(Optional) Disabling URPF for Specified Traffic
Only the CE12800E supports this function.
Background
After URPF check is enabled on an interface, the device performs the URPF check on all the packets passing through the interface. To prevent the packets of a certain type from being discarded, you can disable URPF check for these packets. For example, if the device is configured to trust all the packets from a certain server, the device does not check these packets. If you need to disable URPF check, you can run commands in the traffic behavior view and associate the traffic behavior and a traffic classifier with a traffic policy. When the traffic policy is applied globally or applied to an interface, or a VLAN, the device does not perform URPF check on the traffic that matches the traffic classifier rules.
Procedure
- Configure a traffic classifier.
- Run traffic classifier classifier-name [ type { and | or } ]
A traffic classifier is created and the traffic classifier view is displayed, or the view of an existing traffic classifier is displayed.
and is the logical operator between rules in a traffic classifier, which means that:If a traffic classifier contains ACL rules, packets match the traffic classifier only if they match one ACL rule and all the non-ACL rules.
If a traffic classifier does not contain any ACL rules, packets match the traffic classifier only if they match all the rules in the classifier.
By default, the relationship between rules in a traffic classifier is or.
Run if-match
Matching rules are defined for the traffic classifier.
For details about matching rules in a traffic classifier, see "Configuring a Traffic Classifier" in "MQC Configuration" of the CloudEngine 12800 and 12800E Series SwitchesConfiguration Guide - QoS Configuration Guide.
Run commit
The configuration is committed.
Run quit
Exit from the traffic classifier view.
- Run traffic classifier classifier-name [ type { and | or } ]
- Configure a traffic behavior.
Run traffic behavior behavior-name
A traffic behavior is created and the traffic behavior view is displayed, or the view of an existing traffic behavior is displayed.
Run ip urpf disable
URPF check is disabled for the specified traffic.
By default, URPF check disabling is not configured in a traffic behavior.
Run commit
The configuration is committed.
Run quit
Exit from the traffic behavior view.
Run quit
Exit from the system view.
- Configure a traffic policy.
Run system-view
The system view is displayed.
Run traffic policy policy-name
A traffic policy is created and the traffic policy view is displayed, or the view of an existing traffic policy is displayed.
Run classifier classifier-name behavior behavior-name [ precedence precedence-value ]
A traffic behavior is bound to a traffic classifier in the traffic policy.
Run commit
The configuration is committed.
Run quit
Exit from the traffic policy view.
Run quit
Exit from the system view.
- Apply the traffic policy.
- Applying a traffic policy to an interface
Run system-view
The system view is displayed.
Run interface interface-type interface-number
The interface view is displayed.
Run traffic-policy policy-name { inbound | outbound }
A traffic policy is applied to the interface.
Run commit
The configuration is committed.
- Applying a traffic policy to a VLAN
Run system-view
The system view is displayed.
Run vlan vlan-id
The VLAN view is displayed.
Run traffic-policy policy-name { inbound | outbound }
A traffic policy is applied to the VLAN.
The system applies traffic policing to the packets that belong to the VLAN and match traffic classification rules in the inbound or outbound direction.
Run commit
The configuration is committed.
- Applying a traffic policy to the system or an LPU
Run system-view
The system view is displayed.
Run traffic-policy policy-name global [ slot slot-id ] { inbound | outbound }
A traffic policy is applied to the system or an LPU.
Run commit
The configuration is committed.
- Applying a traffic policy in a VPN instance
Run system-view
The system view is displayed.
(Optional) Run qos port-group group-id
A QoS port group is created and the QoS port group view is displayed.
The CE12800E configured with ED-E, EG-E, and EGA-E series cards does not support the QoS interface group configuration.
(Optional) Run group-member { interface-type interface-number1 [ to interface-type interface-number2 ] }
The specified interfaces are added to the QoS interface group.
(Optional) Run quit
Exit from the QoS interface group view.
Run ip vpn-instance vpn-instance-name
A VPN instance is created and its view is displayed.
Run traffic-policy policy-name inbound [ exclude qos port-group group-id ]
A traffic policy is applied to the VPN instance.
Run commit
The configuration is committed.
- Applying a traffic policy to a BD
Run system-view
The system view is displayed.
Run bridge-domain bd-id
The BD view is displayed.
Run traffic-policy policy-name { inbound | outbound }
A traffic policy is applied to the BD.
Run commit
The configuration is committed.
- Applying a traffic policy to a QoS group
Run system-view
The system view is displayed.
Run qos group group-name
The QoS group view is displayed.
Run the following commands as required:
Run the group-member interface { interface-type interface-number1 [ to interface-type interface-number2 ] } &<1-8> command to add interfaces to the QoS group.
Run the group-member vlan { vlan-id1 [ to vlan-id2 ] } &<1-8> command to add VLANs to the QoS group.
(For CE12800E) Run the group-member ip source ip-address { mask | mask-length } command to add source IP addresses to the QoS group.
Run traffic-policy policy-name { inbound | outbound }
A traffic policy is applied to the QoS group.
Run commit
The configuration is committed.
- Applying a traffic policy to an interface