21. filter Commands

— drop

— description string

— entry number

— action

— drop

— apply-groups reference

— apply-groups-exclude reference

— option

— absent

— match

— exact boolean

— hex string

— invert boolean

— string string

— number number

— present

— dhcp6-filter number

— apply-groups reference

— apply-groups-exclude reference

— default-action

— na boolean

— pd boolean

— drop

— description string

— entry number

— action

— na boolean

— pd boolean

— drop

— apply-groups reference

— apply-groups-exclude reference

— option

— absent

— match

— exact boolean

— hex string

— invert boolean

— string string

— number number

— present

— gre-tunnel-template string

— apply-groups reference

— apply-groups-exclude reference

— description string

— ipv4

— destination-address string

— gre-key (keyword | number)

— skip-ttl-decrement boolean

— source-address string

— ip-exception string

— apply-groups reference

— apply-groups-exclude reference

— description string

— entry number

— apply-groups reference

— apply-groups-exclude reference

— description string

— match

— dst-ip

— address (ipv4-address | ipv4-prefix-with-host-bits)

— mask string

— dst-port

— eq number

— gt number

— lt number

— range

— end number

— start number

— icmp

— code number

— type number

— protocol (number | keyword)

— src-ip

— address (ipv4-address | ipv4-prefix-with-host-bits)

— mask string

— src-port

— eq number

— gt number

— lt number

— range

— end number

— start number

— filter-id number

— ip-filter string

— apply-groups reference

— apply-groups-exclude reference

— chain-to-system-filter boolean

— default-action keyword

— description string

— embed

— filter reference offset number

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— flowspec offset number

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— group number

— router-instance string

— openflow reference offset number

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— grt

— sap reference

— system

— vpls reference

— vprn reference

— entry number

— action

— accept

— accept-when

— pattern

— expression string

— mask string

— offset-type keyword

— offset-value number

— apply-groups reference

— apply-groups-exclude reference

— drop

— drop-when

— extracted-traffic

— eq number

— gt number

— lt number

— range

— end number

— start number

— pattern

— expression string

— mask string

— offset-type keyword

— offset-value number

— ttl

— eq number

— gt number

— lt number

— range

— end number

— start number

— fc keyword

— forward

— bonding-connection number

— esi-l2

— esi-value string

— vpls reference

— esi-l3

— esi-value string

— sf-ip string

— vas-interface reference

— vprn reference

— gre-tunnel reference

— lsp string

— mpls-policy

— endpoint string

— next-hop

— interface-name string

— nh-ip

— address string

— indirect boolean

— nh-ip-vrf

— address string

— indirect boolean

— router-instance string

— redirect-policy reference

— router-instance string

— sap

— sap-id reference

— vpls reference

— sdp

— sdp-bind-id string

— vpls reference

— srte-policy

— color number

— endpoint string

— vprn-target

— adv-prefix string

— bgp-nh string

— lsp string

— vprn reference

— gtp-local-breakout

— http-redirect

— allow-override boolean

— url (keyword | http-redirect-url)

— ignore-match

— l2-aware-nat-bypass boolean

— nat

— nat-policy reference

— rate-limit

— eq number

— gt number

— lt number

— range

— end number

— start number

— pattern

— expression string

— mask string

— offset-type keyword

— offset-value number

— pir (number | keyword)

— ttl

— eq number

— gt number

— lt number

— range

— end number

— start number

— reassemble

— remark

— dscp keyword

— secondary

— apply-groups reference

— apply-groups-exclude reference

— forward

— next-hop

— nh-ip-vrf

— address string

— indirect boolean

— router-instance string

— sap

— sap-id reference

— vpls reference

— sdp

— sdp-bind-id string

— vpls reference

— remark

— dscp keyword

— tcp-mss-adjust

— apply-groups reference

— apply-groups-exclude reference

— description string

— egress-pbr keyword

— filter-sample boolean

— interface-sample boolean

— log reference

— match

— destination-class number

— dscp keyword

— dst-ip

— address (ipv4-address | ipv4-prefix-with-host-bits)

— ip-prefix-list reference

— mask string

— dst-port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— fragment keyword

— icmp

— code number

— type number

— ip-option

— mask number

— type number

— multiple-option boolean

— option-present boolean

— eq number

— gt number

— lt number

— range

— end number

— start number

— port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— protocol (number | keyword)

— protocol-list reference

— src-ip

— address (ipv4-address | ipv4-prefix-with-host-bits)

— ip-prefix-list reference

— mask string

— src-mac

— address string

— mask string

— src-port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— src-route-option boolean

— tcp-flags

— ack boolean

— cwr boolean

— ece boolean

— fin boolean

— ns boolean

— psh boolean

— rst boolean

— syn boolean

— urg boolean

— pbr-down-action-override keyword

— sample-profile reference

— sticky-dest (number | keyword)

— filter-id number

— scope keyword

— subscriber-mgmt

— host-specific-entry

— credit-control

— range

— end number

— start number

— filter-rule

— range

— end number

— start number

— watermark

— high number

— low number

— shared-entry

— filter-rule

— range

— end number

— start number

— pcc-rule

— range

— end number

— start number

— watermark

— high number

— low number

— type keyword

— ipv6-exception string

— apply-groups reference

— apply-groups-exclude reference

— description string

— entry number

— apply-groups reference

— apply-groups-exclude reference

— description string

— match

— dst-ip

— address (ipv6-address | ipv6-prefix-with-host-bits)

— ipv6-prefix-list reference

— mask string

— dst-port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— icmp

— code number

— type number

— next-header (number | keyword)

— port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— src-ip

— address (ipv6-address | ipv6-prefix-with-host-bits)

— ipv6-prefix-list reference

— mask string

— src-port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— filter-id number

— ipv6-filter string

— apply-groups reference

— apply-groups-exclude reference

— chain-to-system-filter boolean

— default-action keyword

— description string

— embed

— filter reference offset number

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— flowspec offset number

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— group number

— router-instance string

— openflow reference offset number

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— grt

— sap reference

— system

— vpls reference

— vprn reference

— entry number

— action

— accept

— accept-when

— pattern

— expression string

— mask string

— offset-type keyword

— offset-value number

— apply-groups reference

— apply-groups-exclude reference

— drop

— drop-when

— extracted-traffic

— hop-limit

— eq number

— gt number

— lt number

— range

— end number

— start number

— pattern

— expression string

— mask string

— offset-type keyword

— offset-value number

— payload-length

— eq number

— gt number

— lt number

— range

— end number

— start number

— fc keyword

— forward

— bonding-connection number

— esi-l2

— esi-value string

— vpls reference

— esi-l3

— esi-value string

— sf-ip string

— vas-interface reference

— vprn reference

— gre-tunnel reference

— lsp string

— mpls-policy

— endpoint string

— next-hop

— nh-ip

— address string

— indirect boolean

— nh-ip-vrf

— address string

— indirect boolean

— router-instance string

— redirect-policy reference

— router-instance string

— sap

— sap-id reference

— vpls reference

— sdp

— sdp-bind-id string

— vpls reference

— srte-policy

— color number

— endpoint string

— vprn-target

— adv-prefix string

— bgp-nh string

— lsp string

— vprn reference

— http-redirect

— allow-override boolean

— url (keyword | http-redirect-url)

— ignore-match

— nat

— nat-policy reference

— nat-type keyword

— rate-limit

— hop-limit

— eq number

— gt number

— lt number

— range

— end number

— start number

— pattern

— expression string

— mask string

— offset-type keyword

— offset-value number

— payload-length

— eq number

— gt number

— lt number

— range

— end number

— start number

— pir (number | keyword)

— remark

— dscp keyword

— secondary

— apply-groups reference

— apply-groups-exclude reference

— forward

— next-hop

— nh-ip-vrf

— address string

— indirect boolean

— router-instance string

— sap

— sap-id reference

— vpls reference

— sdp

— sdp-bind-id string

— vpls reference

— remark

— dscp keyword

— tcp-mss-adjust

— apply-groups reference

— apply-groups-exclude reference

— description string

— egress-pbr keyword

— filter-sample boolean

— interface-sample boolean

— log reference

— match

— destination-class number

— dscp keyword

— dst-ip

— address (ipv6-address | ipv6-prefix-with-host-bits)

— ipv6-prefix-list reference

— mask string

— dst-port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— extension-header

— ah boolean

— esp boolean

— hop-by-hop boolean

— routing-type0 boolean

— flow-label

— mask number

— value number

— fragment keyword

— icmp

— code number

— type number

— next-header (number | keyword)

— next-header-list reference

— eq number

— gt number

— lt number

— range

— end number

— start number

— port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— src-ip

— address (ipv6-address | ipv6-prefix-with-host-bits)

— ipv6-prefix-list reference

— mask string

— src-mac

— address string

— mask string

— src-port

— eq number

— gt number

— lt number

— port-list reference

— range

— end number

— start number

— tcp-flags

— ack boolean

— cwr boolean

— ece boolean

— fin boolean

— ns boolean

— psh boolean

— rst boolean

— syn boolean

— urg boolean

— pbr-down-action-override keyword

— sample-profile reference

— sticky-dest (number | keyword)

— filter-id number

— scope keyword

— subscriber-mgmt

— host-specific-entry

— credit-control

— range

— end number

— start number

— filter-rule

— range

— end number

— start number

— watermark

— high number

— low number

— shared-entry

— filter-rule

— range

— end number

— start number

— pcc-rule

— range

— end number

— start number

— watermark

— high number

— low number

— type keyword

— log number

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— description string

— destination

— memory

— max-entries number

— stop-on-full boolean

— syslog

— name reference

— summary

— admin-state keyword

— summary-crit keyword

— mac-filter string

— apply-groups reference

— apply-groups-exclude reference

— default-action keyword

— description string

— embed

— entry number

— action

— accept

— apply-groups reference

— apply-groups-exclude reference

— drop

— forward

— esi-l2

— esi-value string

— vpls reference

— sap

— sap-id reference

— vpls reference

— sdp

— sdp-bind-id string

— vpls reference

— http-redirect

— url string

— ignore-match

— rate-limit

— pir (number | keyword)

— secondary

— apply-groups reference

— apply-groups-exclude reference

— forward

— sap

— sap-id reference

— vpls reference

— sdp

— sdp-bind-id string

— vpls reference

— apply-groups reference

— apply-groups-exclude reference

— description string

— log reference

— match

— dot1p

— mask number

— priority number

— dst-mac

— address string

— mask string

— etype string

— frame-type keyword

— inner-tag

— mask number

— tag number

— isid

— range

— end number

— start number

— value number

— llc-dsap

— dsap number

— mask number

— llc-ssap

— mask number

— ssap number

— outer-tag

— mask number

— tag number

— snap-oui keyword

— snap-pid number

— src-mac

— address string

— mask string

— pbr-down-action-override keyword

— sticky-dest (number | keyword)

— filter-id number

— scope keyword

— type keyword

— match-list

— apply-groups reference

— apply-groups-exclude reference

— ip-prefix-list string

— apply-groups reference

— apply-groups-exclude reference

— apply-path

— bgp-peers number

— apply-groups reference

— apply-groups-exclude reference

— group string

— neighbor string

— router-instance string

— description string

— prefix string

— prefix-exclude string

— ipv6-prefix-list string

— apply-groups reference

— apply-groups-exclude reference

— apply-path

— bgp-peers number

— apply-groups reference

— apply-groups-exclude reference

— group string

— neighbor string

— router-instance string

— description string

— prefix string

— prefix-exclude string

— port-list string

— apply-groups reference

— apply-groups-exclude reference

— description string

— port number

— range start number end number

— protocol-list string

— apply-groups reference

— apply-groups-exclude reference

— description string

— protocol (number | keyword)

— md-auto-id

— filter-id-range

— apply-groups reference

— apply-groups-exclude reference

— end number

— start number

— redirect-policy string

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— description string

— destination (ipv4-address-no-zone | ipv6-address-no-zone)

— admin-state keyword

— apply-groups reference

— apply-groups-exclude reference

— description string

— ping-test

— apply-groups reference

— apply-groups-exclude reference

— drop-count number

— hold-down number

— interval number

— source-address (ipv4-address-no-zone | ipv6-address-no-zone)

— timeout number

— priority number

— unicast-rt-test

— notify-dest-change boolean

— router-instance string

— sticky-dest (number | keyword)

— redirect-policy-binding string

— apply-groups reference

— apply-groups-exclude reference

— binding-operator keyword

— redirect-policy reference

— apply-groups reference

— apply-groups-exclude reference

— destination reference

— system-filter

— apply-groups reference

— apply-groups-exclude reference

— ip reference

— ipv6 reference

16.0.R1

Platforms

All

Enter the entry list instance

Context

configure filter dhcp-filter number entry number

Tree

Max. Elements

Introduced

16.0.R1

Platforms

All

[entry-id] number

Synopsis

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

drop

Synopsis

Introduced

16.0.R1

Platforms

All

invert boolean

Synopsis

Invert (partial) matching criteria

Context

configure filter dhcp-filter number entry number option match invert boolean

Tree

invert

Default

false

Introduced

16.0.R1

Platforms

All

string string

Synopsis

Matching pattern for the filtered option

Context

configure filter dhcp-filter number entry number option match string string

Tree

string

String Length

1 to 127

Notes

The following are part of a mandatory choice: hex or string.

Introduced

16.0.R1

Platforms

All

number number

Synopsis

Number for DHCP or DHCPv6 option to filter on

Context

configure filter dhcp-filter number entry number option number number

Tree

number

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

present

Synopsis

Platforms

All

default-action

Synopsis

Enable the default-action context

Context

configure filter dhcp6-filter number default-action

Tree

default-action

Introduced

16.0.R1

Platforms

All

bypass-host-creation

Synopsis

Enable the bypass-host-creation context

Context

configure filter dhcp6-filter number default-action bypass-host-creation

Tree

Tree

drop

Notes

The following are part of a mandatory choice: bypass-host-creation or drop.

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure filter dhcp6-filter number description string

Tree

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure filter dhcp6-filter number entry number

Tree

Max. Elements

Introduced

16.0.R1

Platforms

All

[entry-id] number

Synopsis

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

na boolean

Synopsis

Bypass the DHCPv6 NA host creation

Context

configure filter dhcp6-filter number entry number action bypass-host-creation na boolean

Tree

Default

true

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

pd boolean

Synopsis

Bypass the DHCPv6 PD host creation

Context

configure filter dhcp6-filter number entry number action bypass-host-creation pd boolean

Tree

Default

true

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

drop

Synopsis

Introduced

16.0.R1

Platforms

All

invert boolean

Synopsis

Invert (partial) matching criteria

Context

configure filter dhcp6-filter number entry number option match invert boolean

Tree

invert

Default

false

Introduced

16.0.R1

Platforms

All

string string

Synopsis

Matching pattern for the filtered option

Context

configure filter dhcp6-filter number entry number option match string string

Tree

string

String Length

1 to 127

Notes

The following are part of a mandatory choice: hex or string.

Introduced

16.0.R1

Platforms

All

number number

Synopsis

ipv4

Synopsis

Enter the ipv4 context

Context

configure filter gre-tunnel-template string ipv4

Tree

ipv4

Introduced

16.0.R1

Platforms

All

destination-address [address] string

Synopsis

Add a list entry for destination-address

Context

configure filter gre-tunnel-template string ipv4 destination-address string

Tree

destination-address

Max. Elements

Introduced

16.0.R1

Platforms

All

[address] string

Synopsis

Destination IP address

Context

configure filter gre-tunnel-template string ipv4 destination-address string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

gre-key (keyword | number)

Synopsis

GRE key

Context

configure filter gre-tunnel-template string ipv4 gre-key (keyword | number)

Tree

gre-key

Options

if-index

Introduced

16.0.R1

Platforms

All

skip-ttl-decrement boolean

Synopsis

Platforms

VSR

description string

Synopsis

Platforms

VSR

description string

Synopsis

range

Synopsis

Enable the range context

Context

configure filter ip-exception string entry number match dst-port range

Tree

Notes

The following are part of a choice: eq, gt, lt, or range.

Introduced

20.10.R1

Platforms

VSR

end number

Synopsis

Specifies upper bound port to match.

Context

range

Synopsis

Enable the range context

Context

configure filter ip-exception string entry number match src-port range

Tree

Notes

The following are part of a choice: eq, gt, lt, or range.

Introduced

20.10.R1

Platforms

VSR

end number

Synopsis

Specifies upper bound port to match.

Context

configure filter ip-exception string entry number match src-port range end number

Tree

Range

1 to 65535

Notes

This element is mandatory.

Introduced

20.10.R1

Platforms

VSR

start number

Synopsis

Specifies lower bound port to match.

Context

configure filter ip-exception string entry number match src-port range start number

Tree

Range

0 to 65534

Notes

This element is mandatory.

Introduced

20.10.R1

Platforms

VSR

filter-id number

All

group number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Interface group ID for an external configured set of flowspec rules

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Global routing context

Context

configure filter ip-filter string embed openflow reference offset number grt

Tree

grt

Notes

This element is the default part of a choice.

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

sap reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

SAP context

Notes

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

system

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

System context

Context

configure filter ip-filter string embed openflow reference offset number system

Tree

system

Notes

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

vpls reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

VPLS context

Context

configure filter ip-filter string embed openflow reference offset number vpls reference

Tree

Reference

configure service vpls string

Notes

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

vprn reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

VPRN context

Context

Platforms

All

action

Synopsis

Enable the action context

Context

configure filter ip-filter string entry number action

Tree

action

Introduced

16.0.R1

Platforms

All

accept

Synopsis

Accept regular routing to forward a packet that matches this entry

Context

configure filter ip-filter string entry number action accept

configure filter ip-filter string entry number action accept-when pattern expression string

Tree

expression

String Length

3 to 18

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

mask string

Synopsis

Mask for the pattern expression

Context

configure filter ip-filter string entry number action accept-when pattern mask string

Tree

String Length

3 to 18

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

offset-type keyword

Synopsis

Starting point reference for offset value of pattern

Context

configure filter ip-filter string entry number action accept-when pattern offset-type keyword

Tree

Options

layer-3, layer-4, data, dns-qtype

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

offset-value number

Synopsis

Offset value for the pattern expression

Context

configure filter ip-filter string entry number action accept-when pattern offset-value number

Tree

Range

0 to 255

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

drop

Synopsis

Platforms

All

range

Synopsis

Enable the range context

Context

configure filter ip-filter string entry number action drop-when packet-length range

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound of the length range

Context

configure filter ip-filter string entry number action drop-when packet-length range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound of the length range

Context

Introduced

16.0.R4

Platforms

All

mask string

Synopsis

Mask for the pattern expression

Context

configure filter ip-filter string entry number action drop-when pattern mask string

Tree

String Length

3 to 18

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-type keyword

Synopsis

Starting point reference for offset value of pattern

Context

configure filter ip-filter string entry number action drop-when pattern offset-type keyword

Tree

Options

layer-3, layer-4, data, dns-qtype

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-value number

Synopsis

Offset value for the pattern expression

Context

configure filter ip-filter string entry number action drop-when pattern offset-value number

Tree

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

ttl

Synopsis

Enable the ttl context

Context

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound value

Context

configure filter ip-filter string entry number action drop-when ttl range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound value

Context

configure filter ip-filter string entry number action drop-when ttl range start number

Tree

Range

min to 254

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

fc keyword

Synopsis

Class name to be forwarded for matching packets

Context

configure filter ip-filter string entry number action fc keyword

Tree

Options

be, l2, af, l1, h2, ef, h1, nc

Introduced

16.0.R1

Platforms

All

forward

Synopsis

Enter the forward context

Context

configure filter ip-filter string entry number action forward

Tree

forward

Notes

The following are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust.

Introduced

16.0.R1

Platforms

All

bonding-connection number

Synopsis

Platforms

All

esi-l3

Synopsis

Enable the esi-l3 context

Context

configure filter ip-filter string entry number action forward esi-l3

Tree

esi-l3

Notes

The following are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target.

Introduced

16.0.R1

Platforms

All

esi-value string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

ESI of the first ESI-identified appliance

Context

configure filter ip-filter string entry number action forward esi-l3 esi-value string

Tree

esi-value

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

sf-ip string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

IP address of the service function to forward traffic

Context

configure filter ip-filter string entry number action forward esi-l3 sf-ip string

Tree

sf-ip

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

vas-interface reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Egress R-VPLS IP interface name

Context

configure filter ip-filter string entry number action forward esi-l3 vas-interface reference

Tree

vas-interface

Reference

configure service vprn string interface string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

vprn reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

VPRN service name

Context

configure filter ip-filter string entry number action forward esi-l3 vprn reference

Tree

vprn

Reference

configure service vprn string

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

gre-tunnel reference

Synopsis

GRE tunnel template ID that sets the location where an encapsulated matching packet is transported

Context

configure filter ip-filter string entry number action forward gre-tunnel reference

Tree

gre-tunnel

Reference

configure filter gre-tunnel-template string

Notes

The following are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target.

Introduced

16.0.R1

Platforms

All

lsp string

Synopsis

Platforms

All

nh-ip

Synopsis

address string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

All

redirect-policy reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Next hop or forward next hop router that forwards a packet that matches this entry

Context

Platforms

All

vpls reference

Synopsis

Platforms

All

vpls reference

Synopsis

Platforms

All

endpoint string

Synopsis

The SR-TE policy endpoint IPv4 address

Context

configure filter ip-filter string entry number action forward srte-policy endpoint string

Tree

endpoint

Notes

This element is mandatory.

Introduced

19.10.R1

Platforms

All

vprn-target

Synopsis

Platforms

All

lsp string

Synopsis

LSP that is specified to forward a packet matching this entry

Context

configure filter ip-filter string entry number action forward vprn-target lsp string

Tree

lsp

String Length

1 to 64

Introduced

16.0.R1

Platforms

All

vprn reference

Synopsis

Routing context used for route lookup

This element is mandatory.

Introduced

16.0.R1

Platforms

All

ignore-match

Synopsis

Ignore match criteria for the entry

Context

configure filter ip-filter string entry number action ignore-match

Tree

ignore-match

Notes

The following are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust.

Introduced

16.0.R1

Platforms

All

l2-aware-nat-bypass boolean

Synopsis

Divert traffic from an L2-Aware NAT subscriber

Context

configure filter ip-filter string entry number action l2-aware-nat-bypass boolean

Tree

l2-aware-nat-bypass

Description

When configured to true, the filter action selectively diverts traffic from a L2-Aware NAT subscriber away from NAT. This action is only applicable to L2-Aware NAT subscribers and must be configured together with action accept. Traffic identified in the match condition bypasses L2-Aware NAT. An example is to bypass NAT for on-net destinations (within the customer network).

For selective NAT bypass to take effect, in addition to IP filter configuration, the L2-Aware NAT subscriber must be specifically enabled for selective bypass via the allow-bypass configuration option in the configure subscriber-mgmt sub-profile nat allow-bypass context.

When configured to false, traffic that is not classified for bypass automatically diverts to L2-Aware NAT, unless it is explicitly configured in the IP filter action to be dropped.

Default

false

Introduced

20.5.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

nat

Synopsis

Enable the nat context

Context

configure filter ip-filter string entry number action nat

Tree

nat

Notes

The following are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

nat-policy reference

Warning:

Modifying this element clears ISA state, such as flow state, for the new value to take effect.

Synopsis

Platforms

All

range

Synopsis

Enable the range context

Context

configure filter ip-filter string entry number action rate-limit packet-length range

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound of the length range

Context

configure filter ip-filter string entry number action rate-limit packet-length range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound of the length range

Context

Introduced

16.0.R4

Platforms

All

mask string

Synopsis

Mask for the pattern expression

Context

configure filter ip-filter string entry number action rate-limit pattern mask string

Tree

String Length

3 to 18

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-type keyword

Synopsis

Starting point reference for offset value of pattern

Context

configure filter ip-filter string entry number action rate-limit pattern offset-type keyword

Tree

Options

layer-3, layer-4, data, dns-qtype

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-value number

Synopsis

Offset value for the pattern expression

Context

configure filter ip-filter string entry number action rate-limit pattern offset-value number

Tree

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

pir (number | keyword)

Synopsis

Peak information rate

Context

configure filter ip-filter string entry number action rate-limit pir (number | keyword)

Tree

pir

Range

0 to 2000000000

Units

kilobps

Options

max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

ttl

Synopsis

Enable the ttl context

Context

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound value

Context

configure filter ip-filter string entry number action rate-limit ttl range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound value

Context

configure filter ip-filter string entry number action rate-limit ttl range start number

Tree

Range

min to 254

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

reassemble

Synopsis

Introduced

16.0.R1

Platforms

All

router-instance string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

16.0.R1

Platforms

All

vpls reference

Synopsis

VPLS the sdp-bind-id belongs to

16.0.R1

Platforms

All

vpls reference

Synopsis

VPLS associated with the SDP

Context

configure filter ip-filter string entry number action secondary forward sdp vpls reference

Tree

Reference

configure service vpls string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

remark

Synopsis

Enable the remark context

Context

configure filter ip-filter string entry number action secondary remark

Tree

remark

Introduced

16.0.R1

Platforms

All

dscp keyword

Synopsis

Destination SAP

Context

configure filter ip-filter string entry number action secondary remark dscp keyword

Tree

Options

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

tcp-mss-adjust

Synopsis

Adjust MSS option of TCP matching packets to configured value of tcp-mss in router interface context

Context

configure filter ip-filter string entry number action tcp-mss-adjust

Tree

tcp-mss-adjust

Notes

The following are part of a mandatory choice: accept, drop, forward, gtp-local-breakout, http-redirect, ignore-match, nat, reassemble, or tcp-mss-adjust.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

description string

Synopsis

Platforms

All

dscp keyword

Synopsis

DSCP used as an IP filter match criterion

Context

configure filter ip-filter string entry number match dscp keyword

Tree

Options

Introduced

16.0.R1

Platforms

All

dst-ip

Synopsis

Enter the dst-ip context

Context

configure filter ip-filter string entry number match dst-ip

Tree

dst-ip

Introduced

16.0.R1

Platforms

All

address (ipv4-address | ipv4-prefix-with-host-bits)

Synopsis

IP address used as the match criterion

Context

configure filter ip-filter string entry number match dst-ip address (ipv4-address | ipv4-prefix-with-host-bits)

Tree

address

Notes

The following are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

All

ip-prefix-list reference

Synopsis

port-list reference

Synopsis

Platforms

All

start number

Synopsis

Lower bound of the port range as port match criterion

Context

configure filter ip-filter string entry number match dst-port range start number

Tree

Range

0 to 65534

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

fragment keyword

Synopsis

Match criterion for fragmented packets

Context

configure filter ip-filter string entry number match fragment keyword

Tree

fragment

Options

false, true, first-only, non-first-only

Introduced

16.0.R1

Platforms

All

icmp

Synopsis

Enter the icmp context

Context

configure filter ip-filter string entry number match icmp

Tree

icmp

Introduced

16.0.R1

Platforms

All

Platforms

All

range

Synopsis

Enable the range context

Context

configure filter ip-filter string entry number match packet-length range

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

19.5.R1

Platforms

All

end number

Synopsis

Upper bound of the length range

Context

configure filter ip-filter string entry number match packet-length range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

start number

Synopsis

Lower bound of the length range

Context

configure filter ip-filter string entry number match packet-length range start number

Tree

Range

min to 65534

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

port

Synopsis

Enter the port context

Context

Platforms

All

start number

Synopsis

Lower bound of the port range as port match criterion

Context

configure filter ip-filter string entry number match port range start number

Tree

Range

0 to 65534

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

protocol (number | keyword)

Synopsis

IP protocol identifier as a match criterion

Context

configure filter ip-filter string entry number match protocol (number | keyword)

Tree

protocol

Range

0 to 255

Options

Notes

The following are part of a choice: protocol or protocol-list.

Introduced

16.0.R1

Platforms

All

protocol-list reference

Synopsis

Name of the protocol list as a match criterion

Context

Platforms

All

ip-prefix-list reference

Synopsis

IP prefix list used as match criterion

Context

configure filter ip-filter string entry number match src-ip ip-prefix-list reference

Tree

ip-prefix-list

Reference

configure filter match-list ip-prefix-list string

Notes

The following are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

All

mask string

Synopsis

Platforms

All

mask string

Synopsis

MAC address mask as the match criterion

Context

configure filter ip-filter string entry number match src-mac mask string

Tree

Default

ff:ff:ff:ff:ff:ff

Introduced

19.5.R1

Platforms

All

src-port

Synopsis

Enter the src-port context

Context

Platforms

All

start number

Synopsis

Lower bound of the port range as port match criterion

Context

ns boolean

Synopsis

Match TCP NS as per value of the NS TCP flag bit

Context

configure filter ip-filter string entry number match tcp-flags ns boolean

pbr-down-action-override

Options

drop, forward, filter-default-action

Introduced

16.0.R1

Platforms

All

sample-profile reference

Synopsis

Cflowd sample profile ID for matching packets

Context

configure filter ip-filter string entry number sample-profile reference

Tree

sample-profile

Description

This command allows traffic matching an IPv4 or IPv6 filter to be sampled for cflowd processing using a specific sample-profile sample-profile-id. This option is only compatible if the associated interface is configured for interface-based

sampling and in only supported for ingress sampling. An IP filter can only specify a single alternate sample-profile for cflowd sampling, but that sample-profile can be used in multiple entries.

Reference

configure cflowd sample-profile number

Introduced

20.10.R1

Platforms

All

sticky-dest (number | keyword)

Synopsis

Time before action with available PBR or PBF destination and highest priority

Context

configure filter ip-filter string entry number sticky-dest (number | keyword)

Tree

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for entries from Credit Control

Context

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for subscriber host filter-rule entries from RADIUS/Diameter

Context

configure filter ip-filter string subscriber-mgmt host-specific-entry filter-rule range start number

Tree

Range

1 to 2097151

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

watermark

Synopsis

Enter the watermark context

Context

configure filter ip-filter string subscriber-mgmt host-specific-entry watermark

Tree

watermark

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

high number

Synopsis

High watermark for host-specific entries, to raise a table full alarm

Context

configure filter ip-filter string subscriber-mgmt host-specific-entry watermark high number

Tree

high

Range

0 to 100

Default

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

low number

Synopsis

Low watermark for host-specific entries, to clear a table full alarm

Context

configure filter ip-filter string subscriber-mgmt host-specific-entry watermark low number

Tree

low

Range

0 to 100

Range

1 to 2097151

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for shared filter-rules from RADIUS

Context

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for pcc-rule filter entries from Diameter

Context

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

low number

Synopsis

Limit of RADIUS or Diameter shared filters before clearing high watermark notification

Context

Enter the entry list instance

Context

configure filter ipv6-exception string entry number

Tree

Introduced

20.10.R1

Platforms

VSR

[entry-id] number

Synopsis

ID for a match criteria and the corresponding action

Context

configure filter ipv6-exception string entry number

Range

1 to 2097151

Notes

This element is part of a list key.

Introduced

20.10.R1

Platforms

VSR

description string

Synopsis

Platforms

VSR

ipv6-prefix-list reference

Synopsis

port-list reference

Synopsis

IP protocol to match

Context

configure filter ipv6-exception string entry number match next-header (number | keyword)

Tree

next-header

Range

0 to 255

Options

Introduced

20.10.R1

Platforms

VSR

port

Synopsis

Enter the port context

Context

mask string

Synopsis

IPv6 address mask as the match criterion

Context

configure filter ipv6-exception string entry number match src-ip mask string

Tree

Notes

The following are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

20.10.R1

Platforms

VSR

src-port

Synopsis

Enter the src-port context

Context

Platforms

VSR

start number

Synopsis

Lower bound of the port range as port match criterion

Context

configure filter ipv6-exception string entry number match src-port range start number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Interface group ID for an external configured set of flowspec rules

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Global routing context

Context

configure filter ipv6-filter string embed openflow reference offset number grt

Tree

grt

Notes

This element is the default part of a choice.

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

sap reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

SAP context

Context

configure filter ipv6-filter string embed openflow reference offset number sap reference

Tree

sap

Reference

configure service vpls string sap string

Notes

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

system

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

System context

Context

configure filter ipv6-filter string embed openflow reference offset number system

Tree

system

Notes

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

vpls reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

VPLS context

Context

configure filter ipv6-filter string embed openflow reference offset number vpls reference

Tree

Reference

configure service vpls string

Notes

The following are part of a choice: grt, system, (sap and vpls), or vprn.

Introduced

16.0.R4

Platforms

All

vprn reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

VPRN context

Context

Platforms

All

action

Synopsis

Enable the action context

Context

configure filter ipv6-filter string entry number action

Tree

action

Introduced

16.0.R1

Platforms

All

accept

Synopsis

Accept regular routing to forward a packet that matches this entry

Context

configure filter ipv6-filter string entry number action accept

configure filter ipv6-filter string entry number action accept-when pattern expression string

Tree

expression

String Length

3 to 18

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

mask string

Synopsis

Mask for the pattern expression

Context

configure filter ipv6-filter string entry number action accept-when pattern mask string

Tree

String Length

3 to 18

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

offset-type keyword

Synopsis

Starting point reference for offset value of pattern

Context

configure filter ipv6-filter string entry number action accept-when pattern offset-type keyword

Tree

Options

layer-3, layer-4, data, dns-qtype

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

offset-value number

Synopsis

Offset value for the pattern expression

Context

configure filter ipv6-filter string entry number action accept-when pattern offset-value number

Tree

Range

0 to 255

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

drop

Synopsis

Platforms

All

range

Synopsis

Enable the range context

Context

configure filter ipv6-filter string entry number action drop-when hop-limit range

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound value

Context

configure filter ipv6-filter string entry number action drop-when hop-limit range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound value

Context

Introduced

16.0.R4

Platforms

All

mask string

Synopsis

Mask for the pattern expression

Context

configure filter ipv6-filter string entry number action drop-when pattern mask string

Tree

String Length

3 to 18

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-type keyword

Synopsis

Starting point reference for offset value of pattern

Context

configure filter ipv6-filter string entry number action drop-when pattern offset-type keyword

Tree

Options

layer-3, layer-4, data, dns-qtype

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-value number

Synopsis

Offset value for the pattern expression

Context

configure filter ipv6-filter string entry number action drop-when pattern offset-value number

Tree

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

payload-length

Synopsis

Enable the payload-length context

Context

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound of the length range

Context

configure filter ipv6-filter string entry number action drop-when payload-length range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound of the length range

Context

configure filter ipv6-filter string entry number action drop-when payload-length range start number

Tree

Range

min to 65534

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

fc keyword

Synopsis

Class name to be forwarded for matching packets

Context

configure filter ipv6-filter string entry number action fc keyword

Tree

Options

be, l2, af, l1, h2, ef, h1, nc

Introduced

16.0.R1

Platforms

All

forward

Synopsis

Enter the forward context

Context

configure filter ipv6-filter string entry number action forward

Tree

forward

Notes

The following are part of a mandatory choice: accept, drop, forward, http-redirect, ignore-match, nat, or tcp-mss-adjust.

Introduced

16.0.R1

Platforms

All

bonding-connection number

Synopsis

Platforms

All

esi-l3

Synopsis

Enable the esi-l3 context

Context

configure filter ipv6-filter string entry number action forward esi-l3

Tree

esi-l3

Notes

The following are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target.

Introduced

16.0.R1

Platforms

All

esi-value string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

ESI of the first ESI-identified appliance

Context

configure filter ipv6-filter string entry number action forward esi-l3 esi-value string

Tree

esi-value

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

sf-ip string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

IP address of the service function to forward traffic

Context

configure filter ipv6-filter string entry number action forward esi-l3 sf-ip string

Tree

sf-ip

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

vas-interface reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Egress R-VPLS IP interface name

Context

configure filter ipv6-filter string entry number action forward esi-l3 vas-interface reference

Tree

vas-interface

Reference

configure service vprn string interface string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

vprn reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

VPRN service name

Context

configure filter ipv6-filter string entry number action forward esi-l3 vprn reference

Tree

vprn

Reference

configure service vprn string

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

gre-tunnel reference

Synopsis

GRE tunnel template ID that sets the location where an encapsulated matching packet is transported

Context

configure filter ipv6-filter string entry number action forward gre-tunnel reference

Tree

gre-tunnel

Reference

configure filter gre-tunnel-template string

Notes

The following are part of a choice: bonding-connection, esi-l2, esi-l3, gre-tunnel, lsp, mpls-policy, next-hop, redirect-policy, router-instance, sap, sdp, srte-policy, or vprn-target.

Introduced

16.0.R1

Platforms

All

lsp string

Synopsis

router-instance string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Routing context for route lookup for forwarding packets

Context

configure filter ipv6-filter string entry number action forward next-hop nh-ip-vrf router-instance string

Tree

router-instance

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

redirect-policy reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Next hop or forward next hop router that forwards a packet that matches this entry

Context

Platforms

All

vpls reference

Synopsis

Platforms

All

vpls reference

Synopsis

Platforms

All

endpoint string

Synopsis

The SR-TE policy endpoint IPv6 address

Context

configure filter ipv6-filter string entry number action forward srte-policy endpoint string

Tree

endpoint

Notes

This element is mandatory.

Introduced

19.10.R1

Platforms

All

vprn-target

Synopsis

Platforms

All

lsp string

Synopsis

LSP that is specified to forward a packet matching this entry

Context

configure filter ipv6-filter string entry number action forward vprn-target lsp string

Tree

lsp

String Length

1 to 64

Introduced

16.0.R1

Platforms

All

vprn reference

Synopsis

url (keyword | http-redirect-url)

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

URL that is used for redirecting

Context

nat-policy reference

Warning:

Modifying this element clears ISA state, such as flow state, for the new value to take effect.

Synopsis

NAT policy name when action is NAT

Context

configure filter ipv6-filter string entry number action nat nat-policy reference

Tree

nat-policy

Reference

configure service nat nat-policy string

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

nat-type keyword

Warning:

Modifying this element clears ISA state, such as flow state, for the new value to take effect.

Synopsis

NAT type to assign when action is NAT

Context

Platforms

All

range

Synopsis

Enable the range context

Context

configure filter ipv6-filter string entry number action rate-limit hop-limit range

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound value

Context

configure filter ipv6-filter string entry number action rate-limit hop-limit range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound value

Context

Introduced

16.0.R4

Platforms

All

mask string

Synopsis

Mask for the pattern expression

Context

configure filter ipv6-filter string entry number action rate-limit pattern mask string

Tree

String Length

3 to 18

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-type keyword

Synopsis

Starting point reference for offset value of pattern

Context

configure filter ipv6-filter string entry number action rate-limit pattern offset-type keyword

Tree

Options

layer-3, layer-4, data, dns-qtype

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

offset-value number

Synopsis

Offset value for the pattern expression

Context

configure filter ipv6-filter string entry number action rate-limit pattern offset-value number

Tree

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

payload-length

Synopsis

Enable the payload-length context

Context

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

All

end number

Synopsis

Upper bound of the length range

Context

configure filter ipv6-filter string entry number action rate-limit payload-length range end number

Tree

Range

1 to max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Synopsis

Lower bound of the length range

Context

configure filter ipv6-filter string entry number action rate-limit payload-length range start number

Tree

Range

min to 65534

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

pir (number | keyword)

Synopsis

Peak information rate

Context

configure filter ipv6-filter string entry number action rate-limit pir (number | keyword)

Tree

pir

Range

0 to 2000000000

Units

kilobps

Options

max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

remark

Synopsis

Enable the remark context

Context

configure filter ipv6-filter string entry number action remark

Tree

remark

Introduced

16.0.R1

Platforms

All

dscp keyword

Synopsis

Destination SAP

Context

configure filter ipv6-filter string entry number action remark dscp keyword

Tree

Options

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

sap-id reference

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

A packet matching the entry will be forwarded using the specified SAP

Context

configure filter ipv6-filter string entry number action secondary forward sap sap-id reference

Tree

sap-id

Reference

configure service vpls string sap string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

vpls reference

Synopsis

VPLS the sdp-bind-id belongs to

16.0.R1

Platforms

All

vpls reference

Synopsis

VPLS associated with the SDP

Context

configure filter ipv6-filter string entry number action secondary forward sdp vpls reference

Tree

Reference

configure service vpls string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

remark

Synopsis

Enable the remark context

Context

configure filter ipv6-filter string entry number action secondary remark

Tree

remark

Introduced

16.0.R1

Platforms

All

dscp keyword

Synopsis

Destination SAP

Context

configure filter ipv6-filter string entry number action secondary remark dscp keyword

Tree

Options

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

tcp-mss-adjust

Synopsis

Adjust MSS option of TCP matching packets to configured value of tcp-mss in router interface context

Context

configure filter ipv6-filter string entry number action tcp-mss-adjust

Tree

tcp-mss-adjust

Notes

The following are part of a mandatory choice: accept, drop, forward, http-redirect, ignore-match, nat, or tcp-mss-adjust.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

description string

Synopsis

destination-class number

Synopsis

Destination class as a match criterion

Context

configure filter ipv6-filter string entry number match destination-class number

Tree

destination-class

Description

Range

1 to 255

Introduced

20.7.R1

Platforms

All

dscp keyword

Synopsis

DSCP used as an IP filter match criterion

Context

configure filter ipv6-filter string entry number match dscp keyword

Tree

Options

Introduced

16.0.R1

Platforms

All

dst-ip

Synopsis

Enter the dst-ip context

Context

configure filter ipv6-filter string entry number match dst-ip

Tree

dst-ip

Introduced

16.0.R1

Platforms

All

address (ipv6-address | ipv6-prefix-with-host-bits)

Synopsis

IP address as the match criterion

Context

configure filter ipv6-filter string entry number match dst-ip address (ipv6-address | ipv6-prefix-with-host-bits)

Tree

address

Notes

The following are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R1

Platforms

All

ipv6-prefix-list reference

Synopsis

port-list reference

Synopsis

Platforms

All

start number

Synopsis

Lower bound of the port range as port match criterion

Context

configure filter ipv6-filter string entry number match dst-port range start number

Tree

Range

0 to 65534

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

extension-header

Synopsis

Enter the extension-header context

Context

configure filter ipv6-filter string entry number match extension-header

Tree

extension-header

Introduced

16.0.R1

Platforms

All

ah boolean

Synopsis

Match a packet as per the existence of an AH Extension Header

Context

configure filter ipv6-filter string entry number match extension-header ah boolean

Range

1 to 1048575

Default

1048575

Introduced

16.0.R1

Platforms

All

value number

Synopsis

Flow label as match criterion

Context

configure filter ipv6-filter string entry number match flow-label value number

Tree

value

Range

0 to 1048575

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

fragment keyword

Synopsis

Platforms

All

type number

Synopsis

ICMPv6 type value to match

Context

configure filter ipv6-filter string entry number match icmp type number

Tree

type

Range

0 to 255

Introduced

16.0.R1

Platforms

All

next-header (number | keyword)

Synopsis

IP protocol to match

Context

configure filter ipv6-filter string entry number match next-header (number | keyword)

Tree

next-header

Range

0 to 255

Options

Notes

The following are part of a choice: next-header or next-header-list.

Introduced

16.0.R1

Platforms

All

next-header-list reference

Synopsis

Name of the protocol list as a match criterion

Context

configure filter ipv6-filter string entry number match next-header-list reference

Tree

next-header-list

Reference

configure filter match-list protocol-list string

Notes

The following are part of a choice: next-header or next-header-list.

Introduced

20.7.R1

Platforms

All

packet-length

Synopsis

Tree

Notes

The following are part of a mandatory choice: eq, gt, lt, or range.

Introduced

19.5.R1

Platforms

All

end number

Synopsis

Upper bound of packet length range as match criterion

Context

configure filter ipv6-filter string entry number match packet-length range end number

Tree

Range

41 to max

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

start number

Synopsis

Lower bound of packet length range as match criterion

Context

configure filter ipv6-filter string entry number match packet-length range start number

Tree

Range

min to 65574

Notes

This element is mandatory.

Introduced

19.5.R1

Platforms

All

port

Synopsis

Enter the port context

Context

mask string

Synopsis

Platforms

All

mask string

Synopsis

MAC address mask as the match criterion

Context

configure filter ipv6-filter string entry number match src-mac mask string

Tree

Default

ff:ff:ff:ff:ff:ff

Introduced

19.5.R1

Platforms

All

src-port

Synopsis

Enter the src-port context

Context

Platforms

All

start number

Synopsis

Lower bound of the port range as port match criterion

Context

ns boolean

Synopsis

Match TCP NS as per value of the NS TCP flag bit

Context

configure filter ipv6-filter string entry number match tcp-flags ns boolean

pbr-down-action-override

Options

drop, forward, filter-default-action

Introduced

16.0.R1

Platforms

All

sample-profile reference

Synopsis

Cflowd sample profile ID for matching packets

Context

configure filter ipv6-filter string entry number sample-profile reference

Tree

sample-profile

Description

sampling and in only supported for ingress sampling. An IP filter can only specify a single alternate sample-profile for cflowd sampling, but that sample-profile can be used in multiple entries.

Reference

configure cflowd sample-profile number

Introduced

20.10.R1

Platforms

All

sticky-dest (number | keyword)

Synopsis

Time before action with available PBR or PBF destination and highest priority

Context

configure filter ipv6-filter string entry number sticky-dest (number | keyword)

Tree

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for entries from Credit Control

Context

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for subscriber host filter-rule entries from RADIUS/Diameter

Context

configure filter ipv6-filter string subscriber-mgmt host-specific-entry filter-rule range start number

Tree

Range

1 to 2097151

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

watermark

Synopsis

Enter the watermark context

Context

configure filter ipv6-filter string subscriber-mgmt host-specific-entry watermark

Tree

watermark

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

high number

Synopsis

High watermark for host-specific entries, to raise a table full alarm

Context

configure filter ipv6-filter string subscriber-mgmt host-specific-entry watermark high number

Tree

high

Range

0 to 100

Default

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

low number

Synopsis

Low watermark for host-specific entries, to clear a table full alarm

Context

configure filter ipv6-filter string subscriber-mgmt host-specific-entry watermark low number

Tree

low

Range

0 to 100

Range

1 to 2097151

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for shared filter-rules from RADIUS

Context

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of range for pcc-rule filter entries from Diameter

Context

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

low number

Synopsis

Limit of RADIUS or Diameter shared filters before clearing high watermark notification

Context

description string

Synopsis

Text description

Context

configure filter log number description string

Tree

String Length

0 to 80

Introduced

16.0.R1

Platforms

All

destination

Synopsis

Enter the destination context

Context

configure filter log number destination

Tree

destination

Introduced

16.0.R1

Platforms

All

memory

Synopsis

Enter the memory context

Context

configure filter log number destination memory

Tree

memory

Notes

This element is the default part of a choice.

The following are part of a choice: memory or syslog.

Introduced

16.0.R1

Platforms

All

max-entries number

Synopsis

Maximum number of memory entries that the log can store

Context

configure filter log number destination memory max-entries number

Tree

max-entries

Range

1 to 50000

Default

1000

Introduced

16.0.R1

Platforms

All

Platforms

All

mac-filter [filter-name] string

Synopsis

Enter the mac-filter list instance

Context

configure filter mac-filter string

Tree

mac-filter

Introduced

16.0.R1

Platforms

All

[filter-name] string

Synopsis

Filter name

Context

configure filter mac-filter string

String Length

1 to 64

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

default-action keyword

Synopsis

Action for packets that do not match any entry

Context

configure filter mac-filter string default-action keyword

Tree

default-action

Default

drop

Options

drop, accept

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure filter mac-filter string description string

Tree

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

embed

Synopsis

Enter the embed context

Context

configure filter mac-filter string embed

Tree

embed

Description

Commands in this context embed a previously defined MAC embedded filter policy or Hybrid OpenFlow switch instance into an exclusive, template, or system filter policy at the specified offset value. Rules derived from the BGP FlowSpec can also be embedded into template filter policies only.

For MAC filters, embedding is supported for VSD filters or filter entries only.

Introduced

16.0.R1

Platforms

All

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure filter mac-filter string entry number

Tree

Introduced

16.0.R1

Platforms

All

[entry-id] number

Synopsis

ID for a match criteria and the corresponding action

Context

configure filter mac-filter string entry number

Range

1 to 2097151

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

action

Synopsis

Enable the action context

Context

configure filter mac-filter string entry number action

Tree

action

Introduced

16.0.R1

Platforms

All

accept

Synopsis

Accept regular routing to forward a packet that matches this entry

Context

configure filter mac-filter string entry number action accept

Reference

configure service vpls string

Notes

This element is mandatory.

Introduced

16.0.R3

Platforms

All

sap

Synopsis

Enable the sap context

Context

configure filter mac-filter string entry number action forward sap

Tree

sap

Notes

The following are part of a choice: esi-l2, sap, or sdp.

Introduced

16.0.R1

Platforms

All

sap-id reference

Synopsis

VPLS Ethernet SAP ID used to forward matching packets

Context

configure filter mac-filter string entry number action forward sap sap-id reference

Tree

sap-id

Reference

configure service vpls string sap string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

vpls reference

Synopsis

Platforms

All

vpls reference

Synopsis

VPLS associated with the SDP

16.0.R1

Platforms

All

ignore-match

Synopsis

Options

max

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

secondary

Synopsis

A packet matching the entry will be forwarded using the specified SAP

Context

configure filter mac-filter string entry number action secondary forward sap sap-id reference

Tree

sap-id

Reference

configure service vpls string sap string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

vpls reference

Synopsis

VPLS the sdp-bind-id belongs to

16.0.R1

Platforms

All

vpls reference

Synopsis

mask number

Synopsis

802.1p mask value used as a MAC filter match criterion

Context

configure filter mac-filter string entry number match dot1p mask number

Tree

Range

1 to 7

Default

Introduced

16.0.R1

Platforms

All

priority number

Synopsis

IEEE 802.1p value used as a MAC filter match criterion

Context

configure filter mac-filter string entry number match dot1p priority number

Tree

priority

Range

0 to 7

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

Enable the inner-tag context

Context

configure filter mac-filter string entry number match inner-tag

Tree

inner-tag

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Mask to VID of the inner VLAN tag before comparing it with the inner-tag or outer-tag value

Context

start number

Synopsis

Lowest value of 24-bit service instance identifier for the service matching this entry

Context

configure filter mac-filter string entry number match isid range start number

Tree

Range

0 to 16777215

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

value number

Synopsis

Lowest value of 24-bit service instance identifier for the service matching this entry

Context

Introduced

16.0.R1

Platforms

All

mask number

Synopsis

Destination SAP mask

Context

Introduced

16.0.R1

Platforms

All

ssap number

Synopsis

Source or destination SAP value

Context

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

tag number

Synopsis

Options

no-hold-time-up

Introduced

16.0.R1

Platforms

All

filter-id number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

MAC filter ID

Context

configure filter mac-filter string filter-id number

Tree

filter-id

Range

1 to 65535

Introduced

16.0.R1

Platforms

All

scope keyword

Synopsis

Scope of this filter definition

Context

configure filter mac-filter string scope keyword

Tree

scope

Default

template

Options

exclusive, template, embedded, system

Introduced

16.0.R1

Platforms

All

type keyword

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

MAC filter policy

Context

Introduced

16.0.R1

Platforms

All

group string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Regular expression to match against the base router BGP instance group configuration

Context

configure filter match-list ip-prefix-list string apply-path bgp-peers number group string

Tree

group

String Length

1 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

neighbor string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Regular expression to match against the base router BGP instance neighbor configuration

Context

configure filter match-list ip-prefix-list string apply-path bgp-peers number neighbor string

Context

configure filter match-list ip-prefix-list string prefix-exclude string

Notes

This element is part of a list key.

Introduced

16.0.R4

Platforms

All

ipv6-prefix-list [prefix-list-name] string

Synopsis

Enter the ipv6-prefix-list list instance

Context

configure filter match-list ipv6-prefix-list string

Tree

ipv6-prefix-list

Introduced

16.0.R1

Platforms

All

[prefix-list-name] string

Synopsis

Platforms

All

group string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Regular expression to match against the base router BGP instance group configuration

Context

configure filter match-list ipv6-prefix-list string apply-path bgp-peers number group string

Tree

group

String Length

1 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

neighbor string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Regular expression to match against the base router BGP instance neighbor configuration

Context

configure filter match-list ipv6-prefix-list string apply-path bgp-peers number neighbor string

Platforms

All

Add a list entry for protocol

Context

configure filter match-list protocol-list string protocol (number | keyword)

Tree

protocol

Max. Elements

Introduced

20.7.R1

Platforms

All

[protocol-id] (number | keyword)

Synopsis

IP protocol identifier

Context

end number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Upper value of the ID range, must be greater than or equal to start value

Context

configure filter md-auto-id filter-id-range end number

Tree

Range

1 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

start number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Lower value of the ID range, must be less than or equal to end value

Context

Platforms

All

admin-state keyword

Synopsis

Administrative state of the policy

Context

configure filter redirect-policy string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure filter redirect-policy string destination (ipv4-address-no-zone | ipv6-address-no-zone) description string

Tree