Creating a match-action policy

Configure forwarding action policy for IPv4/IPv6 traffic

The following example configures a match-action policy consisting of a rule that accepts IPv4 packets and a rule that drops IPv6 packets.

--{ + candidate shared default }--[  ]--
# info with-context network-instance default policy-forwarding policy ma1
    network-instance default {
        policy-forwarding {
            policy ma1 {
                type match-action
                rule 100 {
                    action {
                        forwarding-action accept
                    }
                    match {
                        address-family ipv4
                    }
                }
                rule 101 {
                    action {
                        forwarding-action drop
                    }
                    match {
                        address-family ipv6
                    }
                }
            }
        }
    }

Rate limit IPv4 traffic with a destination specified in a prefix list

The following example defines an IPv4 prefix list and an QoS policer. A match-action policy is configured so that IPv4 traffic with a destination address covered by a prefix in the prefix list is rate-limited according to the QoS policer.

--{ + candidate shared default }--[  ]--
# info with-context acl match-list ipv4-prefix-list plist1
    acl {
        match-list {
            ipv4-prefix-list plist1 {
                prefix 192.168.1.0/24 {
                }
                prefix 192.168.2.1/32 {
                }
            }
        }
    }

--{ + candidate shared default }--[  ]--
# info with-context qos policers policer qp1
    qos {
        policers {
            policer qp1 {
                type two-rate-three-color
                color-aware-mode false
                two-rate-three-color {
                    committed-rate 100000
                    committed-burst-size 10000
                    peak-rate 300000
                    excess-burst-size 200000
                }
            }
        }
    }

--{ + candidate shared default }--[  ]--
# info with-context network-instance default policy-forwarding policy ma2
    network-instance default {
        policy-forwarding {
            policy ma2 {
                type match-action
                rule 101 {
                    action {
                        policer qp1
                    }
                    match {
                        address-family ipv4
                        ipv4 {
                            destination-ip {
                                prefix-list plist1
                            }
                        }
                    }
                }
            }
        }
    }

Forward matching traffic to a next-hop group

In the following example, IPv4 packets forwarded by next-hop-group ID=1 in network-instance red that have a TTL of 1 are assigned a TTL of 2 and forwarded to next-hop-group nhg1 in the default network-instance.

--{ + candidate shared default }--[  ]--
# info with-context network-instance default static next-hop-group nhg1
    network-instance default {
        static {
            next-hop-group nhg1 {
                next-hop 1 {
                }
                next-hop 2 {
                }
            }
        }
    }

--{ + candidate shared default }--[  ]--
# info with-context network-instance default policy-forwarding policy ma3
    network-instance default {
        policy-forwarding {
            policy ma3 {
                type match-action
                rule 101 {
                    action {
                        next-hop-group nhg1
                        ipv4-ttl 2
                    }
                    match {
                        address-family ipv4
                        ipv4 {
                            next-hop-group-id 1
                            next-hop-group-network-instance red
                            ttl 1
                        }
                    }
                }
            }
        }
    }

Configure counter for dropped packets

The following example configures a match-action policy with a counter for dropped packets. The dropped-packets counter is configured as the action in the policy, so it is incremented for each dropped IPv4 packet.

--{ + candidate shared default }--[  ]--
# info with-context network-instance default policy-forwarding policy ma4
    network-instance default {
        policy-forwarding {
            policy ma4 {
                type match-action
                counter dropped-packets {
                }
                rule 101 {
                    action {
                        forwarding-action drop
                        count {
                            counter-name dropped-packets
                        }
                    }
                    match {
                        address-family ipv4
                    }
                }
            }
        }
    }

Use the info from state command to display the counter statistics; for example:

--{ + candidate shared default }--[  ]--
# info from state with-context network-instance default policy-forwarding policy ma4 counter dropped-packets
    network-instance default {
        policy-forwarding {
            policy ma4 {
                counter dropped-packets {
                    total-packets 12254
                    total-octets 14753816
                }
            }
        }
    }

When a counter is no longer referenced in any match-action policy rule, it is reset to zero.