5.8. Filter Command Reference

This command creates a text description for a configuration context to help identify the content in the configuration file.

The no form of the command removes any description string from the context.

The shutdown command administratively disables the entity. The operational state of the entity is disabled as well as the operational state of any entities contained within. When disabled, an entity does not change, reset, or remove any configuration settings or statistics. Many objects must be shut down before they may be deleted. Many entities must be explicitly enabled using the no shutdown command.

Unlike other commands and parameters where the default state is not indicated in the configuration file, shutdown and no shutdown are always indicated in system-generated configuration files.

The no form of the command puts an entity into the administratively enabled state.

This command enables the context to create a filter log policy.

The no form of the command deletes the filter log ID. The log cannot be deleted if there are filter entries configured to write to the log. All filter entry logging associations need to be removed before the log can be deleted.

This command configures the destination for filter log entries for the specified filter log ID.

Filter logs can be sent to either memory or an existing syslog server. If the filter log destination is memory, the maximum number of entries in the log must be specified.

The no form of the command deletes the filter log association.

This command enables the context to configure log summarization. These settings apply only if syslog is the log destination.

This command defines the key of the index of the mini-table. If key information is changed while summary is in the no-shutdown state, the filter summary mini-table is flushed and reconfigured with different key information. Log packets received during the reconfiguration time will be handled as if summary was not active.

The no form of the command reverts to the default parameter.

This command configures a memory filter log to store log entries until full or to store the most recent log entries (circular buffer).

Specifying wrap-around configures the memory filter log to store the most recent filter log entries (circular buffer). When the log is full, the oldest filter log entries are overwritten with new entries.

The no form of the command configures the memory filter log to accept filter log entries until full. When the memory filter log is full, filter logging for the log filter ID ceases.

This command creates a configuration context for an IPv4 exception filter policy. After creating an exception filter ID, you can optionally assign it to a unique name with the filter-name command. The exception filter name can be used instead of the ID for exception configuration commands, show commands, monitor commands, clear commands, and port and interface association commands.

IP exception filter policies specify matching criteria that allow a packet to be an exception to where it is applied. For more information, refer to the ip-exception command in Router Interface Commands.

The IP exception filter policy is a template that can be applied to multiple router interface group encryption contexts as long as the scope of the policy is configured as template.

Any changes made to the existing policy, using any subcommands, are applied immediately to all network interfaces where the policy is applied.

The no form of the command deletes the IP exception filter policy. An exception filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

This command creates a configuration context for an IPv4 filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and filter names support CLI auto-completion. For more information, refer to the 7705 SAR Basic System Configuration Guide, “Entering CLI Commands”.

IP filter policies specify either a forward or a drop action for packets based on the specified match criteria.

The IP filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple network ports as long as the scope of the policy is template.

Any changes made to the existing policy, using any of the subcommands, will be applied immediately to all network interfaces where this policy is applied.

The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

This command creates a configuration context for an IPv6 filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and Filter names support CLI auto-completion. For more information, refer to the 7705 SAR Basic System Configuration Guide, “Entering CLI Commands”.

IP filter policies specify either a forward or a drop action for packets based on the specified match criteria.

The IP filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple network ports as long as the scope of the policy is template.

Any changes made to the existing policy, using any of the subcommands, will be applied immediately to all network interfaces where this policy is applied.

The no form of the command deletes the IP filter policy. A filter policy cannot be deleted until it is removed from all network interfaces where it is applied.

This command enables the context for a MAC filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and Filter names support CLI auto-completion. For more information, refer to the 7705 SAR Basic System Configuration Guide, “Entering CLI Commands”.

The MAC filter policy specifies either a forward or a drop action for packets based on the specified match criteria.

The MAC filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to multiple services as long as the scope of the policy is template.

A MAC filter policy cannot be applied to a network interface, a VPRN service, or an IES service.

Any changes made to the existing policy, using any of the sub-commands, will be applied immediately to all services where this policy is applied.

The no form of the command deletes the MAC filter policy. A filter policy cannot be deleted until it is removed from all SAPs where it is applied.

This command enables the context for a VLAN filter policy. After creating a filter, you can optionally assign it a unique filter name with the filter-name command. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port association commands.

Filter IDs and Filter names support CLI auto-completion. For more information, refer to the 7705 SAR Basic System Configuration Guide, “Entering CLI Commands”.

The VLAN filter policy specifies either a forward or a drop action for packets based on the specified match criteria.

The VLAN filter policy, sometimes referred to as an access control list (ACL), is a template that can be applied to ring ports on the 2-port 10GigE (Ethernet) Adapter card and 2-port 10GigE (Ethernet) module. Each ring port can support one VLAN filter, and the same VLAN filter can be applied to both ring ports. The scope of a VLAN policy is always template.

A VLAN filter policy cannot be applied to any other type of adapter card.

Any changes made to an existing policy, using any of the sub-commands, is applied immediately to all ring ports where this policy is applied.

The no form of the command deletes the VLAN filter policy. A filter policy cannot be deleted until it is removed from all the ring ports where it is applied.

This command specifies the action to be applied to packets when the packets do not match the specified criteria in all of the IP, MAC, or VLAN filter entries of the filter.

This command creates a unique name to associate with this filter. The filter name can be used instead of the filter ID to refer to a filter for filter configuration commands, show commands, monitor commands, clear commands, and port and interface association commands.

This command renumbers existing IP, MAC, VLAN, or IP exception filter entries to properly sequence filter entries.

This may be required in some cases since the software exits when the first match is found and executes the actions according to the accompanying action command. This requires that entries be sequenced correctly from most to least explicit.

This command configures the filter policy scope as exclusive or template. If the scope of the policy is template and is applied to one or more network interfaces, the scope cannot be changed.

The no form of the command sets the scope of the policy to the default of template.

This command creates or edits a filter entry. Multiple entries can be created using unique entry-id numbers within the filter. The 7705 SAR implementation exits the filter on the first match found and executes the actions in accordance with the accompanying action command. For this reason, entries must be sequenced correctly, from most to least explicit.

Filter entry IDs support CLI auto-completion. For more information, refer to the 7705 SAR Basic System Configuration Guide, “Entering CLI Commands”.

IPv4 filter entries can specify one or more matching criteria, with one caveat. In order to support the maximum 256 entries for IPv4 filters, any entry that uses source port (src-port) and/or destination port (dst-port) ranges (lt, gt, or range keywords) as match criteria must be within the first 64 entries. See the dst-port and src-port commands for more information.

An entry might not have any match criteria defined (in which case, everything matches) but must have at least the keyword action for it to be considered complete. Entries without the action keyword are considered incomplete and are rendered inactive.

The no form of the command removes the specified entry from the filter. Entries removed from the filter are immediately removed from all entities to which that filter is applied.

This command specifies what action to take (drop or forward) when packets match the entry criteria. The action keyword must be entered for the entry to be active. If neither drop nor forward is specified, the filter action is drop.

The action forward next-hop keywords cannot be applied to multicast traffic and only apply to IPv4.

The action forward fc keywords only apply to IPv4.

Multiple action statements entered will overwrite previous action statements when defined.

The no form of the command removes the specified action statement. The filter entry is considered incomplete and is rendered inactive without the action keyword.

This command specifies what action to take (drop or forward) when packets match the entry criteria. The action keyword must be entered and for the entry to be active. If neither drop nor forward is specified, the filter action is drop.

Multiple action statements entered will overwrite previous action statements when defined.

The no form of the command removes the specified action statement. The filter entry is considered incomplete and is rendered inactive without the action keyword.

This command enables the context to enable filter logging for a filter entry and specifies the destination filter log ID.

The filter log ID must exist before a filter entry can be enabled to use the filter log ID.

The no form of the command disables logging for the filter entry.

This command enables the context to enter match criteria for the IPv4 or IP exception filter entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

This command enables the context to enter match criteria for the IPv6 filter entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, all criteria must be satisfied (AND function) before the action associated with the match is executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

This command creates the context for entering/editing match criteria for the filter entry and specifies an Ethernet frame type for the entry. When the match criteria have been satisfied, the action associated with the match criteria is executed.

If more than one match criterion (within one match statement) is configured, then all criteria must be satisfied (AND function) before the action associated with the match will be executed.

A match context may consist of multiple match criteria, but multiple match statements cannot be entered per entry.

The no form of the command removes the match criteria for the entry-id.

This command accesses the match criteria for the filter entry and specifies a match criteria. If the match criteria are satisfied, the action associated with the match criteria is executed.

Only one match criterion (within one match statement) is allowed.

The no form of the command removes the match criteria for the entry-id.

This command configures a DiffServ Code Point (DSCP) name to be used as an IP filter match criterion.

The no form of the command removes the DSCP match criterion.

This command configures a destination IPv4 address range to be used as an IP filter or IP exception filter match criterion.

To match on the destination IP address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The no form of the command removes the destination IP address match criterion.

This command configures a destination IPv6 address range to be used as an IP filter match criterion.

To match on the destination IP address, specify the address and prefix length; for example, 11::12/128.

The no form of the command removes the destination IP address match criterion.

This command configures a destination MAC address to be used as a MAC filter match criterion.

To match on the destination MAC address, specify the IEEE address.

The no form of the command removes the destination MAC address match criterion.

This command configures a destination TCP or UDP port number or port range for an IP filter or IP exception filter match criterion.

The no form of the command removes the destination port match criterion.

This command configures an Ethernet type II Ethertype value to be used as a MAC filter match criterion.

The Ethernet type field is a 2-byte field used to identify the protocol carried by the Ethernet frame. For example, 0800 is used to identify IPv4 packets. The Ethernet type II frame Ethertype value to be used as a match criterion can be expressed as a hexadecimal (0x0600 to 0xFFFF) or a decimal (1536 to 65535) value.

The Ethernet type field is used by the Ethernet version-II frames.

The no form of the command removes the previously entered etype field as the match criteria.

This command configures fragmented or non-fragmented IP packets as an IP filter match criterion.

The no form of the command removes the match criterion.

This command applies to IPv4 filters only.

This command configures matching on the ICMP code field in the ICMP header of an IPv4 or IPv6 packet as a filter match criterion, or configures matching on the ICMP code field in the ICMP header of an IPv4 packet as an exception filter match criterion.

This command applies only if the protocol match criteria specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures matching on the ICMP type field in the ICMP header of an IPv4 or IPv6 packet as a filter match criterion, or configures matching on the ICMP type field in the ICMP header of an IPv4 packet as an exception filter match criterion.

This command applies only if the protocol match criteria specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures matching packets with a specific IP option or a range of IP options in the IP header as an IP filter match criterion.

The option type octet contains three fields:

The no form of the command removes the match criterion.

This command applies to IPv4 filters only.

This command configures matching packets that contain more than one option field in the IP header as an IP filter match criterion.

The no form of the command removes the checking of the number of option fields in the IP header as a match criterion.

This command applies to IPv4 filters only.

This command configures matching packets that contain the option field or have an option field of 0 in the IP header as an IP filter match criterion.

The no form of the command removes the checking of the option field in the IP header as a match criterion.

This command applies to IPv4 filters only.

This command configures a source IPv4 address range to be used as an IP filter or IP exception filter match criterion.

To match on the source IP address, specify the address and its associated mask; for example, 10.1.0.0/16. The conventional notation of 10.1.0.0 255.255.0.0 may also be used.

The no form of the command removes the source IP address match criterion.

This command configures a source IPv6 address range to be used as an IP filter match criterion.

To match on the source IP address, specify the address and prefix length; for example, 11::12/128.

The no form of the command removes the source IP address match criterion.

This command configures a source MAC address to be used as a MAC filter match criterion.

The no form of the command removes the source MAC address as the match criterion.

This command configures a source TCP or UDP port number or port range for an IP filter or IP exception filter match criterion.

The no form of the command removes the source port match criterion.

This command configures matching on the ACK bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The no form of the command removes the criterion from the match entry.

This command configures matching on the SYN bit being set or reset in the control bits of the TCP header of an IP packet as an IP filter match criterion.

The SYN bit is normally set when the source of the packet wants to initiate a TCP session with the specified destination IP address.

The no form of the command removes the criterion from the match entry.

This command discards changes made to a security feature.

This command enters the mode to create or edit security features.

This command saves changes made to security features.

This command enters the context for creating an application group to be used in a security policy.

The no form of the command removes the configured application group.

This command configures a name for an application group, host group, or policer group.

The no form of the command removes the configured name.

This command configures a description for the specified application group, host group, or policer group.

This command enters the context for creating a host group to be used in a security policy.

The no form of the command removes the configured host group.

This command configures a range of hosts to be used in a host group. Up to 10 entries can be configured for a host group.

This command enters the security logging context.

This command configures the identifier for the security log. The 7705 SAR supports up to 100 security logs. This log ID can be applied at the zone level using the config>router>zone>log context or at the rule level using the config>security>policy>entry>logging context, but not to both at the same time.

The no form of the command removes the configured security group.

This command configures a description for the specified security log.

This command configures the destination location of the specified security log.

This command configures the name of the specified security log.

This command configures the logging profile to which the specified security log will match events.

This command disables logging to the specified security log. Logging is enabled by default.

The no form of this command enables logging to the specified security profile.

This command enables log wraparound when the maximum log size has been reached in the log destination location. When wraparound is enabled, the log starts over at 1 and overwrites the existing logs when the log size is at maximum. When wraparound is disabled, the log stops adding entries when the log size is at maximum.

The no form of this command disables log wraparound.

This command configures the security logging profile.

The no form of the command removes the configured profile.

This command configures a description for this logging profile.

The no form of the command removes the configured description for this logging profile.

This command controls the generation of security log events. A log can be configured to generate all event types and events, or to generate specific event types and events. In addition, for each event type or event, one of three actions can be configured: suppress, throttle, or off. These configurations all become part of the specified logging profile. Table 74 lists the supported event types and events on 7705 SAR firewalls.

This command configures a name for this logging profile.

The no form of the command removes the configured name for this logging profile.

This command configures a profile group that provides a context within which you can configure security features such as session idle timeouts and application assurance parameters. Profile 1 is a default profile and cannot be modified.

The no form of the command removes the configured profile group.

This command enters the application context for firewall configuration.

This command enables application level gateway (ALG) inspection by the firewall.

The no form of the command disables ALG inspection by the firewall.

This command enables the context for configuring application assurance parameters. Enabling application assurance automatically sets the defaults for the parameters as listed in Table 75.

The no form of the command disables application assurance on the firewall.

This command enables the context for configuring DNS inspection parameters on a firewall in the application assurance parameters context.

This command limits the number of replies to DNS requests. When enabled, the firewall permits a single reply to each DNS request.

The no form of the command disables the limiting of DNS replies; the firewall permits all replies to each DNS request.

This command enables the context for configuring ICMP limit parameters on a firewall in the application assurance parameters context.

This command limits the number of ICMP type 3 replies through a firewall. When enabled, only 15 ICMP type 3 replies are permitted through the firewall for each ICMP and IP session.

The no form of the command disables the limiting of ICMP type 3 replies through a firewall; all ICMP type 3 replies are permitted through the firewall for each ICMP and IP session.

This command configures the number of ICMP requests and replies allowed through the firewall for each ICMP session. Any requests or replies that are received beyond the configured limit are discarded until the ICMP session times out.

The no form of the command allows all ICMP requests and replies through the firewall for each ICMP session.

This command enables the context for configuring IP layer inspection on a firewall in the application assurance parameters context.

This command controls the inspection of IP options in an IP packet header. The IP options can be specified using either the bit mask value or the name.

The permit command only applies when using bit mask values. It allows packets through the firewall when the IP options on those packets match the bit mask value specified in the ip-option-mask parameter. The ip-option-mask is a flat bit representation of the IP Option Number. The IP Option Copy Bit and IP Option Class Bits are omitted from the ip-option-mask. For example, to permit a packet with the router alert option (which uses IP Option Number 20), bit 20 of the ip-option-mask should be set, which configures the ip-option-mask parameter as 0x00100000. To discard all IP packets with IP options, configure the ip-option-mask parameter as 0x0. To permit any option, configure the ip-option-mask parameter as 0xffffffff or use the permit-any command. When permit-any is configured, the 7705 SAR does not examine IP options and allows all packets through the firewall.

Multiple options can be permitted in a single line of configuration by “AND”ing the IP option bit mask values. For example, to permit packets with the router alert, EOOL, and NOP options, configure the ip-option-mask parameter as 0x00100003.

When IP options are specified using ip-option-name, the permit command is implied. Multiple options can be specified by listing multiple names.

Table 76 lists the names and bit mask values of the supported IP options.

This command enables the context for configuring TCP layer inspection on a firewall in the application assurance parameters context.

This command enables strict examination of TCP packets through the firewall. When enabled, the firewall examines the header of each TCP packet for that session to ensure compliance with RFC 793.

Note: The TCP sessions that are configured with strict TCP are processed in the 7705 SAR CSM complex. Aggregate throughput of sessions through the CSM is limited by the processing power of the CSM that is performing multiple tasks. Throughput for a session on the CSM will not match the maximum throughput of a session that only traverses the datapath.

The no form of the command disables examination of the TCP header on each TCP packet.

This command configures a forward policer group for a security profile. A TCP/UDP security session is bidirectional. When a security sessions is created from a private domain to a public domain, the session’s forward direction is from the private to the public domain and the session’s reverse direction is from the public to the private domain. A forward-direction policer group acts on traffic that is traversing from the private domain to the public domain.

The no form of the command removes the configured forward policer group.

This command configures a profile group name.

The no form of the command removes the configured profile group name.

This command configures a reverse policer group for a security profile. A TCP/UDP security session is bidirectional. When a security sessions is created from a private domain to a public domain, the session’s forward direction is from the private to the public domain and the session’s reverse direction is from the public to the private domain. A reverse-direction policer group acts on traffic that is traversing from the public domain to the private domain.

The no form of the command removes the configured reverse policer group.

This command configures session idle timeouts for this profile.

This command sets the timeout for an ICMP security session. An ICMP session is based on the packet source and destination IP addresses and ICMP identifier. This timer removes the ICMP session if no ICMP packets have been received for the configured time.

The no form of the command removes the timeout set for icmp-request.

This command sets the timeout for protocol sessions other than TCP, UDP, or ICMP. These other protocol sessions are based on a 3-tuple match of source IP address, destination IP address, and protocol, except for SCTP (protocol 132), which uses a 5-tuple match like UDP. If no packets are received after the configured time, the firewall session is discontinued and removed from the 7705 SAR.

The no form of the command removes the timeout set for other-sessions.

This command sets the timeout for a TCP session in the established state.

The no form of the command removes the timeout set for tcp-established.

This command configures the timeout applied to a TCP session in the SYN state.

The no form of the command removes the timeout set for tcp-syn.

This command configures the timeout applied to a TCP session in a time-wait state.

The no form of the command removes the timeout set for tcp-time-wait.

This command configures the idle timeout applied to a TCP session in a transitory state.

The no form of the command removes the timeout set for tcp-transitory.

This command configures the UDP mapping timeout.

The no form of the command removes the UDP mapping timeout.

This command configures the timeout applied to a UDP session with destination port 53.

The no form of the command removes the udp-dns timeout.

This command configures the timeout applied to a UDP session in its initial state.

The no form of the command removes the udp-initial timeout.

This command enters the context for creating a policer group to be used in a security profile.

The no form of the command removes the configured policer group.

This command sets the policer rate and CBS buffer size for the policer group.

This command configures a policy group that provides a context within which you can configure a security policy.

The no form of the command removes the configured policy group.

This command configures an entry in a security policy or in an application group.

The no form of this command deletes the entry with the specified ID. When an entry is deleted, all configuration parameters for the entry are also deleted.

This command specifies what action to take (forward, reject, drop, or NAT) when packets match the entry criteria. An action must be specified in order for the entry to be active. If no action is specified, the entry is inactive.

The nat and forward actions each cause a 6-tuple lookup (source/destination IP address, source/destination port number, protocol, and source zone).

The drop action configures a firewall session on the datapath with the action to drop packets that match the entry criteria. The drop action should be used when an IP connection is carrying a large amount of traffic and CSM processing resources need to be preserved, because the drop action means that packets will not be extracted to the CSM to be rejected. Drop sessions are unidirectional and can be used as a way of blocking traffic from a source issuing a denial of service (DoS) attack.

Entering multiple action statements will overwrite previous action statements.

The no form of the command removes the specified action statement.

This command specifies the destination IP address and port to which packets that have NAT applied to them are sent.

NAT actions cause a 6-tuple lookup (source/destination IP address, source/destination port number, protocol, and source zone). If there is a match, NAT is applied and the packet is routed based on the datapath session table.

Entering multiple action statements will overwrite previous action statements.

The no form of the command removes the specified action statement. An entry is considered incomplete and is rendered inactive if no action is specified.

This command is used to enter the limit context.

This command specifies the maximum number of concurrent security sessions that can be created for the specified policy.

The no form of the command returns the system to the default.

This command forces a firewall to create a unidirectional session when a packet matches the criteria of the policy entry. In normal operating mode, when a packet matches the criteria and the packet is allowed through, the firewall creates a bidirectional session so that packets traveling in the reverse direction on that session are also allowed through the firewall.

The no form of the command creates a bidirectional firewall session for a matched packet.

This command configures logging control for this security policy entry. Logging can be enabled per entry using the to log-id command, or per zone using the to zone command. Logging is suppressed by default.

This command configures match criteria for an application group entry based on the specified protocol. An application group must be configured with at least one matching protocol before it can be assigned to a security policy.

When an application group is applied to NAT, the only protocols supported as match criteria are TCP, UDP, and ICMP.

The no form of the command removes the match criteria for the entry.

This command configures match criteria for an entry based on the specified protocol or application group.

When a security policy is applied to NAT, the only protocols supported as match criteria are TCP, UDP, ICMP, and *.

The no form of the command removes the match criteria for the entry.

This command sets the direction of the traffic to be matched against the IP criteria. For example, if zone-inbound is configured, then all inbound traffic to the zone has the match criteria applied to it.

This command configures the destination IP address or address range to be used in the matching criteria of a policy entry. All packets within the specified IP address range are processed for matching criteria. For host group matching criteria, the host group must be configured before adding it to the policy.

The no form of the command removes the destination IP address match criterion.

This command configures a destination protocol TCP or UDP port number or port range for the match criterion.

The no form of the command removes the destination port match criterion.

This command configures matching on an ICMP code field in the ICMP header of an IPv4 packet as a match criterion.

This option is only meaningful if the protocol match criterion specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures matching on the ICMP type field in the ICMP header of an IPv4 packet as a match criterion.

This option is only meaningful if the protocol match criterion specifies ICMP (1).

The no form of the command removes the criterion from the match entry.

This command configures the source IP address or address range to be used in the matching criteria of a policy entry. All packets within the specified IP address range are processed for matching criteria. For host group matching criteria, the host group must be configured before adding it to the policy.

The no form of the command removes the source IP address match criterion.

This command configures a source protocol TCP or UDP port number or port range for the match criterion.

The no form of the command removes the source port match criterion.

This command assigns an already configured profile to a policy.

The no form of the command removes the assigned profile.

This command configures a policy group name.

The no form of the command removes the configured policy group name.

This command configures the high-water mark threshold for security sessions. An alarm is raised when the high-water mark threshold is reached or exceeded. The value must be greater than or equal to the session-low-wmark value.

The no form of the command removes the high-water mark setting.

This command configures the low-water mark threshold for security sessions. The alarm is cleared when the session utilization percentage is equal to or less than the low-water mark threshold. The value must be less than or equal to the session-high-wmark value.

The no form of the command removes the low-water mark setting.