Configuring Packet Filtering

Context

A device configured to use packet filtering implements traffic control to filter packets that match traffic classification rules.

Procedure

1. Configure a traffic classifier.

   1. Run system-view

      The system view is displayed.

   2. Run traffic classifier classifier-name [ operator { and | or } ]

      A traffic classifier is created and the traffic classifier view is displayed.

      and indicates that rules are ANDed with each other.

      • If a traffic classifier contains ACL rules, packets match the traffic classifier only when they match one ACL rule and all the non-ACL rules.

      • If a traffic classifier does not contain ACL rules, packets match the traffic classifier only when the packets match all the non-ACL rules.

      or indicates that the relationship between rules is OR. Packets match a traffic classifier as long as packets match only one rule of the traffic classifier.

      By default, the relationship between rules in a traffic classifier is OR.

   3. Run the following commands as required.

      Matching Rule	Command
      Outer VLAN ID	if-match vlan-id start-vlan-id [ to end-vlan-id ]
      Inner VLAN IDs in QinQ packets	if-match cvlan-id start-vlan-id [ to end-vlan-id ]
      802.1p priority in VLAN packets	if-match 8021p 8021p-value &<1-8>
      Inner 802.1p priority in QinQ packets	if-match cvlan-8021p 8021p-value &<1-8>
      EXP priority in MPLS packets (AR1200&AR2200&AR3200&AR3600 series)	if-match mpls-exp exp-value &<1-8>
      Destination MAC address	if-match destination-mac mac-address [ mac-address-mask mac-address-mask ]
      Source MAC address	if-match source-mac mac-address [ mac-address-mask mac-address-mask ]
      DLCI value in FR packets	if-match dlci start-dlci-number [ to end-dlci-number ]
      DE value in FR packets	if-match fr-de
      Protocol type field encapsulated in the Ethernet frame header	if-match l2-protocol { arp | ip | mpls | rarp | protocol-value }
      All packets	if-match any
      DSCP priority in IP packets	if-match [ ipv6 ] dscp dscp-value &<1-8> NOTE: If DSCP priority matching is configured in a traffic policy, the SAE220 (WSIC) and SAE550 (XSIC) cards do not support redirect ip-nexthop ip-address post-nat.
      IP precedence in IP packets	if-match ip-precedence ip-precedence-value &<1-8> NOTE: if-match [ ipv6 ] dscp and if-match ip-precedence cannot be configured simultaneously in a traffic classifier where the relationship between rules is AND.
      Layer 3 protocol type	if-match protocol { ip | ipv6 }
      QoS group index of packets	if-match qos-group qos-group-value
      IPv4 packet length	if-match packet-length min-length [ to max-length ]
      PVC information in ATM packets	if-match pvc vpi-number/vci-number
      RTP port number	if-match rtp start-port start-port-number end-port end-port-number
      SYN Flag in the TCP packet header	if-match tcp syn-flag { ack | fin | psh | rst | syn | urg } *
      Inbound interface	if-match inbound-interface interface-type interface-number
      Outbound interface	if-match outbound-interface Cellular interface-number:channel
      ACL rule	if-match acl { acl-number | acl-name } NOTE: Before defining a matching rule for traffic classification based on an ACL, create the ACL. To use an ACL in a traffic classifier to match the source IP address, run the qos pre-nat command on an interface to configure NAT pre-classification. NAT pre-classification enables the NAT-enabled device to carry the private IP address before translation on the outbound interface so that the NAT-enabled device can classify IP packets based on private IP addresses and provide differentiated services.
      ACL6 rule	if-match ipv6 acl { acl-number | acl-name } NOTE: Before defining a matching rule for traffic classification based on an ACL, create the ACL. To use an ACL in a traffic classifier to match the source IP address, run the qos pre-nat command on an interface to configure NAT pre-classification. NAT pre-classification enables the NAT-enabled device to carry the private IP address before translation on the outbound interface so that the NAT-enabled device can classify IP packets based on private IP addresses and provide differentiated services.
      Application protocol	if-match application application-name [ user-set user-set-name ] [ time-range time-name ] NOTE: Before defining a matching rule based on an application protocol, enable Smart Application Control (SA) and load the signature file.
      SA group	if-match category category-name [ user-set user-set-name ] [ time-range time-name ] NOTE: Before defining a matching rule based on an application protocol, enable Smart Application Control (SA) and load the signature file.
      User group	if-match user-set user-set-name [ time-range time-range-name ]

   4. Run quit

      Exit from the traffic classifier view.

2. Configure a traffic behavior.

   1. Run traffic behavior behavior-name

      A traffic behavior is created and the traffic behavior view is displayed, or the view of an existing traffic behavior is displayed.

   2. Run the following commands as required.

      • Run permit

        The device is configured to forward packets matching the traffic classifier based on the original policy.

      • Run deny

        The device is configured to reject packets matching the traffic classifier.

      • When permit and other actions are configured in a traffic behavior, the actions are performed in sequence. If the deny action is configured together with other actions, only the deny action (and traffic statistics, if configured) can take effect.

      • To specify the packet filtering action for packets matching an ACL rule that defines permit, the action taken for the packets depends on deny or permit in the traffic behavior. If the ACL rule defines deny, the packets are discarded regardless of whether deny or permit is configured in the traffic behavior.

   3. (Optional) Run statistic enable

      The traffic statistics function is enabled.

   4. Run quit

      Exit from the traffic behavior view.

   5. Run quit

      Exit from the system view.

3. Configure a traffic policy.

   1. Run system-view

      The system view is displayed.

   2. Run traffic policy policy-name

      A traffic policy is created and the traffic policy view is displayed, or the view of an existing traffic policy is displayed.

      By default, no traffic policy is created in the system.

   3. Run classifier classifier-name behavior behavior-name [ precedence precedence-value ]

      A traffic behavior is bound to a traffic classifier in a traffic policy.

      By default, no traffic classifier or traffic behavior is bound to a traffic policy.

   4. Run quit

      Exit from the traffic policy view.

   5. Run quit

      Exit from the system view.

4. Apply the traffic policy.

   • Apply the traffic policy to an interface.

     1. Run system-view

        The system view is displayed.

     2. Run interface interface-type interface-number[.subinterface-number ]

        The interface view is displayed.

     3. Run traffic-policy policy-name { inbound | outbound }

        The traffic policy is applied to the inbound or outbound direction on the interface.

        By default, no traffic policy is applied to an interface.

   • Apply the traffic policy to an interzone.

     Only the AR100&AR120&AR150&AR160&AR200 series routers support this configuration.

     1. Run system-view

        The system view is displayed.

     2. Run firewall interzone zone-name1 zone-name2

        An interzone is created and the interzone view is displayed.

        By default, no interzone is created.

        You must specify two existing zones for the interzone.

     3. Run traffic-policy policy-name

        The traffic policy is bound to the interzone.

        By default, no traffic policy is bound to an interzone.

   • Apply the traffic policy to a BD.

     Only the AR100&AR120&AR150&AR160&AR200&AR1200 series routers and the AR2220E support this configuration.

     1. Run system-view

        The system view is displayed.

     2. Run bridge-domain bd-id

        A BD is created and the BD view is displayed.

        By default, no BD is created.

     3. Run traffic-policy policy-name { inbound | outbound }

        The traffic policy is applied to the BD.

        By default, no traffic policy is applied to a BD.

   • Apply the traffic policy in the system view.

     1. Run system-view

        The system view is displayed.

     2. Run traffic-policy policy-name global bind interface { interface-type interface-number }&<1-16>

        The traffic policy is applied to the system and bound to the interface.

        By default, no traffic policy is applied to the system or bound to any interface of an AR.

        Classifiers in a global traffic policy cannot be used to match the EXP field of MPLS packets or applied to IPv6 packets. The remark mpls-exp action cannot be configured in a global traffic policy.

        If an interface-based traffic policy is applied to the interface where a global traffic policy is applied, the traffic policies take effect according to the following rules:

        • If the redirecting action is configured in both traffic policies, only the redirecting behavior in the interface-based traffic policy is valid.
        • In other cases, the device executes the traffic behavior in the interface-based traffic policy and then the traffic behavior in the global traffic policy.

Verifying the Configuration

• Run the display traffic classifier { system-defined | user-defined } [ classifier-name ] command to check the traffic classifier configuration.
• Run the display traffic behavior { system-defined | user-defined } [ behavior-name ] command to check the traffic behavior configuration.

• Run the display traffic policy user-defined [ policy-name [ classifier classifier-name ] ] command to check the traffic policy configuration.

• Run the display traffic-policy applied-record [ policy-name ] command to check the application record of a traffic policy.