filter commands
configure
— filter
— apply-groups reference
— apply-groups-exclude reference
— dhcp-filter number
— apply-groups reference
— apply-groups-exclude reference
— default-action
— bypass-host-creation
— drop
— description string
— entry number
— action
— bypass-host-creation
— drop
— apply-groups reference
— apply-groups-exclude reference
— option
— absent
— match
— exact boolean
— hex string
— invert boolean
— string string
— number number
— present
— dhcp6-filter number
— apply-groups reference
— apply-groups-exclude reference
— default-action
— bypass-host-creation
— na boolean
— pd boolean
— drop
— description string
— entry number
— action
— bypass-host-creation
— na boolean
— pd boolean
— drop
— apply-groups reference
— apply-groups-exclude reference
— option
— absent
— match
— exact boolean
— hex string
— invert boolean
— string string
— number number
— present
— gre-tunnel-template string
— apply-groups reference
— apply-groups-exclude reference
— description string
— ipv4
— destination-address string
— gre-key (keyword | number)
— skip-ttl-decrement boolean
— source-address string
— ipv6
— destination-address string
— gre-key keyword
— skip-hop-decrement boolean
— source-address string
— ip-exception string
— apply-groups reference
— apply-groups-exclude reference
— description string
— entry number
— apply-groups reference
— apply-groups-exclude reference
— description string
— match
— dst-ip
— address (ipv4-prefix-with-host-bits | ipv4-address)
— mask string
— dst-port
— eq number
— gt number
— lt number
— range
— end number
— start number
— icmp
— code number
— type number
— protocol (number | keyword)
— src-ip
— address (ipv4-prefix-with-host-bits | ipv4-address)
— mask string
— src-port
— eq number
— gt number
— lt number
— range
— end number
— start number
— filter-id number
— ip-filter string
— apply-groups reference
— apply-groups-exclude reference
— chain-to-system-filter boolean
— default-action keyword
— description string
— embed
— filter reference offset number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— flowspec offset number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— group number
— router-instance string
— openflow reference offset number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— grt
— sap reference
— system
— vpls reference
— vprn reference
— entry number
— action
— accept
— accept-when
— pattern
— expression string
— mask string
— offset-type keyword
— offset-value number
— apply-groups reference
— apply-groups-exclude reference
— drop
— drop-when
— extracted-traffic
— packet-length
— eq number
— gt number
— lt number
— range
— end number
— start number
— pattern
— expression string
— mask string
— offset-type keyword
— offset-value number
— ttl
— eq number
— gt number
— lt number
— range
— end number
— start number
— fc keyword
— forward
— bonding-connection number
— esi-l2
— esi-value string
— vpls reference
— esi-l3
— esi-value string
— sf-ip string
— vas-interface reference
— vprn reference
— gre-tunnel reference
— lsp string
— mpls-policy
— endpoint string
— next-hop
— interface-name string
— nh-ip
— address string
— indirect boolean
— nh-ip-vrf
— address string
— indirect boolean
— router-instance string
— redirect-policy reference
— router-instance string
— sap
— sap-id reference
— vpls reference
— sdp
— sdp-bind-id string
— vpls reference
— srte-policy
— color number
— endpoint string
— vprn-target
— adv-prefix string
— bgp-nh string
— lsp string
— vprn reference
— gtp-local-breakout
— http-redirect
— allow-override boolean
— url (keyword | http-redirect-url)
— ignore-match
— l2-aware-nat-bypass boolean
— nat
— nat-policy reference
— rate-limit
— extracted-traffic
— packet-length
— eq number
— gt number
— lt number
— range
— end number
— start number
— pattern
— expression string
— mask string
— offset-type keyword
— offset-value number
— pir (number | keyword)
— pps-pir (number | keyword)
— ttl
— eq number
— gt number
— lt number
— range
— end number
— start number
— reassemble
— remark
— dscp keyword
— secondary
— apply-groups reference
— apply-groups-exclude reference
— forward
— next-hop
— nh-ip-vrf
— address string
— indirect boolean
— router-instance string
— sap
— sap-id reference
— vpls reference
— sdp
— sdp-bind-id string
— vpls reference
— vprn-target
— adv-prefix string
— bgp-nh string
— lsp string
— vprn reference
— remark
— dscp keyword
— tcp-mss-adjust
— apply-groups reference
— apply-groups-exclude reference
— description string
— egress-pbr keyword
— filter-sample boolean
— interface-sample boolean
— log reference
— match
— destination-class number
— dscp keyword
— dst-ip
— address (ipv4-prefix-with-host-bits | ipv4-address)
— ip-prefix-list reference
— mask string
— dst-port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— fragment keyword
— icmp
— code number
— type number
— ip
— address (ipv4-prefix-with-host-bits | ipv4-address)
— ip-prefix-list reference
— mask string
— ip-option
— mask number
— type number
— multiple-option boolean
— option-present boolean
— packet-length
— eq number
— gt number
— lt number
— range
— end number
— start number
— port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— protocol (number | keyword)
— protocol-list reference
— src-ip
— address (ipv4-prefix-with-host-bits | ipv4-address)
— ip-prefix-list reference
— mask string
— src-mac
— address string
— mask string
— src-port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— src-route-option boolean
— tcp-established
— tcp-flags
— ack boolean
— cwr boolean
— ece boolean
— fin boolean
— ns boolean
— psh boolean
— rst boolean
— syn boolean
— urg boolean
— ttl
— eq number
— gt number
— lt number
— range
— end number
— start number
— pbr-down-action-override keyword
— sample-profile reference
— sticky-dest (number | keyword)
— filter-id number
— scope keyword
— shared-policer boolean
— subscriber-mgmt
— host-specific-entry
— credit-control
— range
— end number
— start number
— filter-rule
— range
— end number
— start number
— watermark
— high number
— low number
— shared-entry
— filter-rule
— range
— end number
— start number
— pcc-rule
— range
— end number
— start number
— watermark
— high number
— low number
— type keyword
— ipv6-exception string
— apply-groups reference
— apply-groups-exclude reference
— description string
— entry number
— apply-groups reference
— apply-groups-exclude reference
— description string
— match
— dst-ip
— address (ipv6-prefix-with-host-bits | ipv6-address)
— ipv6-prefix-list reference
— mask string
— dst-port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— icmp
— code number
— type number
— next-header (number | keyword)
— port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— src-ip
— address (ipv6-prefix-with-host-bits | ipv6-address)
— ipv6-prefix-list reference
— mask string
— src-port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— filter-id number
— ipv6-filter string
— apply-groups reference
— apply-groups-exclude reference
— chain-to-system-filter boolean
— default-action keyword
— description string
— embed
— filter reference offset number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— flowspec offset number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— group number
— router-instance string
— openflow reference offset number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— grt
— sap reference
— system
— vpls reference
— vprn reference
— entry number
— action
— accept
— accept-when
— pattern
— expression string
— mask string
— offset-type keyword
— offset-value number
— apply-groups reference
— apply-groups-exclude reference
— drop
— drop-when
— extracted-traffic
— hop-limit
— eq number
— gt number
— lt number
— range
— end number
— start number
— pattern
— expression string
— mask string
— offset-type keyword
— offset-value number
— payload-length
— eq number
— gt number
— lt number
— range
— end number
— start number
— fc keyword
— forward
— bonding-connection number
— esi-l2
— esi-value string
— vpls reference
— esi-l3
— esi-value string
— sf-ip string
— vas-interface reference
— vprn reference
— gre-tunnel reference
— lsp string
— mpls-policy
— endpoint string
— next-hop
— nh-ip
— address string
— indirect boolean
— nh-ip-vrf
— address string
— indirect boolean
— router-instance string
— redirect-policy reference
— router-instance string
— sap
— sap-id reference
— vpls reference
— sdp
— sdp-bind-id string
— vpls reference
— srte-policy
— color number
— endpoint string
— vprn-target
— adv-prefix string
— bgp-nh string
— lsp string
— vprn reference
— http-redirect
— allow-override boolean
— url (keyword | http-redirect-url)
— ignore-match
— nat
— nat-policy reference
— nat-type keyword
— rate-limit
— extracted-traffic
— hop-limit
— eq number
— gt number
— lt number
— range
— end number
— start number
— pattern
— expression string
— mask string
— offset-type keyword
— offset-value number
— payload-length
— eq number
— gt number
— lt number
— range
— end number
— start number
— pir (number | keyword)
— pps-pir (number | keyword)
— remark
— dscp keyword
— secondary
— apply-groups reference
— apply-groups-exclude reference
— forward
— next-hop
— nh-ip-vrf
— address string
— indirect boolean
— router-instance string
— sap
— sap-id reference
— vpls reference
— sdp
— sdp-bind-id string
— vpls reference
— vprn-target
— adv-prefix string
— bgp-nh string
— lsp string
— vprn reference
— remark
— dscp keyword
— tcp-mss-adjust
— apply-groups reference
— apply-groups-exclude reference
— description string
— egress-pbr keyword
— filter-sample boolean
— interface-sample boolean
— log reference
— match
— destination-class number
— dscp keyword
— dst-ip
— address (ipv6-prefix-with-host-bits | ipv6-address)
— ipv6-prefix-list reference
— mask string
— dst-port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— extension-header
— ah boolean
— esp boolean
— hop-by-hop boolean
— routing-type0 boolean
— flow-label
— mask number
— value number
— fragment keyword
— hop-limit
— eq number
— gt number
— lt number
— range
— end number
— start number
— icmp
— code number
— type number
— ip
— address (ipv6-prefix-with-host-bits | ipv6-address)
— ipv6-prefix-list reference
— mask string
— next-header (number | keyword)
— next-header-list reference
— packet-length
— eq number
— gt number
— lt number
— range
— end number
— start number
— port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— src-ip
— address (ipv6-prefix-with-host-bits | ipv6-address)
— ipv6-prefix-list reference
— mask string
— src-mac
— address string
— mask string
— src-port
— eq number
— gt number
— lt number
— port-list reference
— range
— end number
— start number
— tcp-established
— tcp-flags
— ack boolean
— cwr boolean
— ece boolean
— fin boolean
— ns boolean
— psh boolean
— rst boolean
— syn boolean
— urg boolean
— pbr-down-action-override keyword
— sample-profile reference
— sticky-dest (number | keyword)
— filter-id number
— scope keyword
— shared-policer boolean
— subscriber-mgmt
— host-specific-entry
— credit-control
— range
— end number
— start number
— filter-rule
— range
— end number
— start number
— watermark
— high number
— low number
— shared-entry
— filter-rule
— range
— end number
— start number
— pcc-rule
— range
— end number
— start number
— watermark
— high number
— low number
— type keyword
— log number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— destination
— memory
— max-entries number
— stop-on-full boolean
— syslog
— name reference
— summary
— admin-state keyword
— summary-crit keyword
— mac-filter string
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— description string
— embed
— entry number
— action
— accept
— apply-groups reference
— apply-groups-exclude reference
— drop
— forward
— esi-l2
— esi-value string
— vpls reference
— sap
— sap-id reference
— vpls reference
— sdp
— sdp-bind-id string
— vpls reference
— http-redirect
— url string
— ignore-match
— rate-limit
— pir (number | keyword)
— secondary
— apply-groups reference
— apply-groups-exclude reference
— forward
— sap
— sap-id reference
— vpls reference
— sdp
— sdp-bind-id string
— vpls reference
— apply-groups reference
— apply-groups-exclude reference
— description string
— log reference
— match
— dot1p
— mask number
— priority number
— dst-mac
— address string
— mask string
— etype string
— frame-type keyword
— inner-tag
— mask number
— tag number
— isid
— range
— end number
— start number
— value number
— llc-dsap
— dsap number
— mask number
— llc-ssap
— mask number
— ssap number
— outer-tag
— mask number
— tag number
— snap-oui keyword
— snap-pid number
— src-mac
— address string
— mask string
— pbr-down-action-override keyword
— sticky-dest (number | keyword)
— filter-id number
— scope keyword
— type keyword
— match-list
— apply-groups reference
— apply-groups-exclude reference
— ip-prefix-list string
— apply-groups reference
— apply-groups-exclude reference
— apply-path
— bgp-peers number
— apply-groups reference
— apply-groups-exclude reference
— group string
— neighbor string
— router-instance string
— description string
— prefix string
— prefix-exclude string
— ipv6-prefix-list string
— apply-groups reference
— apply-groups-exclude reference
— apply-path
— bgp-peers number
— apply-groups reference
— apply-groups-exclude reference
— group string
— neighbor string
— router-instance string
— description string
— prefix string
— prefix-exclude string
— port-list string
— apply-groups reference
— apply-groups-exclude reference
— description string
— port number
— range start number end number
— protocol-list string
— apply-groups reference
— apply-groups-exclude reference
— description string
— protocol (number | keyword)
— md-auto-id
— filter-id-range
— apply-groups reference
— apply-groups-exclude reference
— end number
— start number
— redirect-policy string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— destination (ipv4-address-no-zone | ipv6-address-no-zone)
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— ping-test
— apply-groups reference
— apply-groups-exclude reference
— drop-count number
— hold-down number
— interval number
— source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— timeout number
— priority number
— unicast-rt-test
— notify-dest-change boolean
— router-instance string
— sticky-dest (number | keyword)
— redirect-policy-binding string
— apply-groups reference
— apply-groups-exclude reference
— binding-operator keyword
— redirect-policy reference
— apply-groups reference
— apply-groups-exclude reference
— destination reference
— system-filter
— apply-groups reference
— apply-groups-exclude reference
— ip reference
— ipv6 reference
filter command descriptions
filter
dhcp-filter [filter-id] number
Synopsis | Enter the dhcp-filter list instance | |
Context | configure filter dhcp-filter number | |
Tree | dhcp-filter | |
Introduced | 16.0.R1 | |
Platforms | All |
[filter-id] number
Synopsis | Unique DHCP filter policy ID | |
Context | configure filter dhcp-filter number | |
Tree | dhcp-filter | |
Range | 1 to 65535 | |
Notes | This element is part of a list key. | |
Introduced | 16.0.R1 | |
Platforms | All |
default-action
Synopsis | Enable the default-action context | |
Context | configure filter dhcp-filter number default-action | |
Tree | default-action | |
Introduced | 16.0.R1 | |
Platforms | All |
bypass-host-creation
Synopsis | Host creation options to bypass | |
Context | configure filter dhcp-filter number default-action bypass-host-creation | |
Tree | bypass-host-creation | |
Notes | The following elements are part of a mandatory choice: bypass-host-creation or drop. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
drop
Synopsis | DHCP host creation when the filter entry is matched | |
Context | configure filter dhcp-filter number default-action drop | |
Tree | drop | |
Notes | The following elements are part of a mandatory choice: bypass-host-creation or drop. | |
Introduced | 16.0.R1 | |
Platforms | All |
description string
Synopsis | Text description | |
Context | configure filter dhcp-filter number description string | |
Tree | description | |
String Length | 1 to 80 | |
Introduced | 16.0.R1 | |
Platforms | All |
entry [entry-id] number
Synopsis | Enter the entry list instance | |
Context | configure filter dhcp-filter number entry number | |
Tree | entry | |
Max. Instances | 10 | |
Introduced | 16.0.R1 | |
Platforms | All |
[entry-id] number
Synopsis | DHCP filter entry index | |
Context | configure filter dhcp-filter number entry number | |
Tree | entry | |
Range | 1 to 65535 | |
Notes | This element is part of a list key. | |
Introduced | 16.0.R1 | |
Platforms | All |
action
Synopsis | Enable the action context | |
Context | configure filter dhcp-filter number entry number action | |
Tree | action | |
Introduced | 16.0.R1 | |
Platforms | All |
bypass-host-creation
Synopsis | Host creation options to bypass | |
Context | configure filter dhcp-filter number entry number action bypass-host-creation | |
Tree | bypass-host-creation | |
Notes | The following elements are part of a mandatory choice: bypass-host-creation or drop. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
drop
option
Synopsis | Enable the option context | |
Context | configure filter dhcp-filter number entry number option | |
Tree | option | |
Introduced | 16.0.R1 | |
Platforms | All |
absent
match
exact boolean
hex string
invert boolean
string string
number number
present
dhcp6-filter [filter-id] number
Synopsis | Enter the dhcp6-filter list instance | |
Context | configure filter dhcp6-filter number | |
Tree | dhcp6-filter | |
Introduced | 16.0.R1 | |
Platforms | All |
[filter-id] number
Synopsis | Unique DHCP filter policy ID | |
Context | configure filter dhcp6-filter number | |
Tree | dhcp6-filter | |
Range | 1 to 65535 | |
Notes | This element is part of a list key. | |
Introduced | 16.0.R1 | |
Platforms | All |
default-action
Synopsis | Enable the default-action context | |
Context | configure filter dhcp6-filter number default-action | |
Tree | default-action | |
Introduced | 16.0.R1 | |
Platforms | All |
bypass-host-creation
Synopsis | Enable the bypass-host-creation context | |
Context | configure filter dhcp6-filter number default-action bypass-host-creation | |
Tree | bypass-host-creation | |
Notes | The following elements are part of a mandatory choice: bypass-host-creation or drop. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
na boolean
Synopsis | Bypass the DHCPv6 NA host creation | |
Context | configure filter dhcp6-filter number default-action bypass-host-creation na boolean | |
Tree | na | |
Default | true | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
pd boolean
Synopsis | Bypass the DHCPv6 PD host creation | |
Context | configure filter dhcp6-filter number default-action bypass-host-creation pd boolean | |
Tree | pd | |
Default | true | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
drop
Synopsis | Drop DHCPv6 message (do not process) | |
Context | configure filter dhcp6-filter number default-action drop | |
Tree | drop | |
Notes | The following elements are part of a mandatory choice: bypass-host-creation or drop. | |
Introduced | 16.0.R1 | |
Platforms | All |
description string
Synopsis | Text description | |
Context | configure filter dhcp6-filter number description string | |
Tree | description | |
String Length | 1 to 80 | |
Introduced | 16.0.R1 | |
Platforms | All |
entry [entry-id] number
Synopsis | Enter the entry list instance | |
Context | configure filter dhcp6-filter number entry number | |
Tree | entry | |
Max. Instances | 10 | |
Introduced | 16.0.R1 | |
Platforms | All |
[entry-id] number
Synopsis | DHCP filter entry index | |
Context | configure filter dhcp6-filter number entry number | |
Tree | entry | |
Range | 1 to 65535 | |
Notes | This element is part of a list key. | |
Introduced | 16.0.R1 | |
Platforms | All |
action
Synopsis | Enable the action context | |
Context | configure filter dhcp6-filter number entry number action | |
Tree | action | |
Introduced | 16.0.R1 | |
Platforms | All |
bypass-host-creation
Synopsis | Enable the bypass-host-creation context | |
Context | configure filter dhcp6-filter number entry number action bypass-host-creation | |
Tree | bypass-host-creation | |
Notes | The following elements are part of a mandatory choice: bypass-host-creation or drop. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
na boolean
Synopsis | Bypass the DHCPv6 NA host creation | |
Context | configure filter dhcp6-filter number entry number action bypass-host-creation na boolean | |
Tree | na | |
Default | true | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
pd boolean
Synopsis | Bypass the DHCPv6 PD host creation | |
Context | configure filter dhcp6-filter number entry number action bypass-host-creation pd boolean | |
Tree | pd | |
Default | true | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS |
drop
option
Synopsis | Enable the option context | |
Context | configure filter dhcp6-filter number entry number option | |
Tree | option | |
Introduced | 16.0.R1 | |
Platforms | All |
absent
match
exact boolean
hex string
invert boolean
string string
number number
present
gre-tunnel-template [gre-tunnel-template-name] string
Synopsis | Enter the gre-tunnel-template list instance | |
Context | configure filter gre-tunnel-template string | |
Tree | gre-tunnel-template | |
Max. Instances | 8191 | |
Introduced | 16.0.R1 | |
Platforms | All |
[gre-tunnel-template-name] string
Synopsis | GRE tunnel template ID | |
Context | configure filter gre-tunnel-template string | |
Tree | gre-tunnel-template | |
String Length | 1 to 32 | |
Notes | This element is part of a list key. | |
Introduced | 16.0.R1 | |
Platforms | All |
description string
Synopsis | Text description | |
Context | configure filter gre-tunnel-template string description string | |
Tree | description | |
String Length | 1 to 80 | |
Introduced | 16.0.R2 | |
Platforms | All |
ipv4
Synopsis | Enter the ipv4 context | |
Context | configure filter gre-tunnel-template string ipv4 | |
Tree | ipv4 | |
Notes | The following elements are part of a choice: ipv4 or ipv6. | |
Introduced | 16.0.R1 | |
Platforms | All |
destination-address [address] string
Synopsis | Add a list entry for destination-address | |
Context | configure filter gre-tunnel-template string ipv4 destination-address string | |
Tree | destination-address | |
Description | This command defines a destination for the GRE IP header used to encapsulate the matching IPv4/IPv6 packet. A single destination address can be specified for an IPv6 gre-tunnel-template. Traffic matching the associated IPv4 or IPv6 filter is hashed across any available ECMP or UCMP route next hop available to the destination address. If no destination address is available, then matching traffic follows the configured pbr-down-action-override action, if configured. If no pbr-down-action-override is configured traffic is discarded. | |
Max. Instances | 32 | |
Introduced | 16.0.R1 | |
Platforms | All |
[address] string
Synopsis | Destination IPv4 address | |
Context | configure filter gre-tunnel-template string ipv4 destination-address string | |
Tree | destination-address | |
Notes | This element is part of a list key. | |
Introduced | 16.0.R1 | |
Platforms | All |
gre-key (keyword | number)
Synopsis | GRE key | |
Context | configure filter gre-tunnel-template string ipv4 gre-key (keyword | number) | |
Tree | gre-key | |
Max. Range | 0 to 4294967295 | |
Options | ||
Introduced | 16.0.R1 | |
Platforms | All |
skip-ttl-decrement boolean
Synopsis | Decrement TTL | |
Context | configure filter gre-tunnel-template string ipv4 skip-ttl-decrement boolean | |
Tree | skip-ttl-decrement | |
Default | false | |
Introduced | 16.0.R1 | |
Platforms | All |
source-address string
Synopsis | Source IP address of the GRE encapsulated | |
Context | configure filter gre-tunnel-template string ipv4 source-address string | |
Tree | source-address | |
Introduced | 16.0.R1 | |
Platforms | All |
ipv6
Synopsis | Enter the ipv6 context | |
Context | configure filter gre-tunnel-template string ipv6 | |
Tree | ipv6 | |
Notes | The following elements are part of a choice: ipv4 or ipv6. | |
Introduced | 22.7.R1 | |
Platforms | All |
destination-address [address] string
Synopsis | Add a list entry for destination-address | |
Context | configure filter gre-tunnel-template string ipv6 destination-address string | |
Tree | destination-address | |
Max. Instances | 1 | |
Introduced | 22.7.R1 | |
Platforms | All |
[address] string
Synopsis | IPv6 destination address | |
Context | configure filter gre-tunnel-template string ipv6 destination-address string | |
Tree | destination-address | |
Notes | This element is part of a list key. | |
Introduced | 22.7.R1 | |
Platforms | All |
gre-key keyword
Synopsis | Include a key value in GRE header | |
Context | configure filter gre-tunnel-template string ipv6 gre-key keyword | |
Tree | gre-key | |
Description | This command includes a key value in the GRE header of ifIndex of the ingress interface. | |
Options | ||
Introduced | 22.7.R1 | |
Platforms | All |
skip-hop-decrement boolean
Synopsis | Decrement TTL of the received packet | |
Context | configure filter gre-tunnel-template string ipv6 skip-hop-decrement boolean | |
Tree | skip-hop-decrement | |
Description | When configured to true, the system decrements the TTL of the IP packet matching the IPv4 or IPv6 filter when it is encapsulated into the GRE tunnel header. When configured to false, the system increases the TTL of the received packet. | |
Default | false | |
Introduced | 22.7.R1 | |
Platforms | All |
source-address string
Synopsis | Source IPv6 address of the GRE encapsulated | |
Context | configure filter gre-tunnel-template string ipv6 source-address string | |
Tree | source-address | |
Introduced | 22.7.R1 | |
Platforms | All |
ip-exception [filter-name] string
Synopsis | Enter the ip-exception list instance | |
Context | configure filter ip-exception string | |
Tree | ip-exception | |
Introduced | 20.10.R1 | |
Platforms | VSR |
[filter-name] string
Synopsis | Filter name | |
Context | configure filter ip-exception string | |
Tree | ip-exception | |
String Length | 1 to 64 | |
Notes | This element is part of a list key. | |
Introduced | 20.10.R1 | |
Platforms | VSR |
description string
Synopsis | Text description | |
Context | configure filter ip-exception string description string | |
Tree | description | |
String Length | 1 to 80 | |
Introduced | 20.10.R1 | |
Platforms | VSR |
entry [entry-id] number
Synopsis | Enter the entry list instance | |
Context | configure filter ip-exception string entry number | |
Tree | entry | |
Introduced | 20.10.R1 | |
Platforms | VSR |
[entry-id] number
Synopsis | ID for a match criteria and the corresponding action | |
Context | configure filter ip-exception string entry number | |
Tree | entry | |
Range | 1 to 2097151 | |
Notes | This element is part of a list key. | |
Introduced | 20.10.R1 | |
Platforms | VSR |
description string
Synopsis | Text description | |
Context | configure filter ip-exception string entry number description string | |
Tree | description | |
String Length | 1 to 80 | |
Introduced | 20.10.R1 | |
Platforms | VSR |
match
Synopsis | Enter the match context | |
Context | configure filter ip-exception string entry number match | |
Tree | match | |
Introduced | 20.10.R1 | |
Platforms | VSR |
dst-ip
address (ipv4-prefix-with-host-bits | ipv4-address)
mask string
dst-port
eq number
gt number
lt number
range
end number
start number
icmp
code number
type number
protocol (number | keyword)
src-ip
address (ipv4-prefix-with-host-bits | ipv4-address)
mask string
src-port
eq number
gt number
lt number
range
end number
start number
filter-id number
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Filter ID | |
Context | configure filter ip-exception string filter-id number | |
Tree | filter-id | |
Range | 1 to 65535 | |
Introduced | 20.10.R1 | |
Platforms | VSR |
ip-filter [filter-name] string
[filter-name] string
chain-to-system-filter boolean
Synopsis | Chain filter policy to the active IPvX system filter policy | |
Context | configure filter ip-filter string chain-to-system-filter boolean | |
Tree | chain-to-system-filter | |
Default | false | |
Introduced | 16.0.R1 | |
Platforms | All |
default-action keyword
Synopsis | Action for packets that do not match any entry | |
Context | configure filter ip-filter string default-action keyword | |
Tree | default-action | |
Default | drop | |
Options | ||
Introduced | 16.0.R1 | |
Platforms | All |
description string
Synopsis | Text description | |
Context | configure filter ip-filter string description string | |
Tree | description | |
String Length | 1 to 80 | |
Introduced | 16.0.R1 | |
Platforms | All |
embed
Synopsis | Enter the embed context | |
Context | configure filter ip-filter string embed | |
Tree | embed | |
Description | Commands in this context embed a previously defined IPv4 embedded filter policy or Hybrid OpenFlow switch instance into an exclusive, template, or system filter policy at the specified offset value. Rules derived from the BGP FlowSpec can also be embedded into template filter policies only. | |
Introduced | 16.0.R1 | |
Platforms | All |
filter [name] reference offset number
[name] reference
offset number
admin-state keyword
Synopsis | Administrative state of the embedded filter | |
Context | configure filter ip-filter string embed filter reference offset number admin-state keyword | |
Tree | admin-state | |
Default | enable | |
Options | ||
Introduced | 16.0.R1 | |
Platforms | All |
flowspec offset number
offset number
admin-state keyword
Synopsis | Administrative state of the embedded filter | |
Context | configure filter ip-filter string embed flowspec offset number admin-state keyword | |
Tree | admin-state | |
Default | enable | |
Options | ||
Introduced | 16.0.R1 | |
Platforms | All |
group number
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Interface group ID for an external configured set of flowspec rules | |
Context | configure filter ip-filter string embed flowspec offset number group number | |
Tree | group | |
Range | 0 to 16383 | |
Introduced | 16.0.R1 | |
Platforms | All |
router-instance string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Virtual router for an external configured set of flowspec rules | |
Context | configure filter ip-filter string embed flowspec offset number router-instance string | |
Tree | router-instance | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
openflow [of-switch] reference offset number
[of-switch] reference
offset number
admin-state keyword
Synopsis | Administrative state of the embedded filter | |
Context | configure filter ip-filter string embed openflow reference offset number admin-state keyword | |
Tree | admin-state | |
Default | enable | |
Options | ||
Introduced | 16.0.R4 | |
Platforms | All |
grt
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Global routing context | |
Context | configure filter ip-filter string embed openflow reference offset number grt | |
Tree | grt | |
Notes | The following elements are part of a choice: grt, system, (sap and vpls), or vprn. | |
Introduced | 16.0.R4 | |
Platforms | All |
sap reference
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | SAP context | |
Context | configure filter ip-filter string embed openflow reference offset number sap reference | |
Tree | sap | |
Reference | ||
Notes | The following elements are part of a choice: grt, system, (sap and vpls), or vprn. | |
Introduced | 16.0.R4 | |
Platforms | All |
system
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | System context | |
Context | configure filter ip-filter string embed openflow reference offset number system | |
Tree | system | |
Notes | The following elements are part of a choice: grt, system, (sap and vpls), or vprn. | |
Introduced | 16.0.R4 | |
Platforms | All |
vpls reference
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | VPLS context | |
Context | configure filter ip-filter string embed openflow reference offset number vpls reference | |
Tree | vpls | |
Reference | ||
Notes | The following elements are part of a choice: grt, system, (sap and vpls), or vprn. | |
Introduced | 16.0.R4 | |
Platforms | All |
vprn reference
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | VPRN context | |
Context | configure filter ip-filter string embed openflow reference offset number vprn reference | |
Tree | vprn | |
Reference | ||
Notes | The following elements are part of a choice: grt, system, (sap and vpls), or vprn. | |
Introduced | 16.0.R4 | |
Platforms | All |
entry [entry-id] number
[entry-id] number
action
accept
Synopsis | Accept regular routing to forward a matching packet | |
Context | configure filter ip-filter string entry number action accept | |
Tree | accept | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | All |
accept-when
Synopsis | Enable the accept-when context | |
Context | configure filter ip-filter string entry number action accept-when | |
Tree | accept-when | |
Introduced | 19.5.R1 | |
Platforms | All |
pattern
expression string
Synopsis | Pattern expression to match | |
Context | configure filter ip-filter string entry number action accept-when pattern expression string | |
Tree | expression | |
String Length | 3 to 18 | |
Notes | This element is mandatory. | |
Introduced | 19.5.R1 | |
Platforms | All |
mask string
offset-type keyword
Synopsis | Starting point reference for offset value of pattern | |
Context | configure filter ip-filter string entry number action accept-when pattern offset-type keyword | |
Tree | offset-type | |
Options | ||
Notes | This element is mandatory. | |
Introduced | 19.5.R1 | |
Platforms | All |
offset-value number
Synopsis | Offset value for the pattern expression | |
Context | configure filter ip-filter string entry number action accept-when pattern offset-value number | |
Tree | offset-value | |
Range | 0 to 255 | |
Notes | This element is mandatory. | |
Introduced | 19.5.R1 | |
Platforms | All |
drop
Synopsis | Drop a packet matching this entry | |
Context | configure filter ip-filter string entry number action drop | |
Tree | drop | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | All |
drop-when
extracted-traffic
Synopsis | Drop traffic extracted to CPM | |
Context | configure filter ip-filter string entry number action drop-when extracted-traffic | |
Tree | extracted-traffic | |
Introduced | 16.0.R1 | |
Platforms | All |
packet-length
Synopsis | Enable the packet-length context | |
Context | configure filter ip-filter string entry number action drop-when packet-length | |
Tree | packet-length | |
Notes | The following elements are part of a choice: packet-length or ttl. | |
Introduced | 16.0.R1 | |
Platforms | All |
eq number
gt number
lt number
range
end number
start number
pattern
expression string
Synopsis | Pattern expression to match | |
Context | configure filter ip-filter string entry number action drop-when pattern expression string | |
Tree | expression | |
String Length | 3 to 18 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R4 | |
Platforms | All |
mask string
offset-type keyword
Synopsis | Starting point reference for offset value of pattern | |
Context | configure filter ip-filter string entry number action drop-when pattern offset-type keyword | |
Tree | offset-type | |
Options | ||
Notes | This element is mandatory. | |
Introduced | 16.0.R4 | |
Platforms | All |
offset-value number
Synopsis | Offset value for the pattern expression | |
Context | configure filter ip-filter string entry number action drop-when pattern offset-value number | |
Tree | offset-value | |
Range | 0 to 255 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R4 | |
Platforms | All |
ttl
eq number
gt number
lt number
range
Synopsis | Enable the range context | |
Context | configure filter ip-filter string entry number action drop-when ttl range | |
Tree | range | |
Description | This command in this context specify an inclusive range. When range is used, the start of the range (the first value entered) must be smaller than the end of the range (the second value entered). | |
Notes | The following elements are part of a mandatory choice: eq, gt, lt, or range. | |
Introduced | 16.0.R1 | |
Platforms | All |
end number
start number
fc keyword
forward
Synopsis | Enter the forward context | |
Context | configure filter ip-filter string entry number action forward | |
Tree | forward | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | All |
bonding-connection number
Synopsis | Connection ID over which packet is forwarded | |
Context | configure filter ip-filter string entry number action forward bonding-connection number | |
Tree | bonding-connection | |
Range | 1 to 2 | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR |
esi-l2
Synopsis | Enable the esi-l2 context | |
Context | configure filter ip-filter string entry number action forward esi-l2 | |
Tree | esi-l2 | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
esi-value string
vpls reference
esi-l3
Synopsis | Enable the esi-l3 context | |
Context | configure filter ip-filter string entry number action forward esi-l3 | |
Tree | esi-l3 | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
esi-value string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | ESI of the first ESI-identified appliance | |
Context | configure filter ip-filter string entry number action forward esi-l3 esi-value string | |
Tree | esi-value | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
sf-ip string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | IP address of the service function to forward traffic | |
Context | configure filter ip-filter string entry number action forward esi-l3 sf-ip string | |
Tree | sf-ip | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
vas-interface reference
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Egress R-VPLS IP interface name | |
Context | configure filter ip-filter string entry number action forward esi-l3 vas-interface reference | |
Tree | vas-interface | |
Reference | ||
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
vprn reference
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | VPRN service name | |
Context | configure filter ip-filter string entry number action forward esi-l3 vprn reference | |
Tree | vprn | |
Reference | ||
Notes | This element is mandatory. | |
Introduced | 16.0.R4 | |
Platforms | All |
gre-tunnel reference
Synopsis | GRE tunnel template ID that sets the location where an encapsulated matching packet is transported | |
Context | configure filter ip-filter string entry number action forward gre-tunnel reference | |
Tree | gre-tunnel | |
Reference | configure filter gre-tunnel-template string | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
lsp string
Synopsis | LSP that is specified to forward a packet matching this entry | |
Context | configure filter ip-filter string entry number action forward lsp string | |
Tree | lsp | |
String Length | 1 to 64 | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
mpls-policy
Synopsis | Enable the mpls-policy context | |
Context | configure filter ip-filter string entry number action forward mpls-policy | |
Tree | mpls-policy | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 19.10.R1 | |
Platforms | All |
endpoint string
next-hop
Synopsis | Enable the next-hop context | |
Context | configure filter ip-filter string entry number action forward next-hop | |
Tree | next-hop | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
interface-name string
Synopsis | IP interface name that forwards matching packets | |
Context | configure filter ip-filter string entry number action forward next-hop interface-name string | |
Tree | interface-name | |
String Length | 1 to 32 | |
Notes | The following elements are part of a mandatory choice: interface-name, nh-ip, or nh-ip-vrf. | |
Introduced | 16.0.R1 | |
Platforms | All |
nh-ip
address string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | IPv4 address of next hop to forward matching packets | |
Context | configure filter ip-filter string entry number action forward next-hop nh-ip address string | |
Tree | address | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
indirect boolean
nh-ip-vrf
address string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | IPv4 address of next hop to forward matching packets | |
Context | configure filter ip-filter string entry number action forward next-hop nh-ip-vrf address string | |
Tree | address | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
indirect boolean
router-instance string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Routing context for route lookup for forwarding packets | |
Context | configure filter ip-filter string entry number action forward next-hop nh-ip-vrf router-instance string | |
Tree | router-instance | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
redirect-policy reference
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Next hop or forward next hop router that forwards a packet that matches this entry | |
Context | configure filter ip-filter string entry number action forward redirect-policy reference | |
Tree | redirect-policy | |
Reference | configure filter redirect-policy string | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
router-instance string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Router name or VPRN service name | |
Context | configure filter ip-filter string entry number action forward router-instance string | |
Tree | router-instance | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
sap
Synopsis | Enable the sap context | |
Context | configure filter ip-filter string entry number action forward sap | |
Tree | sap | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
sap-id reference
vpls reference
sdp
Synopsis | Enable the sdp context | |
Context | configure filter ip-filter string entry number action forward sdp | |
Tree | sdp | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
sdp-bind-id string
Synopsis | VPLS SDP bind ID used to forward matching packets | |
Context | configure filter ip-filter string entry number action forward sdp sdp-bind-id string | |
Tree | sdp-bind-id | |
String Length | 3 to 16 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
vpls reference
srte-policy
Synopsis | Enable the srte-policy context | |
Context | configure filter ip-filter string entry number action forward srte-policy | |
Tree | srte-policy | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 19.10.R1 | |
Platforms | All |
color number
endpoint string
vprn-target
Synopsis | Enable the vprn-target context | |
Context | configure filter ip-filter string entry number action forward vprn-target | |
Tree | vprn-target | |
Notes | The following elements are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target. | |
Introduced | 16.0.R1 | |
Platforms | All |
adv-prefix string
Synopsis | Advertised IP prefix for target destination | |
Context | configure filter ip-filter string entry number action forward vprn-target adv-prefix string | |
Tree | adv-prefix | |
Introduced | 16.0.R1 | |
Platforms | All |
bgp-nh string
lsp string
vprn reference
gtp-local-breakout
Synopsis | Break out matching traffic locally from a GTP tunnel for GTP-subscriber-hosts, or forward for other entities | |
Context | configure filter ip-filter string entry number action gtp-local-breakout | |
Tree | gtp-local-breakout | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | 7750 SR, 7750 SR-e, 7750 SR-s, VSR |
http-redirect
Synopsis | Enable the http-redirect context | |
Context | configure filter ip-filter string entry number action http-redirect | |
Tree | http-redirect | |
Description | Commands in this context configure the filter entry action for HTTP redirection. | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | All |
allow-override boolean
Synopsis | Override the HTTP redirect URL by a RADIUS VSA | |
Context | configure filter ip-filter string entry number action http-redirect allow-override boolean | |
Tree | allow-override | |
Description | This command specifies whether the RADIUS VSA can override the configured HTTP redirect URL for this filter entry. When configured to true, the RADIUS VSA can override the HTTP redirect URL. When configured to false, the HTTP redirect URL is not overriden. This does not apply if the CPF option is specified for the URL. | |
Default | false | |
Introduced | 16.0.R1 | |
Platforms | All |
url (keyword | http-redirect-url)
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | URL used for HTTP redirect action | |
Context | configure filter ip-filter string entry number action http-redirect url (keyword | http-redirect-url) | |
Tree | url | |
Description | This command specifies the URL to use for HTTP redirection for this filter entry. A URL can be specified or the CPF option can be used for BNG CUPS ESM sessions only. The following macro substitutions may be used: $URL — request-URI in the HTTP GET request received $MAC — a string that represents the MAC address of the subscriber host $IP — a string that represents the IP address of the subscriber host $SUB — a string that represents the subscriber ID $SAP — a string that represents a SAP ID $SAPDESC — description string configured on the SAP $CID — a string that represents the circuit ID or interface ID of the subscriber host (hexadecimal format) $RID — a string that represents the remote ID of the subscriber host (hexadecimal format) | |
String Length | 1 to 255 | |
Options | ||
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
ignore-match
Synopsis | Ignore match criteria for the entry | |
Context | configure filter ip-filter string entry number action ignore-match | |
Tree | ignore-match | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | All |
l2-aware-nat-bypass boolean
Synopsis | Divert traffic from an L2-Aware NAT subscriber | |
Context | configure filter ip-filter string entry number action l2-aware-nat-bypass boolean | |
Tree | l2-aware-nat-bypass | |
Description | When configured to true, the filter action selectively diverts traffic from a L2-Aware NAT subscriber away from NAT. This action is only applicable to L2-Aware NAT subscribers and must be configured together with action accept. Traffic identified in the match condition bypasses L2-Aware NAT. An example is to bypass NAT for on-net destinations (within the customer network). For selective NAT bypass to take effect, in addition to IP filter configuration, the L2-Aware NAT subscriber must be specifically enabled for selective bypass via the allow-bypass configuration option in the configure subscriber-mgmt sub-profile nat allow-bypass context. When configured to false, traffic that is not classified for bypass automatically diverts to L2-Aware NAT, unless it is explicitly configured in the IP filter action to be dropped. | |
Default | false | |
Introduced | 20.5.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR |
nat
Synopsis | Enable the nat context | |
Context | configure filter ip-filter string entry number action nat | |
Tree | nat | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR |
nat-policy reference
WARNING: Modifying this element clears ISA state, such as flow state, for the new value to take effect. | ||
Synopsis | NAT policy name when action is NAT | |
Context | configure filter ip-filter string entry number action nat nat-policy reference | |
Tree | nat-policy | |
Reference | configure service nat nat-policy string | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR |
rate-limit
Synopsis | Enable the rate-limit context | |
Context | configure filter ip-filter string entry number action rate-limit | |
Tree | rate-limit | |
Introduced | 16.0.R1 | |
Platforms | All |
extracted-traffic
Synopsis | Limit the rate of traffic extracted to the CPM | |
Context | configure filter ip-filter string entry number action rate-limit extracted-traffic | |
Tree | extracted-traffic | |
Introduced | 22.2.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS |
packet-length
Synopsis | Enable the packet-length context | |
Context | configure filter ip-filter string entry number action rate-limit packet-length | |
Tree | packet-length | |
Notes | The following elements are part of a choice: packet-length or ttl. | |
Introduced | 16.0.R1 | |
Platforms | All |
eq number
Synopsis | Exact match criterion for the length | |
Context | configure filter ip-filter string entry number action rate-limit packet-length eq number | |
Tree | eq | |
Range | 0 to 65535 | |
Notes | The following elements are part of a mandatory choice: eq, gt, lt, or range. | |
Introduced | 16.0.R1 | |
Platforms | All |
gt number
Synopsis | Greater than match criterion for the length | |
Context | configure filter ip-filter string entry number action rate-limit packet-length gt number | |
Tree | gt | |
Range | 0 to 65534 | |
Notes | The following elements are part of a mandatory choice: eq, gt, lt, or range. | |
Introduced | 16.0.R1 | |
Platforms | All |
lt number
Synopsis | Less than match criterion for the length | |
Context | configure filter ip-filter string entry number action rate-limit packet-length lt number | |
Tree | lt | |
Range | 1 to 65535 | |
Notes | The following elements are part of a mandatory choice: eq, gt, lt, or range. | |
Introduced | 16.0.R1 | |
Platforms | All |
range
Synopsis | Enable the range context | |
Context | configure filter ip-filter string entry number action rate-limit packet-length range | |
Tree | range | |
Notes | The following elements are part of a mandatory choice: eq, gt, lt, or range. | |
Introduced | 16.0.R1 | |
Platforms | All |
end number
Synopsis | Upper bound of the length range | |
Context | configure filter ip-filter string entry number action rate-limit packet-length range end number | |
Tree | end | |
Range | 1 to 65535 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
start number
Synopsis | Lower bound of the length range | |
Context | configure filter ip-filter string entry number action rate-limit packet-length range start number | |
Tree | start | |
Range | 0 to 65534 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
pattern
expression string
Synopsis | Pattern expression to match | |
Context | configure filter ip-filter string entry number action rate-limit pattern expression string | |
Tree | expression | |
String Length | 3 to 18 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R4 | |
Platforms | All |
mask string
offset-type keyword
Synopsis | Starting point reference for offset value of pattern | |
Context | configure filter ip-filter string entry number action rate-limit pattern offset-type keyword | |
Tree | offset-type | |
Options | ||
Notes | This element is mandatory. | |
Introduced | 16.0.R4 | |
Platforms | All |
offset-value number
Synopsis | Offset value for the pattern expression | |
Context | configure filter ip-filter string entry number action rate-limit pattern offset-value number | |
Tree | offset-value | |
Range | 0 to 255 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R4 | |
Platforms | All |
pir (number | keyword)
pps-pir (number | keyword)
Synopsis | Peak information rate | |
Context | configure filter ip-filter string entry number action rate-limit pps-pir (number | keyword) | |
Tree | pps-pir | |
Range | 0 to 100000000 | |
Units | packets per second | |
Options | ||
Notes | The following elements are part of a mandatory choice: pir or pps-pir. | |
Introduced | 22.10.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, 7950 XRS |
ttl
eq number
gt number
lt number
range
Synopsis | Enable the range context | |
Context | configure filter ip-filter string entry number action rate-limit ttl range | |
Tree | range | |
Description | This command in this context specify an inclusive range. When range is used, the start of the range (the first value entered) must be smaller than the end of the range (the second value entered). | |
Notes | The following elements are part of a mandatory choice: eq, gt, lt, or range. | |
Introduced | 16.0.R1 | |
Platforms | All |
end number
start number
reassemble
Synopsis | Forward matching packets to reassembly function | |
Context | configure filter ip-filter string entry number action reassemble | |
Tree | reassemble | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR |
remark
dscp keyword
secondary
forward
next-hop
nh-ip-vrf
address string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | IPv4 address of next hop to forward matching packets | |
Context | configure filter ip-filter string entry number action secondary forward next-hop nh-ip-vrf address string | |
Tree | address | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
indirect boolean
router-instance string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | Routing context for route lookup for forwarding packets | |
Context | configure filter ip-filter string entry number action secondary forward next-hop nh-ip-vrf router-instance string | |
Tree | router-instance | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
sap
sap-id reference
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | SAP ID used to forward packets matching the entry | |
Context | configure filter ip-filter string entry number action secondary forward sap sap-id reference | |
Tree | sap-id | |
Reference | ||
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
vpls reference
sdp
sdp-bind-id string
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | VPLS SDP bind ID used to forward matching packets | |
Context | configure filter ip-filter string entry number action secondary forward sdp sdp-bind-id string | |
Tree | sdp-bind-id | |
String Length | 3 to 16 | |
Notes | This element is mandatory. | |
Introduced | 16.0.R1 | |
Platforms | All |
vpls reference
vprn-target
Synopsis | Enable the vprn-target context | |
Context | configure filter ip-filter string entry number action secondary forward vprn-target | |
Tree | vprn-target | |
Notes | The following elements are part of a choice: next-hop, sap, sdp, or vprn-target. | |
Introduced | 21.7.R1 | |
Platforms | All |
adv-prefix string
Synopsis | Advertised IP prefix for the target destination | |
Context | configure filter ip-filter string entry number action secondary forward vprn-target adv-prefix string | |
Tree | adv-prefix | |
Introduced | 21.7.R1 | |
Platforms | All |
bgp-nh string
lsp string
vprn reference
remark
dscp keyword
tcp-mss-adjust
Synopsis | Adjust MSS option of TCP matching packets to configured value of tcp-mss in router interface context | |
Context | configure filter ip-filter string entry number action tcp-mss-adjust | |
Tree | tcp-mss-adjust | |
Notes | The following elements are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust. | |
Introduced | 16.0.R1 | |
Platforms | 7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR |
description string
Synopsis | Text description | |
Context | configure filter ip-filter string entry number description string | |
Tree | description | |
String Length | 1 to 80 | |
Introduced | 16.0.R1 | |
Platforms | All |
egress-pbr keyword
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
Synopsis | PBR that has an effect when this filter is applied on egress | |
Context | configure filter ip-filter string entry number egress-pbr keyword | |
Tree | egress-pbr | |
Options | ||
Introduced | 16.0.R1 | |
Platforms | All |
filter-sample boolean
Synopsis | Sample matching traffic if IP interface is set to cflowd ACL mode | |
Context | configure filter ip-filter string entry number filter-sample boolean | |
Tree | filter-sample | |
Default | false | |
Introduced | 16.0.R1 | |
Platforms | All |
interface-sample boolean
Synopsis | Sample matching traffic if IP interface is set to cflowd interface mode | |
Context | configure filter ip-filter string entry number interface-sample boolean | |
Tree | interface-sample | |
Default | true | |
Introduced | 16.0.R1 | |
Platforms | All |
log reference
match
Synopsis | Enter the match context | |
Context | configure filter ip-filter string entry number match | |
Tree | match | |
Description | Commands in this context configure match criteria for the filter entry. When the match criteria are satisfied, the action associated with the match criteria is executed. | |
Introduced | 16.0.R1 | |
Platforms | All |
destination-class number
Synopsis | Destination class as a match criterion | |
Context | configure filter ip-filter string entry number match destination-class number | |
Tree | destination-class | |
Description | This command configures the BGP destination class value as a match criterion. Filtering egress traffic on the destination class requires the destination-class-lookup command (under the ingress context for the service interface) to be enabled (set to true). | |
Range | 1 to 255 | |
Introduced | 20.7.R1 | |
Platforms | All |
dscp keyword
dst-ip
address (ipv4-prefix-with-host-bits | ipv4-address)
ip-prefix-list reference
Synopsis | IP4 address prefix list used as match criterion | |
Context | configure filter ip-filter string entry number match dst-ip ip-prefix-list reference | |
Tree | ip-prefix-list | |
Reference | configure filter match-list ip-prefix-list string | |
Notes | The following elements are part of a choice: (address and mask) or ip-prefix-list. | |
Introduced | 16.0.R1 | |
Platforms | All |
mask string
dst-port
eq number
gt number
lt number
port-list reference
Synopsis | Name of the port list as the match criterion | |
Context | configure filter ip-filter string entry number match dst-port port-list reference | |
Tree | port-list | |
Reference | configure filter match-list port-list string | |
Notes | The following elements are part of a choice: eq, gt, lt, port-list, or range. | |
Introduced | 16.0.R1 | |
Platforms | All |