The description command associates a text string with a configuration context to help identify the context in the configuration file.
The no form of the command removes any description string from the context.
The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all SAPs or network ports where it is applied.
no ipv6-filter ipv6-filter-id
The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all SAPs or network ports where it is applied.
Any changes made to the existing policy, using any of the sub-commands, will be applied immediately to all services where this policy is applied. For this reason, when many changes are required on a mac-filter policy, it is recommended that the policy be copied to a work area. That work-in-progress policy can be modified until complete and then written over the original filter policy. Use the config filter copy command to maintain policies in this manner.
The no form of the command deletes the mac-filter policy. A filter policy cannot be deleted until it is removed from all SAP where it is applied.
[no
] redirect-policy
redirect-policy-name
The no form of the command removes the redirect policy from the filter configuration only if the policy is not referenced in an IP filter and the IP filter is not in use (applied to a service or network interface).
The no form of the command deletes the filter log ID. The log cannot be deleted if there are filter entries configured to write to the log. All filter entry logging associations need to be removed before the log can be deleted.
The no form of the command reverts to the default wherein the host creation proceeds as normal
option dhcp-option-number {present
| absent
}
option dhcp-option-number match
hex
hex-string [exact
] [invert-match
]
option dhcp-option-number match
string
ascii-string [exact
] [invert-match
]
The no form of the command reverts to the default.
Filter logs can be sent to either memory (memory) or to an existing Syslog server definition (
server).
If the filter log destination is memory, the maximum number of entries in the log must be specified.
The no form of the command deletes the filter log association.
The shutdown command administratively downs an entity. Administratively downing an entity changes the operational state of the entity to down and the operational state of any entities contained within the administratively down entity.
The no form of the command puts an entity into the administratively enabled state.
The no form of the command reverts to the default parameter.
Specifying wrap-around configures the memory filter log to store the most recent filter log entries (circular buffer). When the log is full, the oldest filter log entries are overwritten with new entries.
The no form of the command configures the memory filter log to accept filter log entries until full. When the memory filter log is full, filter logging for the log filter ID ceases.
When multiple default-action commands are entered, the last command will overwrite the previous command.
embed-filter filter-id [offset
offset] [{active
| inactive
}]
active |
inactive keywords:
active – an embedded filter entries are to be included in this embedding filter policy and activated on applicable line cards – default if no keyword is specified and omitted in info command (but not info detail), or when saving configuration
inactive – an embedded filter policy entries are to be included in this embedded filter policy but are not downloaded to line cards – i.e. remain inactive. Always shown as part of info command or when saved to a configuration file.
The no form of this command removes the embedded filter policy from this filter policy.
scope {exclusive
| template
| embedded
}
The no form of the command sets the scope of the policy to the default of
template.
The no form of the command reverts to the default.
The no form of the command reverts to the default.
The no form of the command reverts to the default.
|
Values
|
normal — Regular match criteria are allowed; ISID or VID filter match criteria not allowed.
isid — Only ISID match criteria are allowed.
vid — On.y VID match criteria are allowed on ethernet_II frame types.
|
entry entry-id [time-range
time-range-name] [create
]
This command creates or edits an IP (v4), IPv6, or MAC filter entry. Multiple entries can be created using unique entry-id numbers within the filter. Entries must be sequenced from most to least explicit.
An entry may not have any match criteria defined (in which case, everything matches) but must have at least the keyword action for it to be considered complete. Entries without the
action keyword will be considered incomplete and hence will be rendered inactive.
The no form of the command removes the specified entry from the filter. Entries removed from the filter are immidately removed from all services or network ports where that filter is applied.
The no form of the command disables logging for the filter entry.
IP (v4/v6) Filter Entry Commands
action forward [next-hop
{ip-address | indirect
ip-address | interface
ip-int-name}]
This command specifies the action to take for packets that match this filter entry. The action command must be entered with a keyword specified in order for the entry to be active.
Note that action forward next-hop cannot be applied to multicast traffic.
The no form of the command removes the specified
action statement. The filter entry is considered incomplete and hence rendered inactive without the
action keyword.
Specifies the HTTP web address that will be sent to the user’s browser. Note that http-redirect is not supported on 7750 SR-1 or 7450 ESS-1 models.
This command specifies the action to take for packets that match this filter entry. The action keyword must be entered and a keyword specified in order for the entry to be active.
The no form of the command removes the specified action statement. The filter entry is considered incomplete and hence rendered inactive without the action keyword.
Specifies the HTTP web address that will be sent to the user’s browser. Note that http-redirect is not supported on 7750 SR-1 or 7450 ESS-1 models.
If the cflowd is either not enabled or set to cflowd interface mode, this command is ignored.
The no form removes this command for the system configuration, disallowing the sampling of packets if the ingress interface is in cflowd acl mode.
[no] interface-disable-sample
This command specifies that traffic matching the associated IP filter entry is not sampled if the IP interface is set to cflowd interface mode. This allows the option to not sample specific types of traffic when interface sampling is enabled.
The no form of this command enables sampling.
match [protocol
protocol-id]
A match context may consist of multiple match criteria, but multiple
match statements cannot be entered per entry.
The no form of the command removes the match criteria for the
entry-id.
The protocol keyword configures an IP protocol to be used as an IP filter match criterion. The protocol type such as TCP or UDP is identified by its respective protocol number.
|
Values
|
0 — 255 (values can be expressed in decimal, hexidecimal, or binary - DHB)
keywords: none, crtp, crudp, egp, eigrp, encap, ether-ip, gre, icmp, idrp, igmp, igp, ip, ipv6, ipv6-frag, ipv6-icmp, ipv6-no-nxt, ipv6-opts, ipv6-route, isis, iso-ip, l2tp, ospf-igp, pim, pnni, ptp, rdp, rsvp, stp, tcp, udp, vrrp
* — udp/tcp wildcard
|
match [next-header next-header]
A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.
The no form of the command removes the match criteria for the entry-id.
|
Values
|
[0 — 42 | 45 — 49 | 52 — 59 | 61— 255] — protocol numbers accepted in decimal, hexidecimal, or binary - DHB
keywords: none, crtp, crudp, egp, eigrp, encap, ether-ip, gre, icmp, idrp, igmp, igp, ip, ipv6, ipv6-icmp, ipv6-no-nxt, isis, iso-ip, l2tp, ospf-igp, pim, pnni, ptp, rdp, rsvp, stp, tcp, udp, vrrp
* — udp/tcp wildcard
|
The no form of the command removes the DSCP match criterion.
|
Values
|
be, cp1, cp2, cp3, cp4, cp5, cp6, cp7, cs1, cp9, af11, cp11, af12, cp13, af13, cp15, cs2, cp17, af21, cp19, af22, cp21, af23, cp23
|
dst-ip {ip-address[/
mask]} [netmask | ip-prefix-list prefix-list-name]
The no form of the command removes the destination IP address match criterion.
dst-ip [ipv6-address/prefix-length|ipv6-prefix-list/ipv6-prefix-list-name]
The no form of the command removes the destination IP address match criterion.
The no form of the command removes the destination port match criterion.
lt specifies all port numbers less than
dst-port-number match.
gt specifies all port numbers greater than
dst-port-number match.
eq specifies that
dst-port-number must be an exact match.
fragment {true
|false
|first-only
|non-first-only
}
The no form of the command removes the match criterion.
Specifies to match on all non-fragmented IP packets. Non-fragmented IP packets are packets that have the MF bit set to zero and have the Fragment Offset field also set to zero. For IPv6, packet matches if it does not contain IPv6 Fragmentation Extension Header.
The no form of this command ignores AH Extension Header presence/absence in a packet when evaluating match criteria of a given filter policy entry.
The no form of this command ignores ESP Extension Header presence/absence in a packet when evaluating match criteria of a given filter policy entry.
The no form of this command ignores Hop-by-Hop Options Extension Header presence/absence in a packet when evaluating match criteria of a given filter policy entry.
Configures matching on ICMP/ICMPv6 code field in the ICMP/ICMPv6 header of an IP
or IPv6 packet as a filter match criterion. Note that an entry containing Layer 4 match criteria will not match non-initial (2nd, 3rd, etc) fragments of a fragmented packet since only the first fragment contains the Layer 4 information.
The no form of the command removes the criterion from the match entry.
The ICMP/ICMPv6 code values that must be present to match.
This command configures matching on the ICMP/ICMPv6 type field in the ICMP/ICMPv6 header of an IP or
IPv6 packet as a filter match criterion. Note that an entry containing Layer 4 match criteria will not match non-initial (2nd, 3rd, etc) fragments of a fragmented packet since only the first fragment contains the Layer 4 information.
The no form of the command removes the criterion from the match entry.
The ICMP/ICMPv6 type values that must be present to match.
The no form of the command removes the match criterion.
The no form of the command removes the checking of the number of option fields in the IP header as a match criterion.
The no form of the command removes the checking of the option field in the IP header as a match criterion.
The no form of this command ignores Routing Type Extension Header type 0 presence/absence in a packet when evaluating match criteria of a given filter policy entry.
src-ip {ip-address[/
mask]} [netmask | ip-prefix-list prefix-list-name]
The no form of the command removes the source IP address match criterion.
src-ip [ipv6-address/prefix-length|ipv6-prefix-list/ipv6-prefix-list-name]
The no form of the command removes the source IPv6 address match criterion.
This command configures a source TCP or UDP port number or port range for an IP filter match criterion. Note that an entry containing Layer 4 match criteria will not match non-initial (2nd, 3rd, etc) fragments of a fragmented packet since only the first fragment contains the Layer 4 information.
The no form of the command removes the source port match criterion.
lt specifies all port numbers less than src-port-number match.
gt specifies all port numbers greater than src-port-number match.
eq specifies that src-port-number must be an exact match.
The no form of the command removes the criterion from the match entry.
The no form of the command removes the criterion from the match entry.
The no form of this command deletes the specified list.
An ip-prefix-list must contain only IPv4 address prefixes.
prefix ip-prefix/prefix-length
The no form of this command deletes the specified prefix from the list.
The no form of this command removes all auto-generation configuration under the apply-path context.
bgp-peers index group
reg-exp neighbor
reg-exp
The no form of this command removes the bgp-peers configuration for auto-generation of address prefixes for the specified index value.
The no form of this command deletes the specified list.
An ipv6-prefix-list must contain only IPv6 address prefixes.
The no form of this command deletes the specified list.
prefix ipv6-prefix/prefix-length
The no form of this command deletes the specified prefix from the list.
This command configures the action for a MAC filter entry. The action keyword must be entered for the entry to be active. Any filter entry without the action keyword will be considered incomplete and will be inactive.
The no form of the command removes the specified action statement. The filter entry is considered incomplete and hence rendered inactive without the action keyword.
match [frame-type 802dot3 | 802dot2-llc | 802dot2-snap | ethernet_II]
This command creates the context for entering/editing match criteria for the filter entry and specifies an Ethernet frame type for the entry. When the match criteria have been satisfied the action associated with the match criteria is executed.
A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.
The no form of the command removes the match criteria for the entry-id.
The frame-type keyword configures an Ethernet frame type to be used for the MAC filter match criteria.
The no form of the command removes the criterion from the match entry.
Egress dot1p value matching will only match if the customer payload contains the 802.1p bits. For example, if a packet ingresses on a null encapsulated SAP and the customer packet is IEEE 802.1Q or 802.1p tagged, the 802.1p bits will be present for a match evaluation. On the other hand, if a customer tagged frame is received on a dot1p encapsulated SAP, the tag will be stripped on ingress and there will be no 802.1p bits for a MAC filter match evaluation; in this case, any filter entry with a dot1p match criterion specified will fail.
Use the no form of the command to remove the dsap value as the match criterion.
The no form of the command removes the destination mac address as the match criterion.
The Ethernet type field is used by the Ethernet version-II frames. IEEE 802.3 Ethernet frames do not use the type field. For IEEE 802.3 frames, use the dsap, ssap or snap-pid fields as match criteria.
The no form of the command removes the previously entered etype field as the match criteria.
isid value [to
higher-value]
The no form of this command removes the ISID match criterion.
The optional vid_mask is defaulted to 4095 (exact match) but may be specified to allow pattern matching. The masking operation is ((value & vid-mask) = = (tag & vid-mask)). A value of 6 and a mask of 7 would match all VIDs with the lower 3 bits set to 6.
The no form of the command removes the criterion from the match criteria.
The no form of the command removes the snap-pid value as the match criteria.
src-mac ieee-address [ieee-address-mask]
The no form of the command removes the source mac as the match criteria.
ssap ssap-value [ssap-mask]
The no form of the command removes the ssap match criterion.
copy ip-filter
src-filter-id [src-entry src-entry-id] to dst-filter-id [dst-entry dst-entry-id] [overwrite]
copy ipv6-filter src-filter-id [src-entry
src-entry-id] to
dst-filter-id [dst-entry dst-entry-id] [overwrite
]
copy mac-filter src-filter-id [src-entry
src-entry-id] to
dst-filter-id [dst-entry dst-entry-id] [overwrite
]
This command copies existing filter list entries for a specific filter ID to another filter ID. The copy command is a configuration level maintenance tool used to create new filters using existing filters. It also allows bulk modifications to an existing policy with the use of the
overwrite keyword.
If
overwrite is not specified, an error will occur if the destination policy ID exists.
This keyword indicates that the source-filter-id and the
dest-filter-id are IPv6 filter IDs.
The source-filter-id identifies the source filter policy from which the copy command will attempt to copy. The filter policy must exist within the context of the preceding keyword (
ip-filter, ipv6-filter or
mac-filter).
The dest-filter-id identifies the destination filter policy to which the copy command will attempt to copy. If the
overwrite keyword does not follow, the filter policy ID cannot already exist within the system for the filter type the copy command is issued for. If the
overwrite keyword is present, the destination policy ID may or may not exist.
The overwrite keyword specifies that the destination filter ID may exist. If it does, everything in the existing destination filter ID will be completely overwritten with the contents of the source filter ID. If the destination filter ID exists, either
overwrite must be specified or an error message will be returned. If
overwrite is specified, the function of copying from source to destination occurs in a ‘break before make’ manner and therefore should be handled with care.
renum old-entry-id new-entry-id
This command renumbers existing MAC or IP filter entries to properly sequence filter entries.
This may be required in some cases since the OS exits when the first match is found and executes the actions according to the accompanying action command. This requires that entries be sequenced correctly from most to least explicit.
[no
] destination
ip-address
drop-count consecutive-failures [hold-down
seconds]
Redirect policies can contain multiple destinations. Each destination is assigned an initial or base priority which describes its relative importance within the policy. If more than one destination is specified, the destination with the highest effective priority value is selected.
oid oid-string community
community-string
return-value return-value type
return-type [disable
| lower-priority
priority | raise-priority
priority]
return-code return-code-1 [return-code-2] [disable
| lower-priority
priority | raise-priority
priority]
url url-string [http-version
version-string]
