3.4. Configuring Filter Policies with CLI
This section provides information to configure filter policies using the CLI.
3.5. Basic Configuration
The most basic IP and MAC filter policies must have the following:
- a filter ID
- template scope, either exclusive or template
- default action, either drop or forward
- at least one filter entry
- specified action, either drop or forward
- specified matching criteria
- allocates the required amount of resources for ingress and egress filter policies
The following is a sample configuration output of allocation of ingress internal CAM resources for ingress policy for 7210 SAS-D.
The following is a sample configuration output of allocation of egress internal CAM resources for egress policy for 7210 SAS-D.
The following is a sample configuration output of an IP filter policy. The configuration blocks all incoming TCP session except Telnet and allows all outgoing TCP sessions from IP net 10.67.132.0/24. CAM resources must be allocated to IPv4 criteria before associating the filter with a SAP. Figure 6 shows the interface to apply the filter.
Figure 6 shows the IP filter applied to an ingress interface.
Figure 6: Applying an IP Filter to an Ingress Interface
3.6. Common Configuration Tasks
This section provides a brief overview of the tasks that must be performed for both IP and MAC filter configurations and provides the CLI commands.
3.6.1. Allocating Resources for Filter Policies (Ingress and Egress)
The following provides an example of allocation of CAM hardware resources for use with filter policies that use IPv4 and MAC criteria:
3.6.2. Creating an IP Filter Policy
Configuring and applying filter policies is optional. Each filter policy must have the following:
- the filter type specified (IP)
- a filter policy ID
- a default action
- filter policy scope specified, either exclusive or template
- at least one filter entry with matching criteria specified
- configure CAM hardware resource for use by the filter policy match-criteria
3.6.2.1. IP Filter Policy
The following is a sample exclusive filter policy configuration output.
3.6.2.2. IP Filter Entry
Within a filter policy, configure filter entries which contain criteria against which ingress, egress, or network traffic is matched. The action specified in the entry determine how the packets are handled, either dropped or forwarded.
- Enter a filter entry ID. The system does not dynamically assign a value.
- Assign an action, either drop or forward.
- Specify matching criteria.
Use the following syntax to create an IP filter entry.
The following is a sample IP filter entry configuration output.
3.6.2.3. IP Entry Matching Criteria
Use the following syntax to configure IP filter matching criteria:
The following is a sample IP filter matching configuration output.
3.6.3. Creating an IPv6 Filter Policy (applicable only for 7210 SAS-D and 7210 SAS-Dxp)
Configuring and applying IPv6 filter policies is optional. Each filter policy must have the following:
- The IPv6 filter type specified.
- An IPv6 filter policy ID.
- A default action, either drop or forward.
- Template scope specified, either exclusive or template.
- At least one filter entry with matching criteria specified.
3.6.3.1. IPv6 Filter Entry
Within an IPv6 filter policy, configure filter entries which contain criteria against which ingress, egress, or network traffic is matched. The action specified in the entry determine how the packets are handled, either dropped or forwarded.
- Enter an IPv6 filter entry ID. The system does not dynamically assign a value.
- Assign an action, either drop or forward.
- Specify matching criteria.
The following is a sample IPv6 filter entry configuration output.
3.6.4. Creating a MAC Filter Policy
Configuring and applying filter policies is optional. Each filter policy must have the following:
- The filter type specified (MAC).
- A filter policy ID.
- A default action, either drop or forward.
- Filter policy scope, either exclusive or template.
- At least one filter entry.
- Matching criteria specified.
3.6.4.1. MAC Filter Policy
The following is a sample MAC filter policy configuration output.
3.6.4.2. MAC Filter Entry
Within a filter policy, configure filter entries which contain criteria against which ingress, egress, or network traffic is matched. The action specified in the entry determine how the packets are handled, either dropped or forwarded.
- Enter a filter entry ID. The system does not dynamically assign a value.
- Assign an action, either drop or forward.
- Specify matching criteria.
The following displays a MAC filter entry configuration output.
3.6.4.3. MAC Entry Matching Criteria
The following is a sample filter matching configuration output.
3.6.4.4. Apply IP and MAC Filter Policies
The following example shows an example of applying an IP and a MAC filter policy to an Epipe service:
The following is a sample output for IP and MAC filters assigned to an ingress and egress SAP.
3.6.4.5. Apply Filter Policies to an IES Interface
IP filter policies can be applied to an IP interface created in an IES service. These filter policies apply to the routed management traffic.
The following is a sample output for an IP filter applied to an IES sap at ingress.
3.7. Filter Management Tasks
This section discusses the filter policy management tasks.
3.7.1. Renumbering Filter Policy Entries
The system exits the matching process when the first match is found and then executes the actions in accordance with the specified action. Because the ordering of entries is important, the numbering sequence can be rearranged. Entries should be numbered from the most explicit to the least explicit.
Use the following syntax to renumber existing MAC or IP filter entries to re-sequence filter entries.
The following is a sample original filter entry order on the left side and the reordered filter entries on the right side.
A:ALA-7>config>filter# info ---------------------------------------------- ... ip-filter 11 create description "filter-main" scope exclusive entry 10 create description "no-91" match dst-ip 10.10.10.91/24 src-ip 10.10.10.103/24 exit action forward exit entry 20 create match dst-ip 10.10.10.91/24 src-ip 10.10.0.100/24 exit action drop exit entry 30 create match dst-ip 10.10.10.91/24 src-ip 10.10.0.200/24 exit action forward exit entry 40 create match dst-ip 10.10.10.91/24 src-ip 10.10.10.106/24 exit action drop exit exit ... ---------------------------------------------- A:ALA-7>config>filter# | A:ALA-7>config>filter# info ---------------------------------------------- ... ip-filter 11 create description "filter-main" scope exclusive entry 1 create match dst-ip 10.10.10.91/24 src-ip 10.10.10.106/24 exit action drop exit entry 10 create match dst-ip 10.10.10.91/24 src-ip 10.10.0.100/24 exit action drop exit entry 15 create description "no-91" match dst-ip 10.10.10.91/24 src-ip 10.10.10.103/24 exit action forward exit entry 30 create match dst-ip 10.10.10.91/24 src-ip 10.10.0.200/24 exit action forward exit exit ... ---------------------------------------------- A:ALA-7>config>filter# |
3.7.2. Modifying an IP Filter Policy
To access a specific IP filter, you must specify the filter ID. Use the no form of this command to remove the command parameters or return the parameter to the default setting.
The following is a sample modified IP filter output.
3.7.3. Modifying a MAC Filter Policy
To access a specific MAC filter, you must specify the filter ID. Use the no form of this command to remove the command parameters or return the parameter to the default setting.
The following is a sample modified MAC filter output.
3.7.4. Deleting a Filter Policy
Before you can delete a filter, you must remove the filter association from the applied ingress and egress SAPs and network interfaces.
3.7.4.1. From an Ingress SAP
Use the following syntax to remove a filter from an ingress SAP.
3.7.4.2. From an Egress SAP
Use the following syntax to remove a filter from an egress SAP.
3.7.4.3. From the Filter Configuration
Use the following syntax to delete the filter after you have removed the filter from the SAP.
3.7.5. Copying Filter Policies
When changes are made to an existing filter policy, they are applied immediately to all services where the policy is applied. If numerous changes are required, the policy can be copied so you can edit the “work in progress” version without affecting the filtering process. When the changes are completed, you can overwrite the work in progress version with the original version.
New filter policies can also be created by copying an existing policy and renaming the new filter.
The following shows command usage to copy an existing IP filter (11) to create a new filter policy (12).