This section provides information to configure filter policies using the command line interface.
This section provides a brief overview of the tasks that must be performed for both IP and MAC filter configurations and provides the CLI commands.
Configuring and applying filter policies is optional. Each filter policy must have the following:
Use the following CLI syntax to create a template IPv4 filter policy:
Within a filter policy, configure filter entries which contain criteria against which ingress, egress, or network traffic is matched. The action specified in the entry determine how the packets are handled, such as dropping or forwarding.
The following displays an IPv4 filter entry configuration example:
If http-redirect is specified as an action, a corresponding forward entry must be specified before the redirect. Http-redirect is not supported on the 7450 ESS-1 model.
The following displays an http-redirect configuration example:
Within a filter entry, you can specify that traffic matching the associated IPv4 filter entry is sampled if the IPv4 interface is set to cflowd acl mode. Enabling filter-sample enables the cflowd tool.
The following displays an IPv4 filter entry configuration example:
Within a filter entry, you can also specify that traffic matching the associated IPv4 filter entry is not sampled by cflowd if the IPv4 interface is set to cflowd interface mode. The following displays an IPv4 filter entry configuration example:
Configuring and applying IPv6 filter policies is optional. IPv6 filter policies must be configured separately from IP (IPv4) filter policies. The configuration mimics IP filter policy configuration. See Creating an IPv4 Filter Policy.
Configuring and applying filter policies is optional. Each filter policy must have the following:
The following example shows a MAC filter policy configuration:
The following example shows an ISID filter policy configuration:
The following example shows a VID filter policy configuration:
Within a filter policy, configure filter entries that contain criteria against which ingress, egress, or network traffic is matched. The action specified in the entry determines how the packets are handled, such as dropping or forwarding.
The following displays a MAC filter entry configuration example:
Configuring and applying IP exception filter policies is optional. Each exception filter policy must have the following:
Use the following CLI syntax to create an IP exception filter policy:
The following example displays a template IP exception filter policy configuration.
Within an exception filter policy, configure exception entries that contain criteria against which ingress, egress, and network traffic is matched. Packets that match the entry criteria are allowed to transit the NGE domain in clear text.
Use the following CLI syntax to configure IP exception filter matching criteria:
The following example displays a matching configuration.
IP filter policies support usage of match lists as a single match criteria. To create a match list you must:
Optionally, a description can also be defined.
The following example shows an IPv4 address prefix list configuration and its usage in an IPv4 filter policy:
Filter policies can be associated with the entities listed in Table 48.
IPv4 and IPv6 Filter Policies | MAC Filter Policies |
Epipe SAP, spoke SDP | Epipe SAP, spoke SDP |
Fpipe SAP, spoke SDP | N/A |
IES interface SAP, spoke SDP, R-VPLS | N/A |
Ipipe SAP, spoke SDP | N/A |
VPLS mesh SDP, spoke SDP, SAP | VPLS mesh SDP, spoke SDP, SAP |
VPRN interface SAP, spoke SDP, R-VPLS, network ingress | N/A |
Network interface | N/A |
IP and MAC filter policies are applied by associating them with a SAP and/or spoke-sdp in ingress and/or egress direction as needed. Filter ID is used to associate an existing filter policy, or if defined, a Filter Name for that filter policy can be used in the CLI.
The following output displays IP and MAC filters assigned to an ingress and egress SAP and spoke SDP:
The following output displays an IPv6 filters assigned to an IES service interface:
IP filter policies can be applied to network IPv4/IPv6 interfaces. MAC filters cannot be applied to network IP interfaces or to routable IES services. Similarly to applying filter policies to service, IPv4/IPv6 filter policies are applied to network interfaces by associating a policy with ingress and/or egress direction as desired. Filter ID is used to associate an existing filter policy, or if defined, a Filter Name for that Filter ID policy can be used in the CLI.
The following displays an IP filter applied to an interface at ingress.
The following displays IPv4 and IPv6 filters applied to an interface at ingress and egress.
Configuring and applying redirect policies is optional. Each redirect policy must have the following:
The following displays a redirection policy configuration:
Traffic matching an IP filter can be tunneled with GRE using the following mechanisms.
The gre-tunnel-template defines the parameters to create the GRE header used to encapsulate matching IP traffic.
The following is an example configuration:
This section describes filter policy management tasks.
The system exits the matching process when the first match is found and then executes the actions in accordance with the specified action. Because the ordering of entries is important, the numbering sequence may need to be rearranged. Entries should be numbered from the most explicit to the least explicit.
The following example shows renumbering of filter entries.
The following displays the original filter entry order, followed by the reordered filter entries:
There are several ways to modify an existing filter policy. A filter policy can be modified dynamically as part of subscriber management dynamic insertion/removal of filter policy entries (see the 7450 ESS, 7750 SR, and VSR Triple Play Service Delivery Architecture Guide for details). A filter policy can be modified indirectly by configuration change to a match list the filter policy uses (as described earlier in this guide). In addition, a filter policy can be directly edited as described below.
To access a specific IP (v4/v6), or MAC filter, you must specify the filter ID, or if defined, filter name. Use the no form of the command to remove the command parameters or return the parameter to the default setting.
The following output displays the modified IP filter output:
Before you can delete a filter, you must remove the filter association from all the applied ingress and egress SAPs and network interfaces by executing no filter command in all context where the filter is used.
After you have removed the filter from the SAPs network interfaces, you can delete the filter as shown in the following example.
To access a specific redirect policy, you must specify the policy name. Use the no form of the command to remove the command parameters or return the parameter to the default setting.
Before you can delete a redirect policy from the filter configuration, you must remove the policy association from the IP filter.
The following example shows the command usage to replace the configured redirect policy (redirect1) with a different redirect policy (redirect2) and then removing the redirect1 policy from the filter configuration.
When changes are to be made to an existing filter policy applied to a one or more SAPs/network interfaces, Nokia recommends to first copy the applied filter policy, then modify the copy and then overwrite the applied policy with the modified copy. This ensures that a policy being modified is not applied when partial changes are done as any filter policy edits are applied immediately to all services where the policy is applied.
New filter policies can also be created by copying an existing policy and renaming the new filter.
The following displays the command usage to copy an existing IP filter (11) to create a new filter policy (12) that can then be edited. And once edits are completed, it can be used to overwrite existing policy (11).