Traffic steering using match-action policies

Note: Match-action policies are supported on 7250 IXR Gen 3 systems.

A match-action policy allows you to configure IPv4/IPv6 ACL policies, QoS classifier policies, and policy-based routing (PBR) policies in a unified model, with all three policy types configured as rules in a single policy.

In this unified model, only a single match-action policy needs to be applied on each interface. The rules in a match-action policy can mix actions typically associated with ACLs (drop, count, and so on), actions typically associated with QoS multi-field classification (assign forwarding class) and actions typically associated with a PBR policy (apply tunnel encapsulation, redirect to next-hop/next-hop-group, and so on).

Match-action policies can coexist with separately configured traffic steering policies. See Traffic steering flow for ingress packets for an illustration of how each policy type is evaluated for ingress packets.

Match-action policy rules are not evaluated against terminating tunnel packets (MPLS/VXLAN/UDP/GRE/IP-in-IP) that arrive on the routed subinterface where the policy is applied.

SR Linux does not support configuration of both match-action and interface ingress ACLs in the system. This means that binding an IPv4, IPv6, MAC ACL policy to input traffic on any subinterface in the system is blocked if there is a match-action policy defined (with any combination of IPv4/IPv6 rules), and the match-action policy is already bound to any subinterface. Similarly, binding a match-action policy (with any combination of IPv4/IPv6 rules) to any subinterface in the system is blocked if there is an IPv4, IPv6 or MAC ACL policy defined, and the ACL is already bound to any subinterface (same or different) for input traffic filtering in the system.

To switch from using interface ingress ACLs to match-action policies or vice versa, you must delete the bindings of the one type before binding the new type.

Mixing IPv4 and IPv6 rules in one match-action policy

A single match-action policy applied to a subinterface can affect the forwarding of both IPv4 and IPv6 packets, but each rule within the policy applies only to IPv4 packets or only to IPv6 packets, not both. Configuring the address-family scope of each rule is mandatory; it must be explicitly configured using network-instance.policy-forwarding.policy.rule.match.address-family and is never inferred from the match conditions present in the rule.

If a match-action policy rule has address-family ipv4 and no other match conditions, then it is assumed to match all IPv4 packets. If a rule has address-family ipv6 and no other match conditions, then it is assumed to match all IPv6 packets.

See Configure forwarding action policy for IPv4/IPv6 traffic for an example configuration.

Counters for match-action policies

7250 IXR Gen 3 systems support policy counters, which refer to the number of unique counter-names configured across all match-action policies in all network-instances. Each of these policy counters supports packet and byte counts.

A named policy counter is referenced when at least one match-action policy rule uses it through configuration of network-instance.policy-forwarding.policy.rule.action.count.counter-name. On each referenced-to-unreferenced transition, the reported packet and octet counts are reset to zero. Values are not retained while the counter remains configured but unused. If a match-action policy rule later references the same counter name, counting restarts from zero.

See Configure counter for dropped packets for an example configuration.

Match conditions for match-action policies

The following table lists the match conditions that can be specified in a match-action policy.

Table 1. Match conditions for match-action policies
Container	Match condition	Description
`address-family`¹	`ipv4`	Limit match conditions for the rule to those under the `ipv4` container.
`address-family`¹	`ipv6`	Limit match conditions for the rule to those under the `ipv6` container.
`ipv4`	`next-hop-group-id`	Match IPv4 packets that are forwarded by a route that uses the referenced next-hop group. A next-hop group must be viable to be matched.
	`next-hop-group-network-instance`	The search scope (network-instance of the `next-hop-group-id`. If not specified, the search scope is the same as the network-instance where the policy is defined.
	`protocol`	An IPv4 packet matches this condition if its IP protocol type field matches the specified value.
	`dscp-set`	An IPv4 packet matches this condition if its DSCP value matches any of the values in the specified list.
	`destination-ip.prefix`	An IPv4 packet matches this condition if its destination IP address is covered by the specified prefix.
	`destination-ip.prefix-list`	An IPv4 packet matches this condition if its IPv4 destination address is covered by a prefix in the specified prefix list. This is a reference to a prefix list configured under `acl.match-list.ipv4-prefix-list`.
	`ttl`	An IPv4 packet matches this condition if its IPv4 TTL matches this value. Only the value 1 can be matched.
	`icmp.type`	An IPv4 packet matches this condition if its ICMP type matches this value.
	`icmp.code`	An IPv4 packet matches this condition if its ICMP code matches one of the values in this list.
`ipv6`	`next-hop-group-id`	Match IPv6 packets that are forwarded by a route that uses the referenced next-hop group. A next-hop group must be viable to be matched.
	`next-hop-group-network-instance`	The search scope (network-instance of the `next-hop-group-id`. If not specified, the search scope is the same as the network-instance where the policy is defined.
	`next-header`	An IPv6 packet matches this condition if its first `next-header` field matches the specified value.
	`dscp-set`	An IPv6 packet matches this condition if its `traffic-class` value matches any of the values in the specified list.
	`destination-ip.prefix`	An IPv6 packet matches this condition if its destination IP address is covered by the specified prefix.
	`hop-limit`	An IPv6 packet matches this condition if its IPv6 hop-limit matches this value. Only the value 1 can be matched.
	`icmp6.type`	An IPv6 packet matches this condition if its ICMPv6 type matches this value.
	`icmp6.code`	An IPv6 packet matches this condition if its ICMPv6 code matches one of the values in this list.
`transport`	`source-port`	An IPv4 packet matches this condition if its transport source port matches the specified port number, name, or port number range. The match condition for `ipv4.protocol` or `ipv6.next-header` must be configured as `tcp` or `udp`.
`transport`	`destination-port`	A packet matches this condition if its transport destination port matches the specified port number, name, or port number range. The match condition for `ipv4.protocol` or `ipv6.next-header` must be configured as `tcp` or `udp`.

¹ If address-family is not specified, match conditions can be configured under both the ipv4 and ipv6 containers simultaneously.

Actions for match-action policies

The following table lists the actions you can specify in a match-action policy.

Table 2. Actions for match-action policies
Action	Description
`count.counter-name`	Count matching packets using a counter with a specified name. This is a reference to a counter configured under `network-instance.policy-forwarding.policy.counter`.
`forwarding-action`	Apply one of the following forwarding actions to matching packets: `accept` – Accept matching packets `drop` – Drop matching packets `reject` – Reject matching packets and send one of the ICMP unreachable message types: For ICMPv4: type 3 (destination unreachable), code 13 (communication administratively prohibited) For ICMPv6: type 1 (destination unreachable), code 1 (communication administratively prohibited)
`next-hop-group`	Forward according to the specified next-hop group. If the next-hop group has no viable members, the traffic is dropped. This is a reference to a next-hop group configured under `network-instance.static.next-hop-group`.
`ipv4-ttl`	Set the IPv4 TTL to 2, so that after the forwarding decrement it is equal to 1; only supported when `address-family ipv4` is configured for the rule.
`ipv6-hop-limit`	Set the IPv6 hop-limit to 2, so that after the forwarding decrement it is equal to 1; only supported when `address-family ipv6` is configured for the rule.
`policer`	Rate limit matching packets by metering them through the specified policer. This is a reference to a policer configured under `qos.policers.policer`.
`forwarding-class`	Associate matching packets with the specified forwarding-class. This is a reference to a forwarding class configured under `qos.forwarding-classes.forwarding-class`.