Filter Command Reference

Command Hierarchies

•	DHCP Filter Policy Commands

•	Match Filter List Commands

•	IP Filter Policy Commands

•	IPv6 Filter Policy Commands

•	System Filter Policy Commands

•	Log Filter Commands

•	MAC Filter Commands

•	Redirect Policy Configuration Commands

•	Copy Filter Commands

•	Show Commands

•	Clear Commands

•	Monitor Commands

•	Debug Commands

 

Configuration Commands

DHCP Filter Policy Commands

config

—

filter

—	dhcp-filter filter-id [create]

—	no dhcp-filter filter-id

—	description description-string

—	no description

—	entry entry-id [create]

—	no entry entry-id

—	action {bypass-host-creation}

—	action drop

—

no action

—	option dhcp-option-number {present | absent}

—	option dhcp-option-number match hex hex-string [exact] [invert-match]

—	option dhcp-option-number match string ascii-string [exact] [invert-match]

—

no option

 

IP Filter Policy Commands

config

—

filter

—	ip-filter filter-id [create]

—	ip-filter {filter-id | filter-name}

—	no ip-filter filter-id

—	chain-to-system-filter

—	no chain-to-system-filter

—	default-action {drop | forward}

—	description description-string

—	no description

—	embed-filter filter-id [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name [{system | service {service-id | service-name} | sap sap-id}] [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name system [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name service {service-id | service-name} [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name sap sap-id}] [offset offset ] [{active | inactive}]

—	no embed-filter filter-id

—	no embed-filter open-flow ofs-name service {service-id | service-name}

—	no embed-filter open-flow ofs-name sap sap-id

—	no embed-filter open-flow ofs-name system

—	no embed-filter open-flow ofs-name [{system | service {service-id | service-name} | sap sap-id}]

—	entry entry-id [time-range time-range-name] [create]

—	no entry entry-id

—	action (IPv4)

—	no action (IPv4)

—

drop

—	drop packet-length {{lt | eq | gt} packet-length-value | range packet-length-value packet-length-value}

—	drop [ttl {{lt | gt | eq} ttl-value | range ttl-value ttl-value}]

—

forward

—	forward esi esi sf-ip ip-address vas-interface interface-name router {router-instance | service-name service-name}

—	forward esi esi service-id vpls-service-id

—	forward lsp lsp-name

—	forward next-hop [indirect] ip-address

—	forward next-hop [indirect] ip-address router {router-instance | service-name service-name}

—	forward next-hop interface ip-int-name

—	forward redirect-policy policy-name

—	forward router {router-instance | service-name service-name}

—	forward sap sap-id

—	forward sdp sdp-id:vc-id

—	gtp-local-breakout

—	http-redirect rdr-url-string [allow-radius-override]

—	nat [nat-policy nat-policy-name]

—	reassemble

—	description description-string

—	no description

—	egress-pbr {default-load-balancing | l4-load-balancing}

—	no egress-pbr

—	[no] filter-sample

—	[no] interface-disable-sample

—	log log-id

—

no log

—	match [protocol protocol-id]

—

no match

—	dscp dscp-name

—

no dscp

—	dst-ip {ip-address/mask | ip-address ipv4-address-mask | ip-prefix-list prefix-list-name}

—

no dst-ip

—	dst-port {lt | gt | eq} dst-port-number

—	dst-port port-list-name

—	dst-port range dst-port-number dst-port-number

—	no dst-port

—	fragment {true|false|first-only|non-first-only}

—	no fragment

—	icmp-code icmp-code

—	no icmp-code

—	icmp-type icmp-type

—	no icmp-type

—	ip-option ip-option-value [ip-option-mask]

—	no ip-option

—	multiple-option {true | false}

—	no multiple-option

—	option-present {true | false}

—	no option-present

—	port {lt|gt|eq} port-number

—	port port-list port-list-name

—	port range port-number port-number

—

no port

—	src-ip{ip-address/mask | ip-address ipv4-address-mask | ip-prefix-list prefix-list-name}

—

no src-ip

—	src-port {{lt | gt | eq} src-port-number}

—	src-port port-list port-list-name

—	src-port range src-port-number src-port-number

—	no src-port

—	src-route-option {true|false}

—	no src-route-option

—	tcp-ack {true | false}

—	no tcp-ack

—	tcp-syn {true | false}

—	no tcp-syn

—	pbr-down-action-override {drop | forward | filter-default-action}

—	no pbr-down-action-override

—	filter-name filter-name

—	no filter-name

—	renum old-entry-id new-entry-id

—	scope {exclusive | template | embedded | system}

—

no scope

—	shared-radius-filter-wmark low low-watermark high high-watermark

—	no shared-radius-filter-wmark

—	sub-insert-credit-control start-entry entry-id count count

—	no sub-insert-credit-control

—	sub-insert-radius start-entry entry-id count count

—	no sub-insert-radius

—	sub-insert-shared-pccrule start-entry entry-id count count

—	no sub-insert-shared-pccrule

—	sub-insert-shared-radius start-entry entry-id count count

—	no sub-insert-shared-radius

—	sub-insert-wmark low low-watermark high high-watermark

—	no sub-insert-wmark

IPv6 Filter Policy Commands

 

— IPv6 Filter Policy Commands

config

—

filter

—	ipv6-filter filter-id [create]

—	ipv6-filter {filter-id | filter-name}

—	no ipv6-filter filter-id

—	chain-to-system-filter

—	no chain-to-system-filter

—	default-action {drop | forward}

—	description description-string

—	no description

—	embed-filter filter-id [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name [{system | service {service-id | service-name} | sap sap-id}] [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name system [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name service {service-id | service-name} [offset offset ] [{active | inactive}]

—	embed-filter open-flow ofs-name sap sap-id}] [offset offset ] [{active | inactive}]

—	no embed-filter filter-id

—	no embed-filter open-flow ofs-name service {service-id | service-name}

—	no embed-filter open-flow ofs-name sap sap-id

—	no embed-filter open-flow ofs-name system

—	no embed-filter open-flow ofs-name [{system | service {service-id | service-name} | sap sap-id}]

—	entry entry-id [time-range time-range-name] [create]

—	no entry entry-id

—	action(IPv6)

—	no action(IPv6)

—

drop

—	drop packet-length {{lt | eq | gt} packet-length-value | range packet-length-value packet-length-value}

—

forward

—	forward next-hop [indirect] ipv6-address

—	forward next-hop [indirect] ipv6-address router {router-instance | service-name service-name}

—	forward redirect-policy policy-name

—	forward router{router-instance service-name service-name}

—	forward sap sap-id

—	forward sdp sdp-id:vc-id

—	http-redirect rdr-url-string [allow-radius-override]

—	nat [nat-policy nat-policy-name] nat-type nat-type

—	description description-string

—	no description

—	[no] filter-sample

—	[no] interface-disable-sample

—	log log-id

—

no log

—	match [next-header next-header]

—

no match

—	ah-ext-hdr {true | false }

—	no ah-ext-hdr

—	dscp dscp-name

—

no dscp

—	dst-ip {ipv6-address/prefix-length | ipv6-address ipv6-address-mask | ipv6-prefix-list prefix-list-name}

—

no dst-ip

—	dst-port {lt | gt | eq} dst-port-number

—	dst-port port-list port-list-name

—	dst-port range dst-port-number dst-port-number

—	no dst-port

—	esp-ext-hdr {true | false }

—	no esp-ext-hdr

—	flow-label flow-label [mask]

—	no flow-label

—	fragment {true|false|first-only|non-first-only}

—	no fragment

—	hop-by-hop-opt {true|false}

—	no hop-by-hop-opt

—	icmp-code icmp-code

—	no icmp-code

—	icmp-type icmp-type

—	no icmp-type

—	port {lt|gt|eq} port-number

—	port port-list port-list-name

—	port range port-number port-number

—

no port

—	routing-type0 {true|false}

—	no routing-type0

—	src-ip{ipv6-address/prefix-length | ipv6-address ipv6-address-mask | ipv6-prefix-list prefix-list-name}

—

no src-ip

—	src-port {lt | gt | eq} src-port-number}

—	src-port port-list port-list-name

—	src-port range src-port-number src-port-number

—	no src-port

—	tcp-ack {true | false}

—	no tcp-ack

—	tcp-syn {true | false}

—	no tcp-syn

—	filter-name filter-name

—	no filter-name

—	renum old-entry-id new-entry-id

—	scope {exclusive | template | embedded | system}

—

no scope

—	shared-radius-filter-wmark low low-watermark high high-watermark

—	no shared-radius-filter-wmark

—	sub-insert-credit-control start-entry entry-id count count

—	no sub-insert-credit-control

—	sub-insert-radius start-entry entry-id count count

—	no sub-insert-radius

—	sub-insert-shared-pccrule start-entry entry-id count count

—	no sub-insert-shared-pccrule

—	sub-insert-shared-radius start-entry entry-id count count

—	no sub-insert-shared-radius

—	sub-insert-wmark low low-watermark high high-watermark

—	no sub-insert-wmark

System Filter Policy Commands

config

—

filter

—	system-filter

—	ip filter-id

—	no ip filter-id

—	ipv6 filter-id

—	no ipv6 filter-id

 

Log Filter Commands

config

—

filter

—	log log-id [create]

—	no log log-id

—	description description-string

—	no description

—	destination memory num-entries | syslog syslog-id

—	no destination

—	[no] shutdown

—

summary

—	[no] shutdown

—	summary-crit dst-addr

—	summary-crit src-addr

—	no summary-crit

—	[no] wrap-around

MAC Filter Commands

config

—

filter

—	mac-filter filter-id [create]

—	mac-filter {filter-id | filter-name}

—	no mac-filter filter-id

—	default-action {drop | forward}

—	description description-string

—	no description

—	entry entry-id [time-range time-range-name]

—	no entry entry-id [create]

—

action

—

no action

—

drop

—	forward esi eso service-id vpls-service-id

—	forward sap sap-id

—	forward sdp sdp-id:vc-id

—	http-redirect url

—	description description-string

—	no description

—	log log-id

—

no log

—	match [frame-type {802dot3 | 802dot2-llc | 802dot2-snap | ethernet_II}]

—

no match

—	dot1p dot1p-value [dot1p-mask]

—

no dot1p

—	dsap dsap-value [dsap-mask]

—

no dsap

—	dst-mac ieee-address [ieee-address-mask]

—	no dst-mac

—	etype 0x0600..0xffff

—

no etype

—	inner-tag value [vid-mask]

—	no inner-tag

—	isid value [to higher-value]

—

no isid

—	outer-tag value [vid-mask]

—	no outer-tag

—	snap-oui {zero | non-zero}

—	no snap-oui

—	snap-pid snap-pid

—	no snap-pid

—	ssap ssap-value [ssap-mask]

—

no ssap

—	src-mac ieee-address [ieee-address-mask]

—	no src-mac

—	pbr-down-action-override {drop | forward | filter-default-action}

—	no pbr-down-action-override

—	renum old-entry-id new-entry-id

—	scope {exclusive | template}

—

no scope

—	type filter-type

 

Match Filter List Commands

config

—

filter

—	match-list

—	ip-prefix-list ip-prefix-list-name [create]

—	no ip-prefix-list ip-prefix-list-name

—	[no] apply-path

—	bgp-peers index group reg-exp neighbor reg-exp

—	no bgp-peers index

—	description description-string

—	no description

—	[no] prefix ip-prefix/prefix-length

—	ipv6-prefix-list ipv6-prefix-list-name [create]

—	no ipv6-prefix-list ipv6-prefix-list-name

—	[no] apply-path

—	bgp-peers index group reg-exp neighbor reg-exp

—	no bgp-peers index

—	description description-string

—	no description

—	[no] prefix ipv6-prefix/prefix-length

—	port-list port-list-name create

—	no port-list port-list-name

—	description description-string

—	no description

—	[no] port port number

—	[no] port range start end

—

no port

 

 

Redirect Policy Configuration Commands

config

—

filter

— Redirect policy commands

—	redirect-policy redirect-policy-name [create]

—	no redirect-policy redirect-policy-name

—	description description-string

—	no description

—	destination ip-address [create]

—	no destination ip-address

—	destination ipv6-address [create]

—	no destination ipv6-address

—	description description-string

—	no description

—	[no] ping-test

—	drop-count consecutive-failures [hold-down seconds]

—	no drop-count

—	interval seconds

—	no interval

—	timeout seconds

—	no timeout

—	priority [priority]

—	no priority

—	router router-instance

—	router service-name service-name

—

no router

—	[no] shutdown

—	snmp-test test-name [create]

—	no snmp-test test-name

—	drop-count consecutive-failures [hold-down seconds]

—	no drop-count

—	interval seconds

—	no interval

—	oid oid-string community community-string

—

no oid

—	return-value return-value type return-type [disable | lower-priority priority | raise-priority priority]

—	no return-value return-value type return-type

—	timeout seconds

—	no timeout

—	sticky-dest {hold-time-up seconds | no-hold-time-up}

—	no sticky-dest

—	[no] unicast-rt-test

—	url-test test-name [create]

—	no url-test test-name

—	drop-count consecutive-failures [hold-down seconds]

—	no drop-count

—	interval seconds

—	no interval

—	return-code return-code-1 [return-code-2] [disable | lower-priority priority | raise-priority priority]

—	no return-code return-code-1 [return-code-2]

—	timeout seconds

—	no timeout

—	url url-string [http-version version-string]

—

no url

—	[no] router [router-instance | service-name service-name]

—	[no] shutdown

Copy Filter Commands

config

—

filter

—	copy ip-filter src-filter-id [src-entry src-entry-id] to dst-filter-id [dst-entry dst-entry-id] [overwrite]

—	copy ipv6-filter src-filter-id [src-entry src-entry-id] to dst-filter-id [dst-entry dst-entry-id] [overwrite]

—	copy mac-filter src-filter-id [src-entry src-entry-id] to dst-filter-id [dst-entry dst-entry-id] [overwrite]

Show Commands

show

—

filter

—	dhcp [filter-id]

—	dhcp6 [filter-id]

—	download-failed

—	ip [filter-type filter-type]

—	ip embedded [inactive]

—	ip ip-filter-id embedded [inactive]

—	ip ip-filter-id [detail]

—	ip ip-filter-id associations

—	ip ip-filter-id type entry-type

—	ip ip-filter-id counters [type entry-type]

—	ip ip-filter-id entry entry-id counters

—	ip ip-filter-id entry entry-id [detail]

—	ipv6 [filter-type filter-type]

—	ipv6 embedded [inactive]

—	ipv6 ipv6-filter-id embedded [inactive]

—	ipv6 ipv6-filter-id [detail]

—	ipv6 ipv6-filter-id associations

—	ipv6 ipv6-filter-id type entry-type

—	ipv6 ipv6-filter-id counters [type entry-type]

—	ipv6 ipv6-filter-id entry entry-id counters

—	ipv6 ipv6-filter-id entry entry-id [detail]

—	log [bindings]

—	log log-id [match string]

—	mac {mac-filter-id [entry entry-id] [association | counters]}

—	match-list

—	ip-prefix-list [prefix-list-name]

—	ip-prefix-list prefix-list-name references

—	ipv6-prefix-list [prefix-list-name]

—	ipv6-prefix-list prefix-list-name references

—	port-list [port-list-name]

—	port-list port-list-name references

—	redirect-policy {redirect-policy-name [dest ip-address] [association]}

—	system-filter [chained-to]

Clear Commands

clear

—

filter

—	ip filter-id [entry entry-id] [ingress | egress]

—	ipv6 filter-id [entry entry-id] [ingress | egress]

—	log log-id

—	mac filter-id [entry entry-id] [ingress | egress]

Monitor Commands

monitor

—	filter ip ip-filter-id entry entry-id [interval seconds] [repeat repeat] [absolute | rate]

—	filter ipv6 ipv6-filter-id entry entry-id [interval seconds] [repeat repeat] [absolute | rate]

—	filter mac mac-filter-id entry entry-id [interval seconds] [repeat repeat] [absolute | rate]

Debug Commands

tools

—

dump

— Redirect policy commands

—

filter

—

resources

—

cpm

—	egress-pbr [detail]

—	ip <filter-id>

—

iom

—	ip <filter-id>

—	ipv6 <filter-id>

—	mac <filter-id>