Filter Command Reference

This command creates a text description for a configuration context to help identify the content in the configuration file.

The no form of the command removes any description string from the context.

The shutdown command administratively disables the entity. The operational state of the entity is disabled as well as the operational state of any entities contained within. When disabled, an entity does not change, reset, or remove any configuration settings or statistics. Many objects must be shut down before they may be deleted. Many entities must be explicitly enabled using the no shutdown command.

Unlike other commands and parameters where the default state is not indicated in the configuration file, shutdown and no shutdown are always indicated in system-generated configuration files.

The no form of the command puts an entity into the administratively enabled state.

This command enables the context to create a filter log policy.

The no form of the command deletes the filter log ID. The log cannot be deleted if there are filter entries configured to write to the log. All filter entry logging associations need to be removed before the log can be deleted.

This command configures the destination for filter log entries for the specified filter log ID.

Filter logs can be sent to either memory or an existing syslog server. If the filter log destination is memory, the maximum number of entries in the log must be specified.

The no form of the command deletes the filter log association.

This command enables the context to configure log summarization. These settings apply only if syslog is the log destination.

This command defines the key of the index of the mini-table. If key information is changed while summary is in the no-shutdown state, the filter summary mini-table is flushed and reconfigured with different key information. Log packets received during the reconfiguration time will be handled as if summary was not active.

The no form of the command reverts to the default parameter.

This command configures a memory filter log to store log entries until full or to store the most recent log entries (circular buffer).

Specifying wrap-around configures the memory filter log to store the most recent filter log entries (circular buffer). When the log is full, the oldest filter log entries are overwritten with new entries.

The no form of the command configures the memory filter log to accept filter log entries until full. When the memory filter log is full, filter logging for the log filter ID ceases.

This command creates a configuration context for an IPv4 filter policy.

IP filter policies specify either a forward or a drop action for packets based on the specified match criteria.

The IP filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple network ports as long as the scope of the policy is template.

Any changes made to the existing policy, using any of the subcommands, will be applied immediately to all network interfaces where this policy is applied.

The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

This command creates a configuration context for an IPv6 filter policy.

IP filter policies specify either a forward or a drop action for packets based on the specified match criteria.

The IP filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple network ports as long as the scope of the policy is template.

Any changes made to the existing policy, using any of the subcommands, will be applied immediately to all network interfaces where this policy is applied.

The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

This command enables the context for a MAC filter policy.

The MAC filter policy specifies either a forward or a drop action for packets based on the specified match criteria.

The MAC filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple services as long as the scope of the policy is template.

A MAC filter policy cannot be applied to a network interface, a VPRN service, or an IES service.

Any changes made to the existing policy, using any of the sub-commands, will be applied immediately to all services where this policy is applied.

The no form of the command deletes the MAC filter policy. A filter policy cannot be deleted until it is removed from all SAPs where it is applied.

This command enables the context for a VLAN filter policy.

The VLAN filter policy specifies either a forward or a drop action for packets based on the specified match criteria.

The VLAN filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to ring ports on the 2-port 10GigE (Ethernet) Adapter card and 2-port 10GigE (Ethernet) module. Each ring port can support one VLAN filter, and the same VLAN filter can be applied to both ring ports. The scope of a VLAN policy is always template.

A VLAN filter policy cannot be applied to any other type of adapter card.

Any changes made to an existing policy, using any of the sub-commands, is applied immediately to all ring ports where this policy is applied.

The no form of the command deletes the VLAN filter policy. A filter policy cannot be deleted until it is removed from all the ring ports where it is applied.

This command specifies the action to be applied to packets when the packets do not match the specified criteria in all of the IP, MAC, or VLAN filter entries of the filter.

This command renumbers existing IP, MAC, or VLAN filter entries to properly sequence filter entries.

This may be required in some cases since the OS exits when the first match is found and executes the actions according to the accompanying action command. This requires that entries be sequenced correctly from most to least explicit.

This command configures the filter policy scope as exclusive or template. If the scope of the policy is template and is applied to one or more network interfaces, the scope cannot be changed.

The no form of the command sets the scope of the policy to the default of template.

This command creates or edits a filter entry. Multiple entries can be created using unique entry-id numbers within the filter. The 7705 SAR implementation exits the filter on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly, from most to least explicit.

IPv4 filter entries can specify one or more matching criteria, with one caveat. In order to support the maximum 256 entries for IPv4 filters, any entry that uses source port (src-port) and/or destination port (dst-port) ranges (lt, gt, or range keywords) as match criteria must be within the first 64 entries. See the dst-port and src-port commands for more information.

An entry might not have any match criteria defined (in which case, everything matches) but must have at least the keyword action for it to be considered complete. Entries without the action keyword are considered incomplete and are rendered inactive.

The no form of the command removes the specified entry from the filter. Entries removed from the filter are immediately removed from all entities to which that filter is applied.

This command specifies what action to take (drop or forward) when packets match the entry criteria. The action keyword must be entered for the entry to be active. If neither drop nor forward is specified, the filter action is drop.

The action forward next-hop keywords cannot be applied to multicast traffic and only apply to IPv4.

The action forward fc keywords only apply to IPv4.

Multiple action statements entered will overwrite previous action statements when defined.

The no form of the command removes the specified action statement. The filter entry is considered incomplete and is rendered inactive without the action keyword.

This command specifies what action to take (drop or forward) when packets match the entry criteria. The action keyword must be entered and for the entry to be active. If neither drop nor forward is specified, the filter action is drop.

Multiple action statements entered will overwrite previous action statements when defined.

The no form of the command removes the specified action statement. The filter entry is considered incomplete and is rendered inactive without the action keyword.

This command enables the context to enable filter logging for a filter entry and specifies the destination filter log ID.

The filter log ID must exist before a filter entry can be enabled to use the filter log ID.

The no form of the command disables logging for the filter entry.

This command enables the context to enter match criteria for the IPv4 filter entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

This command enables the context to enter match criteria for the IPv6 filter entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

This command creates the context for entering/editing match criteria for the filter entry and specifies an Ethernet frame type for the entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, then all criteria must be satisfied (AND function) before the action associated with the match will be executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

This command accesses the match criteria for the filter entry and specifies a match criteria. If the match criteria are satisfied, the action associated with the match criteria is executed.

Only one match criterion (within one match statement) is allowed.

The no form of the command removes the match criteria for the entry-id.

This command configures a DiffServ Code Point (DSCP) name to be used as an IP filter match criterion.

The no form of the command removes the DSCP match criterion.

This command configures a destination IPv4 address range to be used as an IP filter match criterion.

To match on the destination IP address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The no form of the command removes the destination IP address match criterion.

This command configures a destination IPv6 address range to be used as an IP filter match criterion.

To match on the destination IP address, specify the address and prefix length; for example, 11::12/128.

The no form of the command removes the destination IP address match criterion.

This command configures a destination MAC address to be used as a MAC filter match criterion.

To match on the destination MAC address, specify the IEEE address.

The no form of the command removes the destination MAC address match criterion.

This command configures a destination TCP or UDP port number or port range for an IP filter match criterion.

The no form of the command removes the destination port match criterion.

This command configures an Ethernet type II Ethertype value to be used as a MAC filter match criterion.

The Ethernet type field is a 2-byte field used to identify the protocol carried by the Ethernet frame. For example, 0800 is used to identify IPv4 packets. The Ethernet type II frame Ethertype value to be used as a match criterion can be expressed as a hexadecimal (0x0600 to 0xFFFF) or a decimal (1536 to 65535) value.

The Ethernet type field is used by the Ethernet version-II frames.

The no form of the command removes the previously entered etype field as the match criteria.

This command configures fragmented or non-fragmented IP packets as an IP filter match criterion.

The no form of the command removes the match criterion.

This command applies to IPv4 filters only.

This command configures matching on an ICMP code field in the ICMP header of an IPv4 or IPv6 packet as a filter match criterion.

This option is only meaningful if the protocol match criteria specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures matching on the ICMP type field in the ICMP header of an IPv4 or IPv6 packet as a filter match criterion.

This option is only meaningful if the protocol match criteria specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures matching packets with a specific IP option or a range of IP options in the IP header as an IP filter match criterion.

The option type octet contains three fields:

The no form of the command removes the match criterion.

This command applies to IPv4 filters only.

This command configures matching packets that contain more than one option field in the IP header as an IP filter match criterion.

The no form of the command removes the checking of the number of option fields in the IP header as a match criterion.

This command applies to IPv4 filters only.

This command configures matching packets that contain the option field or have an option field of 0 in the IP header as an IP filter match criterion.

The no form of the command removes the checking of the option field in the IP header as a match criterion.

This command applies to IPv4 filters only.

This command configures a source IPv4 address range to be used as an IP filter match criterion.

To match on the source IP address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The no form of the command removes the source IP address match criterion.

This command configures a source IPv6 address range to be used as an IP filter match criterion.

To match on the source IP address, specify the address and prefix length; for example, 11::12/128.

The no form of the command removes the source IP address match criterion.

This command configures a source MAC address to be used as a MAC filter match criterion.

The no form of the command removes the source MAC address as the match criterion.

This command configures a source TCP or UDP port number or port range for an IP filter match criterion.

The no form of the command removes the source port match criterion.

This command configures matching on the ACK bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The no form of the command removes the criterion from the match entry.

This command configures matching on the SYN bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The SYN bit is normally set when the source of the packet wants to initiate a TCP session with the specified destination IP address.

The no form of the command removes the criterion from the match entry.

This command discards changes made to a security feature.

This command enters the mode to create or edit security features.

This command saves changes made to security features.

This command configures a profile group that provides a context within which you can configure security features such as session idle timeouts. Profile 1 is a default profile and cannot be modified.

The no form of the command removes the configured profile group.

This command configures a profile group name.

The no form of the command removes the configured profile group name.

This command configures session idle timeouts for this policy.

This command sets the timeout for a half-open NAT ICMP session. A half-open NAT ICMP session is created when an ICMP request is sent but no ICMP response is received.

The no form of the command removes the timeout set for icmp-request.

This command sets the timeout for a TCP session in the established state.

The no form of the command removes the timeout set for tcp-established.

This command configures the timeout applied to a TCP session in the SYN state.

The no form of the command removes the timeout set for tcp-syn.

This command configures the timeout applied to a TCP session in a time-wait state.

The no form of the command removes the timeout entered set for tcp-time-wait.

This command configures the idle timeout applied to a TCP session in a transitory state.

The no form of the command removes the timeout entered set for tcp-transitory.

This command configures the UDP mapping timeout.

The no form of the command removes the UDP mapping timeout.

This command configures the timeout applied to a UDP session with destination port 53.

The no form of the command removes the udp-dns timeout.

This command configures the timeout applied to a UDP session in its initial state.

The no form of the command removes the udp-initial timeout.

This command configures a policy group that provides a context within which you can configure a security policy.

The no form of the command removes the configured policy group.

This command configures a NAT policy entry.

The no form of this command deletes the entry with the specified ID. When an entry is deleted, all configuration parameters for the entry are also deleted.

This command specifies what action to take (forward, reject, or nat) when packets match the entry criteria. The action keyword must be entered and a keyword must be specified for the entry to be active. If reject, forward, or nat is not specified, the action is rejected.

The nat and forward actions cause a 6-tuple lookup (src/dst IP, src/dst port, protocol, src zone). If there is a match, NAT is applied and the packet is routed based on the datapath session table.

Multiple action statements entered will overwrite previous action statements when defined.

The no form of the command removes the specified action statement. An entry is considered incomplete and is rendered inactive without the action keyword.

This command specifies the destination IP address and port to which packets that have NAT applied to them are sent.

NAT actions cause a 6-tuple lookup (src/dst IP, src/dst port, protocol, src zone). If there is a match, NAT is applied and the packet is routed based on the datapath session table.

Multiple action statements entered will overwrite previous action statements when defined.

The no form of the command removes the specified action statement. An entry is considered incomplete and is rendered inactive without the action keyword.

This command is used to enter the limit context.

This command specifies the maximum number of concurrent sessions that can be created by NAT within a zone.

The no form of the command returns the system to the default.

This command configures match criteria for an entry based on the specified protocol.

The no form of the command removes the match criteria for the entry.

This command sets the direction of the traffic to be matched against the IP criteria. For example, if zone-inbound is configured, then all inbound traffic to the zone has the match criteria applied to it.

This command configures the destination IP address or address range to be used in the matching criteria of a policy entry. All packets within the specified IP address range are processed for matching criteria.

The no form of the command removes the destination IP address match criteria.

This command configures a destination protocol TCP or UDP port number or port range for the match criteria.

The no form of the command removes the destination port match criteria.

This command configures matching on an ICMP code field in the ICMP header of an IPv4 packet as a match criterion.

This option is only meaningful if the protocol match criterion specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures matching on the ICMP type field in the ICMP header of an IPv4 packet as a match criterion.

This option is only meaningful if the protocol match criterion specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures the source IP address or address range to be used in the matching criteria of a policy entry. All packets within the specified IP address range are processed for matching criteria.

The no form of the command removes the source IP address match criteria.

This command configures a source protocol TCP or UDP port number or port range for the match criteria.

The no form of the command removes the source port match criteria.

This command assigns an already configured profile to a policy.

The no form of the command removes the assigned profile.

This command configures a policy group name.

The no form of the command removes the configured policy group name.

This command configures the high-watermark threshold for NAT sessions. The alarm is raised when the high-watermark threshold is reached or exceeded. The value must be greater than or equal to the session-low-wmark value.

The no form of the command removes the high-watermark setting.

This command configures the low-watermark threshold for NAT sessions. The alarm is cleared when the session utilization percentage is equal to or less than the low-watermark threshold. The value must be lower than or equal to the session-high-wmark value.

The no form of the command removes the low-watermark setting.