that Filter ID policy can be used in the CLI.
The following displays an IP filter applied to an interface at ingress.
The following displays IPv4 and IPv6 filters applied to an interface at ingress and egress.
Configuring and applying redirect policies is optional. Each redirect policy must have the following:
The following displays a redirection policy configuration:
This section discusses the following filter policy management tasks:
The system exits the matching process when the first match is found and then executes the actions in accordance with the specified action. Because the ordering of entries is important, the numbering sequence may need to be rearranged. Entries should be numbered from the most explicit to the least explicit.
The following example illustrates renumbering of filter entries.
The following displays the original filter entry order, followed by the reordered filter entries:
There are several ways to modify an existing filter policy. A filter policy can be modified dynamically as part of subscriber management dynamic insertion/removal of filter policy entries (see the Triple Play Guide for details). A filter policy can be modified indirectly by configuration change to a match list the filter policy uses (as described earlier in this guide). In addition, a filter policy can be directly edited as described below.
To access a specific IP (v4/v6), or MAC filter, you must specify the filter ID, or if defined, filter name. Use the no form of the command to remove the command parameters or return the parameter to the default setting.
The following output displays the modified IP filter output:
Before you can delete a filter, you must remove the filter association from all the applied ingress and egress SAPs and network interfaces by executing no filter command in all context where the filter is used.
After you have removed the filter from the SAPs network interfaces, you can delete the filter as shown in the following example.
To access a specific redirect policy, you must specify the policy name. Use the no form of the command to remove the command parameters or return the parameter to the default setting.
Before you can delete a redirect policy from the filter configuration, you must remove the policy association from the IP filter.
The following example shows the command usage to replace the configured redirect policy (redirect1) with a different redirect policy (redirect2) and then removing the redirect1 policy from the filter configuration.
When changes are to be made to an existing filter policy applied to a one or more SAPs/network interfaces, it is recommended to first copy the applied filter policy, then modify the copy and then overwrite the applied policy with the modified copy. This ensures that a policy being modified is not applied when partial changes are done as any filter policy edits are applied immediately to all services where the policy is applied.
New filter policies can also be created by copying an existing policy and renaming the new filter.
The following displays the command usage to copy an existing IP filter (11) to create a new filter policy (12) that can then be edited. And once edits are completed, it can be used to overwrite existing policy (11).