Filter Policies

Syntax

description description-string

no description

Context

config>filter>ip-exception

config>filter>ip-exception>entry

config>filter>ip-filter

config>filter>log

config>filter>ip-filter>entry

config>filter>ipv6-filter

config>filter>ipv6-filter>entry

config>filter>mac-filter

config>filter>mac-filter>entry

config>filter>match-list>ip-prefix-list

config>filter>match-list>ipv6-prefix-list

config>filter>vlan-filter

config>filter>vlan-filter>entry

config>security>app-group

config>security>bypass

config>security>bypass>entry

config>security>host-group

config>security>logging>log

config>security>logging>profile

config>security>policer-group

config>security>policy

config>security>policy>entry

config>security>profile

Description

This command creates a text description for a configuration context to help identify the content in the configuration file.

The no form of the command removes any description string from the context.

Default

n/a

Parameters

description-string

the description character string. Allowed values are any string up to 80 characters long composed of printable, 7-bit ASCII characters. If the string contains special characters (such as #, $, or spaces), the entire string must be enclosed within double quotes.

Syntax

[no] shutdown

Context

config>filter>log

config>filter>log>summary

Description

The shutdown command administratively disables the entity. The operational state of the entity is disabled as well as the operational state of any entities contained within. When disabled, an entity does not change, reset, or remove any configuration settings or statistics. Many objects must be shut down before they may be deleted. Many entities must be explicitly enabled using the no shutdown command.

Unlike other commands and parameters where the default state is not indicated in the configuration file, shutdown and no shutdown are always indicated in system-generated configuration files.

The no form of the command puts an entity into the administratively enabled state.

Default

no shutdown

Syntax

log log-id [create]

no log log-id

Context

config>filter

Description

This command enables the context to create a filter log policy.

The no form of the command deletes the filter log ID. The log cannot be deleted if there are filter entries configured to write to the log. All filter entry logging associations need to be removed before the log can be deleted.

Default

log 101

Special Cases

Filter log 101

filter log 101 is the default log and is automatically created by the system. Filter log 101 is always a memory filter log and cannot be changed to a syslog filter log. The log size defaults to 1000 entries. The number of entries and wraparound behavior can be edited.

Parameters

log-id

the filter log ID destination expressed as a decimal integer

Values

101 to 199

Syntax

destination memory num-entries

destination syslog syslog-id

no destination

Context

config>filter>log

Description

This command configures the destination for filter log entries for the specified filter log ID.

Filter logs can be sent to either memory or an existing syslog server. If the filter log destination is memory, the maximum number of entries in the log must be specified.

The no form of the command deletes the filter log association.

Default

no destination

Parameters

num-entries

specifies that the destination of the filter log ID is a memory log. The num-entries value is the maximum number of entries in the filter log expressed as a decimal integer.

Values

1 to 50000

 syslog-id

specifies that the destination of the filter log ID is a syslog server. The syslog-id parameter is the identifier of the syslog server.

Values

1 to 10

Syntax

summary

Context

config>filter>log

Description

This command enables the context to configure log summarization. These settings apply only if syslog is the log destination.

Syntax

summary-crit dst-addr

summary-crit src-addr

no summary-crit

Context

config>filter>log>summary

Description

This command defines the key of the index of the mini-table. If key information is changed while summary is in the no shutdown state, the filter summary mini-table is flushed and reconfigured with different key information. Log packets received during the reconfiguration time will be handled as if summary was not active.

The no form of the command reverts to the default parameter.

Default

dst-addr

Parameters

dst-addr

specifies that received log packets are summarized based on the destination IP address

src-addr

specifies that received log packets are summarized based on the source IP address

Syntax

[no] wrap-around

Context

config>filter>log

Description

This command configures a memory filter log to store log entries until full or to store the most recent log entries (circular buffer).

Specifying wrap-around configures the memory filter log to store the most recent filter log entries (circular buffer). When the log is full, the oldest filter log entries are overwritten with new entries.

The no form of the command configures the memory filter log to accept filter log entries until full. When the memory filter log is full, filter logging for the log filter ID ceases.

Default

wrap-around

Syntax

ip-exception filter-id [create]

[no] ip-exception {filter-id | filter-name}

Context

config>filter

Description

This command creates a configuration context for an IPv4 exception filter policy. After creating an exception filter ID, you can optionally assign it to a unique name with the filter-name command. The exception filter name can be used instead of the ID for exception configuration commands, show commands, monitor commands, clear commands, and port and interface association commands.

IP exception filter policies specify matching criteria that allow a packet to be an exception to where it is applied. For more information, see the ip-exception command in Router Interface Commands.

The IP exception filter policy is a template that can be applied to multiple router interface group encryption contexts as long as the scope of the policy is configured as template.

Any changes made to the existing policy, using any subcommands, are applied immediately to all network interfaces where the policy is applied.

The no form of the command deletes the IP exception filter policy. An exception filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

Parameters

filter-id

the IP exception filter policy ID number

Values

1 to 65535

filter-name

the IP exception filter policy name, up to 64 characters in length. The name must already exist within the created IP exceptions.

create

keyword required when first creating the configuration context. When the context is created, you can navigate into the context without the create keyword.

Syntax

ip-filter filter-id [create]

ip-filter {filter-id | filter-name}

no ip-filter {filter-id | filter-name}

Context

config>filter

Description

This command creates a configuration context for an IPv4 filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and filter names support CLI auto-completion. For more information, see the 7705 SAR Basic System Configuration Guide, ‟Entering CLI Commands”.

IP filter policies specify either a forward or a drop action for packets based on the specified match criteria.

The IP filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple network ports as long as the scope of the policy is template.

Any changes made to the existing policy, using any of the subcommands, are applied immediately to all network interfaces where this policy is applied.

The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

Parameters

filter-id

the IP filter policy ID number

Values

1 to 65535

create

keyword required when first creating the configuration context. When the context is created, you can navigate into the context without the create keyword.

filter-name

the filter name, up to 64 characters in length

Syntax

ipv6-filter ipv6-filter-id [create]

ipv6-filter {ipv6-filter-id | filter-name}

no ipv6-filter {ipv6-filter-id | filter-name}

Context

config>filter

Description

This command creates a configuration context for an IPv6 filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and Filter names support CLI auto-completion. For more information, see the 7705 SAR Basic System Configuration Guide, ‟Entering CLI Commands”.

IP filter policies specify either a forward or a drop action for packets based on the specified match criteria.

The IP filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple network ports as long as the scope of the policy is template.

Any changes made to the existing policy, using any of the subcommands, are applied immediately to all network interfaces where this policy is applied.

The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

Parameters

ipv6-filter-id

the IPv6 filter policy ID number

Values

1 to 65535

create

keyword required when first creating the configuration context. When the context is created, you can navigate into the context without the create keyword.

filter-name

the filter name, up to 64 characters in length

Syntax

mac-filter filter-id [create]

mac-filter {filter-id | filter-name}

no mac-filter {filter-id | filter-name}

Context

config>filter

Description

This command enables the context for a MAC filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and filter names support CLI auto-completion. For more information, see the 7705 SAR Basic System Configuration Guide, ‟Entering CLI Commands”.

The MAC filter policy specifies either a forward or a drop action for packets based on the specified match criteria.

The MAC filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple services as long as the scope of the policy is template. It can also be used to refine port mirroring so that only the desired MAC addresses are mirrored.

A MAC filter policy can be applied to VPLS ingress and egress SAPs and ingress SDPs. MAC filter policies cannot be applied to a network interface, a VPRN service, or an IES service.

Any changes made to the existing policy, using any of the sub-commands, are applied immediately to all services where this policy is applied.

The no form of the command deletes the MAC filter policy. A filter policy cannot be deleted until it is removed from all SAPs or SDPs where it is applied.

Parameters

filter-id

the MAC filter policy ID number

Values

1 to 65535

create

keyword required when first creating the configuration context. When the context is created, you can navigate into the context without the create keyword.

filter-name

the filter name, up to 64 characters in length

Syntax

vlan-filter filter-id [create]

vlan-filter {filter-id | filter-name}

no vlan-filter {filter-id | filter-name}

Context

config>filter

Description

This command enables the context for a VLAN filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and Filter names support CLI auto-completion. For more information, see the 7705 SAR Basic System Configuration Guide, ‟Entering CLI Commands”.

The VLAN filter policy specifies either a forward or a drop action for packets based on the specified match criteria.

The VLAN filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to ring ports on the 2-port 10GigE (Ethernet) Adapter card and 2-port 10GigE (Ethernet) module. Each ring port can support one VLAN filter, and the same VLAN filter can be applied to both ring ports. The scope of a VLAN policy is always template.

A VLAN filter policy cannot be applied to any other type of adapter card.

Any changes made to an existing policy, using any of the sub-commands, is applied immediately to all ring ports where this policy is applied.

The no form of the command deletes the VLAN filter policy. A filter policy cannot be deleted until it is removed from all the ring ports where it is applied.

Parameters

filter-id

the VLAN filter policy ID number

Values

1 to 65535

create

keyword required when first creating the configuration context. When the context is created, you can navigate into the context without the create keyword.

filter-name

the filter name, up to 64 characters in length

Syntax

default-action {drop | forward}

Context

config>filter>ip-filter

config>filter>ipv6-filter

config>filter>mac-filter

config>filter>vlan-filter

Description

This command specifies the action to be applied to packets when the packets do not match the specified criteria in all of the IP, MAC, or VLAN filter entries of the filter.

Default

drop

Parameters

drop

specifies that all packets are dropped unless there is a specific filter entry that causes the packet to be forwarded

forward

specifies that all packets are forwarded unless there is a specific filter entry that causes the packet to be dropped

Syntax

filter-name filter-name

no filter-name

Context

config>filter>ip-filter

config>filter>ipv6-filter

config>filter>mac-filter

config>filter>vlan-filter

config>filter>ip-exception

Description

This command creates a unique name to associate with this filter. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port and interface association commands.

Parameters

filter-name

the filter name, up to 64 characters in length

Syntax

renum old-entry-id new-entry-id

Context

config>filter>ip-exception

config>filter>ip-filter

config>filter>ipv6-filter

config>filter>mac-filter

config>filter>vlan-filter

Description

This command renumbers existing IP, MAC, VLAN, or IP exception filter entries to properly sequence filter entries.

This may be required in some cases since the software exits when the first match is found and executes the actions according to the accompanying action command. This requires that entries be sequenced correctly from most to least explicit.

Parameters

old-entry-id

the entry number of an existing entry

Values

1 to 256 (ip-exception, ip-filter, ipv6-filter, mac-filter)

1 to 64 (vlan-filter)

new-entry-id

the new entry number to be assigned to the old entry

Values

1 to 256 (ip-exception, ip-filter, ipv6-filter, mac-filter)

1 to 64 (vlan-filter)

Syntax

scope {exclusive | template}

no scope

Context

config>filter>ip-exception

config>filter>ip-filter

config>filter>ipv6-filter

config>filter>mac-filter

Description

This command configures the filter policy scope as exclusive or template. If the scope of the policy is template and is applied to one or more network interfaces, the scope cannot be changed.

The no form of the command sets the scope of the policy to the default of template.

Default

template

Parameters

exclusive

when the scope of a policy is defined as exclusive, the policy can only be applied to a single entity (network port). If an attempt is made to assign the policy to a second entity, an error message results. If the policy is removed from the entity, it becomes available for assignment to another entity.

template

when the scope of a policy is defined as template, the policy can be applied to multiple network ports

Syntax

entry entry-id [create]

no entry entry-id

Context

config>filter>ip-exception

config>filter>ip-filter

config>filter>ipv6-filter

config>filter>mac-filter

config>filter>vlan-filter

Description

This command creates or edits a filter entry. Multiple entries can be created using unique entry-id numbers within the filter. The 7705 SAR implementation exits the filter on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly, from most to least explicit.

Filter entry IDs support CLI auto-completion. For more information, see the 7705 SAR Basic System Configuration Guide, ‟Entering CLI Commands”.

IPv4 and IPv6 filter entries can specify one or more matching criteria. However, in order to support the maximum 256 entries for IPv4 or IPv6 filters, any entry that uses source port (src-port) and/or destination port (dst-port) ranges (lt, gt, or range keywords) as match criteria must be within the first 64 entries. See the dst-port and src-port commands for more information.

For IPv6 filters, the combined number of fields for all entries in a filter must not exceed 16 fields (or 256 bits), where a field contains the bit representation of the matching criteria.

Some adapter cards have limitations on the size of ACLs that can be supported and therefore cannot support the maximum number of IPv6 filter entries. If you attempt to configure more entries than the card can support, the following error log event and SNMP trap are generated:

‟Class MDA Module : runtime event, details: Filter <filter id> ACL_STATUS_IPV6_ FILTER_ENTRIES_EXCEEDED Config Error!”

SNMPv2-MIB:snmpTrapOID.0 : (1.3.6.1.4.1.6527.6.1.2.3.2.1.0.13 (ALU-CHASSIS-MIB:aluEqMdaCriticalRuntimeError)) Syntax: ObjectID ALU-CHASSIS-MIB:aluChassisNotifyMdaRuntimeStatusContext.0 : (runtime event, details: Filter <filter id> ACL_STATUS_IPV6_FILTER_ENTRIES_EXCEEDED Config Error!) Syntax: SNMPv2-TC:DisplayString

where <filter id> is the filter policy ID

An entry may not have any match criteria defined (in which case, everything matches) but must have at least the keyword action for it to be considered complete. Entries without the action keyword are considered incomplete and are rendered inactive.

The no form of the command removes the specified entry from the filter. Entries removed from the filter are immediately removed from all entities to which that filter is applied.

Default

n/a

Parameters

entry-id

an entry-id uniquely identifies a match criteria and the corresponding action. It is recommended that multiple entries be given entry-ids in staggered increments. This allows users to insert a new entry in an existing policy without requiring renumbering of all the existing entries.

Values

1 to 256 (IP exception filters, IPv4 filters, IPv6 filters, and MAC filters)

1 to 64 (VLAN filters)

create

keyword required when first creating the configuration context. When the context is created, you can navigate into the context without the create keyword.

Syntax

action [drop]

action forward [next-hop {ip-address | indirect ip-address}] [fc fc-name [prioritylow| high]]

no action

Context

config>filter>ip-filter>entry

config>filter>mac-filter>entry

Description

This command specifies what action to take (drop or forward) when packets match the entry criteria. The action keyword must be entered for the entry to be active. If neither drop nor forward is specified, the filter action is drop.

The action forward next-hop keywords cannot be applied to multicast traffic and only apply to IPv4.

The action forward fc keywords only apply to IPv4.

Multiple action statements entered overwrite previous action statements when defined.

The no form of the command removes the specified action statement. The filter entry is considered incomplete and is rendered inactive without the action keyword.

Default

no action

Parameters

drop

specifies that packets matching the entry criteria are dropped

forward

specifies that packets matching the entry criteria are forwarded

next-hop ip-address

specifies the IPv4 address of the direct next hop to which packets matching the entry criteria are forwarded

indirect ip-address

specifies the IPv4 address of the indirect next hop to which packets matching the entry criteria are forwarded. The direct next-hop IPv4 address and egress IP interface are determined by a route table lookup.

If the next hop is not available, then a routing lookup is performed and if a match is found then the packet is forwarded to the result of that lookup. If no match is found, then an ‟ICMP destination unreachable” message is send back to the origin.

Values

0.0.0.0 to 255.255.255.255 (dotted-decimal notation)

fc fc-name

specifies the forwarding class (FC) to be used for queuing packets through the 7705 SAR. Each FC can be mapped to a different queue, or multiple FCs can be handled by the same queue.

There are eight forwarding classes, providing different classes of service. The forwarding classes are: nc (network control), h1 (high 1), ef (expedited forwarding), h2 (high 2), l1 (low 1), l2 (low 2), af (assured forwarding), be (best effort).

Values

be, l2, af, l1, h2, ef, h1, nc

priority low | high

specifies the priority assigned to incoming traffic. Traffic priority is important for internal processes when some traffic may be dropped because of congestion. Low-priority traffic is dropped first.

Syntax

action {drop | forward}

no action

Context

config>filter>ipv6-filter>entry

config>filter>vlan-filter>entry

Description

This command specifies what action to take (drop or forward) when packets match the entry criteria. The action keyword must be entered and for the entry to be active. If neither drop nor forward is specified, the filter action is drop.

Multiple action statements entered overwrite previous action statements when defined.

The no form of the command removes the specified action statement. The filter entry is considered incomplete and is rendered inactive without the action keyword.

Default

drop

Parameters

drop

specifies that packets matching the entry criteria are dropped

forward

specifies that packets matching the entry criteria are forwarded

Syntax

log log-id

no log

Context

config>filter>ip-filter>entry

config>filter>ipv6-filter>entry

config>filter>mac-filter>entry

Description

This command enables the context to enable filter logging for a filter entry and specifies the destination filter log ID.

The filter log ID must exist before a filter entry can be enabled to use the filter log ID.

The no form of the command disables logging for the filter entry.

Default

no log

Parameters

log-id

the filter log ID destination expressed as a decimal integer

Values

101 to 199

Syntax

match [protocol protocol-id]

no match

Context

config>filter>ip-filter>entry

config>filter>ip-exception>entry

Description

This command enables the context to enter match criteria for the IPv4 or IP exception filter entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

Parameters

protocol-id

protocol-number or protocol-name

protocol-number

the protocol number in decimal, hexadecimal, or binary, representing the IP protocol to be used as a filter match criterion. Common protocol numbers include ICMP(1), TCP(6), and UDP(17) (see IP Protocol IDs and Descriptions).

Values

[0 to 255]D

[0x0 to 0xFF]H

[0b0 to 0b11111111]B

protocol-name

configures the protocol name representing the IP protocol to be used as a filter match criterion

Values

IPv4 filter keywords: none, icmp, igmp, ip, tcp, egp, igp, udp,      rdp, ipv6, ipv6-route, ipv6-frag, idrp, rsvp, gre, ipv6-icmp, ipv6-     no-nxt, ipv6-opts, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni,      pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp, mpls-in-ip,      * - udp/tcp wildcard

IP exception filter keywords: none, icmp, igmp, tcp, udp, rsvp,      ospf-igp, pim, vrrp

Table 9. IP Protocol IDs and Descriptions

Protocol ID	Protocol	Description
1	icmp	Internet Control Message
2	igmp	Internet Group Management
4	ip	IP in IP (encapsulation)
6	tcp	Transmission Control
8	egp	Exterior Gateway Protocol
9	igp	Any private interior gateway
17	udp	User Datagram
27	rdp	Reliable Data Protocol
41	ipv6	IPv6
43	ipv6-route	Routing Header for IPv6
44	ipv6-frag	Fragment Header for IPv6
45	idrp	Inter-Domain Routing Protocol
46	rsvp	Reservation Protocol
47	gre	General Routing Encapsulation
58	ipv6-icmp	ICMP for IPv6
59	ipv6-no-nxt	No Next Header for IPv6
60	ipv6-opts	Destination Options for IPv6
80	iso-ip	ISO Internet Protocol
88	eigrp	EIGRP
89	ospf-igp	OSPFIGP
97	ether-ip	Ethernet-within-IP Encapsulation
98	encap	Encapsulation Header
102	pnni	PNNI over IP
103	pim	Protocol Independent Multicast
112	vrrp	Virtual Router Redundancy Protocol
115	l2tp	Layer Two Tunneling Protocol
118	stp	Schedule Transfer Protocol
123	ptp	Performance Transparency Protocol
124	isis	ISIS over IPv4
126	crtp	Combat Radio Transport Protocol
127	crudp	Combat Radio User Datagram
132	sctp	Stream Control Transmission Protocol
137	mpls-in-ip	MPLS in IP

Note:

• PTP in the context of IP or IP exception filters is defined as Performance Transparency Protocol. IP protocols can be used as IP or IP exception filter match criteria; the match is made on the 8-bit protocol field in the IP header.

• PTP in the context of SGT QoS is defined as Precision Timing Protocol and is an application in the 7705 SAR. The PTP application name is also used in areas such as event-control and logging. Precision Timing Protocol is defined in IEEE 1588-2008.

Syntax

match [next-header next-header]

no match

Context

config>filter>ipv6-filter>entry

Description

This command enables the context to enter match criteria for the IPv6 filter entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

Parameters

next-header

protocol-number or protocol-name

protocol-number

the protocol number in decimal, hexadecimal, or binary, representing the IP protocol to be used as the IPv6 next header filter match criterion This parameter is similar to the protocol parameter used in IPv4 filter match criteria. See IP Protocol IDs and Descriptions for a list of common protocol numbers.

Values

[1 to 42 | 45 to 49 | 52 to 59 | 61 to 255]D

[0x0 to 0x2A | 0x2D to 0x31 | 0x34 to 0x3B | 0x3D to 0xFF]H

[0b0 to 0b101010 | 0b101101 to 0b110001 | 0b110100 to 0b111011 | 0b111101 to 0b11111111]B

protocol-name

the protocol name to be used as the IPv6 next header filter match criterion. This parameter is similar to the protocol parameter used in IPv4 filter match criteria. See IP Protocol IDs and Descriptions for a list of common protocol numbers.

Values

none, icmp, igmp, ip, tcp, egp, igp, udp, rdp, ipv6, idrp, rsvp, gre, ipv6-icmp, ipv6-no-nxt, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni, pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp, mpls-in-ip, * - udp/tcp wildcard

Syntax

match frame-type {802dot3 | 802dot2-llc | 802dot2-snap | ethernet_II}

no match

Context

config>filter>mac-filter>entry

Description

This command enables the context for entering/editing match criteria for the filter entry and specifies an Ethernet frame type for the entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, then all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

Default

frame-type 802dot3

Parameters

frame-type

configures an Ethernet frame type to be used for the MAC filter match criteria

802dot3

specifies the frame type as Ethernet IEEE 802.3

802dot2-llc

specifies the frame type as Ethernet IEEE 802.2 LLC

802dot2-snap

specifies the frame type as Ethernet IEEE 802.2 SNAP

ethernet_II

specifies the frame type as Ethernet Type II

Syntax

match vlan {lt | gt | eq} vlan-id

match vlan range vlan-id to vlan-id

match untagged

no match

Context

config>filter>vlan-filter>entry

Description

This command accesses the match criteria for the filter entry and specifies a match criteria. If the match criteria are satisfied, the action associated with the match criteria is executed.

Only one match criterion (within one match statement) is allowed.

The no form of the command removes the match criteria for the entry-id.

Default

no match

Parameters

vlan {lt | gt | eq}vlan-id

specifies an operator and a vlan-id to be used for the VLAN filter match criteria (lt for less than, gt for greater than, and eq for equal to)

Values

1 to 4094

vlan range vlan-id to vlan-id

specifies a range of VLAN IDs to be used for the VLAN filter match criteria.

Values

1 to 4094

untagged

specifies that Ethernet frames with no tag or dot1q header (null encapsulation) are used for the VLAN filter match criteria

Syntax

dscp dscp-name

no dscp

Context

config>filter>ip-filter>entry>match

config>filter>ipv6-filter>entry>match

Description

This command configures a DiffServ Code Point (DSCP) name to be used as an IP filter match criterion.

The no form of the command removes the DSCP match criterion.

Default

no dscp

Parameters

dscp-name

 a DSCP name that has been previously mapped to a value using the dscp-name command. The DiffServ Code Point may only be specified by its name.

Values

be | cp1 | cp2 | cp3 | cp4 | cp5 | cp6 | cp7 | cs1 | cp9 | af11 | cp11 |

af12 | cp13 | af13 | cp15 | cs2 | cp17 | af21 | cp19 | af22 | cp21 |

af23 | cp23 | cs3 | cp25 | af31 | cp27 | af32 | cp29 | af33 | cp31 | cs4 |

cp33 | af41 | cp35 | af42 | cp37 | af43 | cp39 | cs5 | cp41 | cp42 |

cp43 | cp44 | cp45 | ef | cp47 | nc1 | cp49 | cp50 | cp51 | cp52 | cp53 |

cp54 | cp55 | nc2 | cp57 | cp58 | cp59 | cp60 | cp61 | cp62 | cp63

Syntax

dst-ip {ip-address/mask | ip-address ipv4-address-mask | ip-prefix-list prefix-list-name}

no dst-ip

Context

config>filter>ip-exception>entry>match

config>filter>ip-filter>entry>match

Description

This command configures a destination IPv4 address range or specifies an IP prefix list configured under the match-list ip-prefix-list command to be used as a match criterion for an IP filter or IP exception filter.

To match on the destination IP address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 can also be used.

The no form of the command removes the destination IP address or prefix list match criterion.

Default

n/a

Parameters

ip-address

the IP prefix for the IP match criterion in dotted-decimal notation

Values

0.0.0.0 to 255.255.255.255

mask

the subnet mask length expressed as a decimal integer

Values

1 to 32

ipv4-address-mask

any mask expressed in dotted-decimal notation

Values

0.0.0.0 to 255.255.255.255

prefix-list-name

the name of the IP prefix list configured under the match-list ip-prefix-list command

Syntax

dst-ip {ipv6-address/prefix-length | ipv6-address ipv6-address-mask | ipv6-prefix-list prefix-list-name}

no dst-ip

Context

config>filter>ipv6-filter>entry>match

Description

This command configures a destination IPv6 address range or specifies an IPv6 prefix list configured under the match-list ipv6-prefix-list command to be used as a match criterion for an IP filter.

To match on the destination IP address, specify the address and prefix length; for example, 11::12/128.

The no form of the command removes the destination IPv6 address or prefix list match criterion.

Default

n/a

Parameters

ipv6-address

the IPv6 address on the interface

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x:    [0 to FFFF]H

d:    [0 to 255]D

prefix-length

the prefix length associated with the IPv6 address

Values

0 to 128

ipv6-address-mask

the IPv6 address mask

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x:    [0 to FFFF]H

d:    [0 to 255]D

prefix-list-name

the name of the IPv6 prefix list configured with the match-list ipv6-prefix-list command

Syntax

dst-mac ieee-address

no dst-mac

Context

config>filter>mac-filter>entry>match

Description

This command configures a destination MAC address to be used as a MAC filter match criterion.

To match on the destination MAC address, specify the IEEE address.

The no form of the command removes the destination MAC address match criterion.

Default

no dst-mac

Parameters

ieee-address

the MAC address to be used as a match criterion

Values

xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx, where x is a hexadecimal digit

Syntax

dst-port {lt | gt | eq} dst-port-number

dst-port range dst-port-number dst-port-number

no dst-port

Context

config>filter>ip-exception>entry>match

config>filter>ip-filter>entry>match

config>filter>ipv6-filter>entry>match

Description

This command configures a destination TCP or UDP port number or port range for an IP filter or IP exception filter match criterion.

The no form of the command removes the destination port match criterion.

Default

n/a

Parameters

lt | gt | eq

use relative to dst-port-number for specifying the port number match criteria:

lt specifies that all port numbers less than dst-port-number match

gt specifies that all port numbers greater than dst-port-number match

eq specifies that dst-port-number must be an exact match

dst-port-number

the destination port number to be used as a match criteria expressed as a decimal integer

Values

1 to 65535

range

specifies an inclusive range of port numbers to be used as a match criteria. The first dst-port-number specifies the start of the range, and the second dst-port-number specifies the end of the range.

Syntax

etype 0x600...0xffff

no etype

Context

config>filter>mac-filter>entry>match

Description

This command configures an Ethernet type II Ethertype value to be used as a MAC filter match criterion.

The Ethernet type field is a 2-byte field used to identify the protocol carried by the Ethernet frame. For example, 0800 is used to identify IPv4 packets. The Ethernet type II frame Ethertype value to be used as a match criterion can be expressed as a hexadecimal (0x0600 to 0xFFFF) or a decimal (1536 to 65535) value.

The Ethernet type field is used by the Ethernet version-II frames.

The no form of the command removes the previously entered etype field as the match criteria.

Default

no etype

Syntax

fragment {true | false}

no fragment

Context

config>filter>ip-filter>entry>match

Description

This command configures fragmented or non-fragmented IP packets as an IP filter match criterion.

The no form of the command removes the match criterion.

This command applies to IPv4 filters only.

Default

false

Parameters

true

configures a match on all fragmented IP packets. A match occurs for all packets that have either the MF (more fragment) bit set or have the Fragment Offset field of the IP header set to a non-zero value.

false

configures a match on all non-fragmented IP packets. Non-fragmented IP packets are packets that have the MF bit set to zero and have the Fragment Offset field also set to zero.

Syntax

icmp-code icmp-code

no icmp-code

Context

config>filter>ip-exception>entry>match

config>filter>ip-filter>entry>match

config>filter>ipv6-filter>entry>match

Description

This command configures matching on the ICMP code field in the ICMP header of an IPv4 or IPv6 packet as a filter match criterion, or configures matching on the ICMP code field in the ICMP header of an IPv4 packet as an exception filter match criterion.

This command applies only if the protocol match criteria specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

Default

no icmp-code

Parameters

icmp-code

icmp-code-number or icmp-code-keyword

icmp-code-number

the ICMP code number in decimal, hexadecimal, or binary, to be used as a match criterion

Values

[0 to 250]D

[0x0 to 0xFF]H

[0b0 to 0b11111111]B

icmp-code-keyword

the ICMP code keyword to be used as a match criterion

Values

For IPv6:

none, no-route-to-destination, comm-with-dest-admin-prohibited, beyond-scope-src-addr, address-unreachable, port-unreachable

For IPv4 and IP-exception:

none, network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, dest-network-unknown, dest-host-unknown, src-host-isolated, network-unreachable-for-tos, host-unreachable-for-tos

Syntax

icmp-type icmp-type

no icmp-type

Context

config>filter>ip-exception>entry>match

config>filter>ip-filter>entry>match

config>filter>ipv6-filter>entry>match

Description

This command configures matching on the ICMP type field in the ICMP header of an IPv4 or IPv6 packet as a filter match criterion, or configures matching on the ICMP type field in the ICMP header of an IPv4 packet as an exception filter match criterion.

This command applies only if the protocol match criteria specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

Default

no icmp-type

Parameters

icmp-type

icmp-type-number or icmp-type-keyword

icmp-type-number

the ICMP type number in decimal, hexadecimal, or binary, to be used as a match criterion

Values

[0 to 250]D

[0x0 to 0xFF]H

[0b0 to 0b11111111]B

icmp-type-keyword

the ICMP type to be used as a match criterion

Values

For IPv6:

none, dest-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, multicast-listen-query, multicast-listen-report, multicast-listen-done, router-solicitation, router-advt, neighbor-solicitation, neighbor-advertisement, redirect-message, router-renumbering, icmp-node-info-query, icmp-node-info-resp, inv-nd-solicitation, inv-nd-adv-message, multicast-listener-report-v2, home-agent-ad-request, home-agent-ad-reply, mobile-prefix-solicitation, mobile-prefix-advt, cert-path-solicitation, cert-path-advt, multicast-router-advt, multicast-router-solicitation, multicast-router-termination, fmipv6, rpl-control, ilnpv6-locator-update, duplicate-addr-request, duplicate-addr-confirmation

For IPv4 and IP-exception:

none, echo-reply, dest-unreachable, source-quench, redirect, echo-request, router-advt, router-selection, time-exceeded, parameter-problem, timestamp-request, timestamp-reply, addr-mask-request, addr-mask-reply, photuris

Syntax

ip-option ip-option-value [ip-option-mask]

no ip-option

Context

config>filter>ip-filter>entry>match

Description

This command configures matching packets with a specific IP option or a range of IP options in the IP header as an IP filter match criterion.

The option type octet contains three fields:

• 1 bit copied flag (copy options in all fragments)

• 2 bits option class

• 5 bits option number

The no form of the command removes the match criterion.

This command applies to IPv4 filters only.

Default

no ip-option

Parameters

ip-option-value

 the 8-bit option type (can be entered using decimal, hexadecimal, or binary formats). The mask is applied as an AND to the option byte and the result is compared with the option value.

The decimal value entered for the match should be a combined value of the 8-bit option type field and not just the option number. Therefore, to match on IP packets that contain the Router Alert option (option number = 20), enter the option type of 148 (10010100).

Values

0 to 255

ip-option-mask

specifies a range of option numbers to use as the match criteria

This 8-bit mask can be entered using decimal, hexadecimal, or binary formats (see 8-bit mask formats).

Table 10. 8-bit mask formats

Format Style	Format Syntax	Example
Decimal	DDD	20
Hexadecimal	0x	0x14
Binary	0bBBBBBBBB	0b0010100

Default

255 (decimal) (exact match)

Values

0 to 255

Syntax

multiple-option {true | false}

no multiple-option

Context

config>filter>ip-filter>entry>match

Description

This command configures matching packets that contain more than one option field in the IP header as an IP filter match criterion.

The no form of the command removes the checking of the number of option fields in the IP header as a match criterion.

This command applies to IPv4 filters only.

Default

no multiple-option

Parameters

true

specifies matching on IP packets that contain more than one option field in the header

false

specifies matching on IP packets that do not contain multiple option fields in the header

Syntax

option-present {true | false}

no option-present

Context

config>filter>ip-filter>entry>match

Description

This command configures matching packets that contain the option field or have an option field of 0 in the IP header as an IP filter match criterion.

The no form of the command removes the checking of the option field in the IP header as a match criterion.

This command applies to IPv4 filters only.

Parameters

true

specifies matching on all IP packets that contain the option field in the header. A match occurs for all packets that have the option field present. An option field of 0 is considered as no option present.

false

specifies matching on IP packets that do not have any option field present in the IP header (an option field of 0)

Syntax

src-ip {ip-address/mask | ip-address ipv4-address-mask | ip-prefix-list prefix-list-name}

no src-ip

Context

config>filter>ip-exception>entry>match

config>filter>ip-filter>entry>match

Description

This command configures a source IPv4 address range or specifies an IP prefix list configured under the match-list ip-prefix-list command to be used as a match criterion for an IP filter or IP exception filter.

To match on the source IP address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 can also be used.

The no form of the command removes the source IP address or prefix list match criterion.

Default

no src-ip

Parameters

ip-address

the IP prefix for the IP match criterion in dotted-decimal notation

Values

0.0.0.0 to 255.255.255.255

mask

the subnet mask length expressed as a decimal integer

Values

0 to 32

ipv4-address-mask

any mask expressed in dotted-decimal notation

Values

0.0.0.0 to 255.255.255.255

prefix-list-name

the name of the IP prefix list configured with the match-list ip-prefix-list command

Syntax

src-ip {ipv6-address/prefix-length | ipv6-address ipv6-address-mask | ipv6-prefix-list prefix-list-name}

no src-ip

Context

config>filter>ipv6-filter>entry>match

Description

This command configures a source IPv6 address range or specifies an IPv6 prefix list configured under the match-list ipv6-prefix-list command to be used as a match criterion for an IP filter.

To match on the source IP address, specify the address and prefix length; for example, 11::12/128.

The no form of the command removes the source IPv6 address or prefix list match criterion.

Default

n/a

Parameters

ipv6-address

the IPv6 address on the interface

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x:    [0 to FFFF]H

d:    [0 to 255]D

prefix-length

the prefix length associated with the IPv6 address

Values

0 to 128

ipv6-address-mask

the IPv6 address mask

Values

x:x:x:x:x:x:x:x (eight 16-bit pieces)

x:x:x:x:x:x:d.d.d.d

x:    [0 to FFFF]H

d:    [0 to 255]D

prefix-list-name

the name of the IPv6 prefix list configured with the match-list ipv6-prefix-list command

Syntax

src-mac ieee-address

no src-mac

Context

config>filter>mac-filter>entry>match

Description

This command configures a source MAC address to be used as a MAC filter match criterion.

The no form of the command removes the source MAC address as the match criterion.

Default

no src-mac

Parameters

ieee-address

the 48-bit IEEE MAC address to be used as a match criterion

Values

xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx, where x is a hexadecimal digit

Syntax

src-port {lt | gt | eq} src-port-number

src-port range src-port-number src-port-number

no src-port

Context

config>filter>ip-exception>entry>match

config>filter>ip-filter>entry>match

config>filter>ipv6-filter>entry>match

Description

This command configures a source TCP or UDP port number or port range for an IP filter or IP exception filter match criterion.

The no form of the command removes the source port match criterion.

Default

no src-port

Parameters

lt | gt | eq

use relative to src-port-number for specifying the port number match criteria:

lt specifies that all port numbers less than src-port-number match

gt specifies that all port numbers greater than src-port-number match

eq specifies that src-port-number must be an exact match

src-port-number

the source port number to be used as a match criteria expressed as a decimal integer

Values

1 to 65535

range

specifies an inclusive range of port numbers to be used as a match criteria. The first src-port-number specifies the start of the range, and the second src-port-number specifies the end of the range.

Syntax

tcp-ack {true | false}

no tcp-ack

Context

config>filter>ip-filter>entry>match

config>filter>ipv6-filter>entry>match

Description

This command configures matching on the ACK bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The no form of the command removes the criterion from the match entry.

Default

no tcp-ack

Parameters

true

specifies matching on IP packets that have the ACK bit set in the control bits of the TCP header of an IP packet

false

specifies matching on IP packets that do not have the ACK bit set in the control bits of the TCP header of the IP packet

Syntax

tcp-syn {true | false}

no tcp-syn

Context

config>filter>ip-filter>entry>match

config>filter>ipv6-filter>entry>match

Description

This command configures matching on the SYN bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The SYN bit is normally set when the source of the packet wants to initiate a TCP session with the specified destination IP address.

The no form of the command removes the criterion from the match entry.

Default

no tcp-syn

Parameters

true

specifies matching on IP packets that have the SYN bit set in the control bits of the TCP header

false

specifies matching on IP packets that do not have the SYN bit set in the control bits of the TCP header

Syntax

abort

Context

config>security

Description

This command discards changes made to a security feature.

Default

n/a

Syntax

begin

Context

config>security

Description

This command enters the mode to create or edit security features.

Default

n/a

Syntax

commit

Context

config>security

Description

This command saves changes made to security features.

Default

n/a

Syntax

app-group {group-id | name} [create]

no app-group {group-id | name}

Context

config>security

Description

This command enters the context for creating an application group to be used in a security policy.

The no form of the command removes the configured application group.

Default

n/a

Parameters

group-id

the application group ID, from 1 to 100

name

the name of the application group, up to 32 characters in length (must start with a letter)

Syntax

name name

no name

Context

config>security>app-group

config>security>host-group

config>security>policer-group

Description

This command configures a name for an application group, host group, or policer group.

The no form of the command removes the configured name.

Parameters

name

 the name of the application group, host group, or policer group, up to 32 characters in length (must start with a letter)

Syntax

bypass {bypass-id | name} [create]

no bypass {bypass-id | name}

Context

config>security

Description

This command creates a bypass policy that allows packets to bypass a firewall in a Layer 2 service security zone based on specified match criteria. The bypass policy must be given an ID or a name that is unique within the system. If given a name, the system automatically assigns the first available ID number to the policy. The bypass name can be used instead of the bypass ID to refer to a bypass policy for firewall configuration commands, show commands, monitor commands, clear commands, and service endpoint association commands. The bypass policy can be associated with a VPLS or Epipe service with the fw-bypass-policy command under the config>service>vpls or config>service>epipe context.

Each bypass policy that is created uses one of the system’s filter entry slots.

The no form of the command deletes the bypass policy.

Default

n/a

Parameters

bypass-id

the bypass ID number

Values

1 to 65535

name

the name of the bypass policy

Values

1 to 32 characters (must start with a letter). If the string contains special characters (such as #, $, or spaces), the entire string must be enclosed within double quotes.

create

keyword required when first creating the bypass policy. When the policy is created, you can enter the context without the create keyword.

Syntax

entry entry-id [create]

no entry entry-id

Context

config>security>bypass

Description

This command configures an entry in a bypass policy.

The no form of this command deletes the entry with the specified ID. When an entry is deleted, all configuration parameters for the entry are also deleted.

Default

n/a

Parameters

entry-id

the entry ID number

Values

1 to 65535

create

keyword required when first creating the entry. When the entry is created, you can enter the context without the create keyword.

Syntax

match [protocol protocol-id]

no match

Context

config>security>bypass>entry

Description

This command defines the protocols that are allowed to bypass a firewall in a Layer 2 service.

When processing protocol packets defined in the bypass policy, the 7705 SAR ignores the firewall lookup table, even if there is a more specific matching rule for the firewall. The bypass policy must be created carefully to ensure that it does not cause any security holes on the node.

The no form of the command removes the protocol from the bypass policy.

Default

no protocol

Parameters

protocol-id

protocol-number | protocol-name

protocol-number

the protocol number in decimal, hexadecimal, or binary, that is allowed to bypass the firewall. See IP Protocol IDs and Descriptions for a list of common protocol numbers.

Values

[0 to 255]D

[0x0 to 0xFF]H

[0b0 to 0b11111111]B

protocol-name

the name of the protocol that is allowed to bypass the firewall

Values

none, icmp, igmp, ip, tcp, egp, igp, udp, rdp, ipv6, ipv6-route, ipv6-frag, idrp, rsvp, gre, ipv6-icmp, ipv6-no-nxt, ipv6-opts, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni, pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp, mpls-in-ip

* - udp/tcp wildcard

Table 11. IP Protocol IDs and Descriptions

Protocol ID	Protocol	Description
1	icmp	Internet Control Message
2	igmp	Internet Group Management
4	ip	IP in IP (encapsulation)
6	tcp	Transmission Control
8	egp	Exterior Gateway Protocol
9	igp	Any private interior gateway
17	udp	User Datagram
27	rdp	Reliable Data Protocol
41	ipv6	IPv6
43	ipv6-route	Routing Header for IPv6
44	ipv6-frag	Fragment Header for IPv6
45	idrp	Inter-Domain Routing Protocol
46	rsvp	Reservation Protocol
47	gre	General Routing Encapsulation
58	ipv6-icmp	ICMP for IPv6
59	ipv6-no-nxt	No Next Header for IPv6
60	ipv6-opts	Destination Options for IPv6
80	iso-ip	ISO Internet Protocol
88	eigrp	EIGRP
89	ospf-igp	OSPFIGP
97	ether-ip	Ethernet-within-IP Encapsulation
98	encap	Encapsulation Header
102	pnni	PNNI over IP
103	pim	Protocol Independent Multicast
112	vrrp	Virtual Router Redundancy Protocol
115	l2tp	Layer Two Tunneling Protocol
118	stp	Schedule Transfer Protocol
123	ptp	Performance Transparency Protocol
124	isis	ISIS over IPv4
126	crtp	Combat Radio Transport Protocol
127	crudp	Combat Radio User Datagram
132	sctp	Stream Control Transmission Protocol
137	mpls-in-ip	MPLS in IP

Syntax

dst-port {lt | gt | eq} dst-port-number

dst-port range dst-port-number dst-port-number

no dst-port

Context

config>security>bypass>entry>match

Description

This command configures a destination protocol TCP or UDP port number or port range for the bypass policy match criterion.

The no form of the command removes the destination port match criterion.

Default

no dst-port

Parameters

lt | gt | eq

use relative to dst-port-number for specifying the port number match criterion:

lt specifies that all port numbers less than the dst-port-number match

gt specifies that all port numbers greater than the dst-port-number match

eq specifies that the dst-port-number must be an exact match

dst-port-number

the destination port number to be used as a match criterion, expressed as a decimal integer

Values

1 to 65535

range

specifies an inclusive range of port numbers to be used as a match criterion. The first dst-port-number specifies the start of the range, and the second dst-port-number specifies the end of the range.

Syntax

src-port {lt | gt | eq} src-port-number

src-port range src-port-number src-port-number

no src-port

Context

config>security>bypass>entry>match

Description

This command configures a source protocol TCP or UDP port number or port range for the bypass policy match criterion.

The no form of the command removes the source port match criterion.

Default

no src-port

Parameters

lt | gt | eq

use relative to src-port-number for specifying the port number match criterion:

lt specifies that all port numbers less than the src-port-number number match

gt specifies that all port numbers greater than the src-port-number number match

eq specifies that the src-port-number must be an exact match

src-port-number

the source port number to be used as a match criterion, expressed as a decimal integer

Values

1 to 65535

range

specifies an inclusive range of port numbers to be used as a match criterion. The first src-port-number specifies the start of the range, and the second src-port-number specifies the end of the range.

Syntax

name name

no name

Context

config>security>bypass

Description

This command configures the bypass policy name. The bypass policy name must be unique within the system. If the policy name was already configured with the bypass command, this command renames the policy.

The no form of the command deletes the bypass name.

Default

no name

Parameters

name

the name of the bypass policy

Values

1 to 32 characters (must start with a letter). If the string contains special characters (such as #, $, or spaces), the entire string must be enclosed within double quotes.

Syntax

host-group {group-id | name} [create]

no host-group {group-id | name}

Context

config>security

Description

This command enters the context for creating a host group to be used in a security policy.

The no form of the command removes the configured host group.

Default

n/a

Parameters

group-id

the host group ID, from 1 to 100

name

the name of the host group, up to 32 characters in length (must start with a letter)

Syntax

host ip-address [to ip-address]

no host

Context

config>security>host-group

Description

This command configures a range of hosts to be used in a host group. Up to 10 entries can be configured for a host group.

Default

n/a

Parameters

ip-address

the IPv4 address of the host

Syntax

logging

Context

config>security

Description

This command enters the security logging context.

Default

n/a

Syntax

log-id {log-id | log-name} [create]

no log-id {log-id | log-name}

Context

config>security>logging

Description

This command configures the identifier for the security log. The 7705 SAR supports up to 100 security logs. This log ID can be applied at the zone level or at the rule level, but not to both at the same time.

The no form of the command removes the configured security group.

Default

n/a

Parameters

log-id

the security log ID, from 1 to 100

log-name

the name of the security log, up to 32 characters in length (must start with a letter)

Syntax

destination {memory [size] | syslog syslog-id}

no destination

Context

config>security>logging>log

Description

This command configures the destination location of the specified security log.

Default

n/a

Parameters

memory

specifies that the log destination is the 7705 SAR local memory (compact flash or flash drive)

size

the number of log events that can be held in memory, up to 1024

syslog

specifies that the log destination is the system log

syslog-id

the identifier of the system log, up to 32 characters in length

Syntax

name name

no name

Context

config>security>logging>log

Description

This command configures the name of the specified security log.

Default

n/a

Parameters

name

the name of the security log, up to 32 characters in length

Syntax

profile {logging-profile-id | logging-profile-name}

Context

config>security>logging>log

Description

This command configures the logging profile to which the specified security logs match events.

Default

n/a

Parameters

logging-profile-id

the logging profile ID for the security log

Values

1 to 100

logging-profile-name

the logging profile name for the security log, up to 32 characters in length

Syntax

[no] shutdown

Context

config>security>logging>log

Description

This command disables logging to the specified security log. Logging is enabled by default.

The no form of this command enables logging to the specified security profile.

Default

no shutdown

Syntax

[no] wrap-around

Context

config>security>logging>log

Description

This command enables log wraparound when the maximum log size has been reached in the log destination location. When wraparound is enabled, the log starts over at 1 and overwrites the existing logs when the log size is at maximum. When wraparound is disabled, the log stops adding entries when the log size is at maximum.

The no form of this command disables log wraparound.

Default

no wrap-around

Syntax

profile {profile-id | profile-name} [create]

no profile {profile-id | profile-name}

Context

config>security>logging

Description

This command configures the security logging profile.

The no form of the command removes the configured profile.

Default

n/a

Parameters

profile-id

the ID of the profile group, from 1 to 65535

profile-name

the name of the profile group, up to 32 characters in length

Syntax

event-control event-type [event event] {suppress | throttle | off}

Context

config>security>logging>profile

Description

This command controls the generation of security log events. A log can be configured to generate all event types and events, or to generate specific event types and events. In addition, for each event type or event, one of three actions can be configured: suppress, throttle, or off. These configurations all become part of the specified logging profile. Event Types and Events Supported on 7705 SAR Firewalls  lists the supported event types and events on 7705 SAR firewalls.

Default

n/a

Parameters

event-type

the type of event to be controlled for in this logging profile, as shown in Event Types and Events Supported on 7705 SAR Firewalls 

event

the name of the event to be controlled for in this logging profile as shown in Event Types and Events Supported on 7705 SAR Firewalls 

suppress

suppresses the specified event type or event in this logging profile

throttle

throttles a repeating event type or event when the same event type or event is generated repeatedly within 1 s in this logging profile

off

allows the event type or event to be logged in this logging profile

Syntax

name name

no name

Context

config>security>logging>profile

Description

This command configures a name for this logging profile.

The no form of the command removes the configured name for this logging profile.

Default

n/a

Parameters

name

the name of the logging profile, up to 32 characters in length

Syntax

profile {profile-id | profile-name} [create]

no profile {profile-id | profile-name}

Context

config>security

Description

This command configures a profile group that provides a context within which you can configure security features such as session idle timeouts and application assurance parameters. Profile 1 is a default profile and cannot be modified.

The no form of the command removes the configured profile group.

Default

1

Parameters

profile-id

the ID of the profile group, from 1 to 100

profile-name

the name of the profile group, up to 32 characters in length

Syntax

application

Context

config>security>profile

Description

This command enters the application context for firewall configuration.

Syntax