Network And Service (Access) Interface-Based Filtering - Alcatel-Lucent 7705 Configuration Manual

Configuring Filter Policies
CSM Filters
The 7705 SAR supports IPv4 and IPv6 CSM filters. For information on CSM filters, refer to
the 7705 SAR OS System Management Guide, "CSM Filters and CSM Security".

Network and Service (Access) Interface-based Filtering

IP and MAC filter policies specify either a forward or a drop action for packets, based on
information specified in the match criteria. Within each filter policy, you can create entries
that define matching criteria.
The same IP filter policy can be assigned to any entity (network interfaces, IP pseudowires,
Ethernet pseudowires, VPLS services, VPRN services, and IES services), all of which can be
configured on the same adapter card. For example, a filter policy with filter-id defined as
filter-5 can be assigned to multiple Ipipe SAPs and, simultaneously, to network interfaces on
the same adapter card.
A filter policy assigned to an entity on one adapter card can also be assigned to any entity on
another adapter card. For example, a filter policy with filter-id defined as filter-2 can be
assigned to an Epipe on an Ethernet Adapter card and to a network interface on another
Ethernet Adapter card.
An interface that supports IPv6 can have both IPv4 and IPv6 filters assigned to it; these are
counted as two unique filters.
Both IP and MAC filter policies are supported per adapter card, and assigning the same filter
policy to different entities on a card counts as using one filter policy.
Filter entry matching criteria can be as general or specific as required, but all conditions in
the entry must be met in order for the packet to be considered a match and the specified entry
action performed. The process stops when the first complete match is found and the action
defined in the entry is executed (that is, packets that match the criteria are either dropped or
forwarded).
Configuration and assignment of IP and MAC filter policies is similar for network interfaces,
IES management SAPs, Ethernet and IP pseudowire SAPs, VPRN and IES interface SAPs
and spoke SDPs, and VPLS SAPs and SDPs (spoke and mesh). This guide describes the
assignment of filter policies to network interfaces. For detailed information on assigning
filters to a service, refer to the 7705 SAR OS Services Guide; see "IP Filters" (under
"Ethernet VLL (Epipe) Services" and "IP Interworking VLL (Ipipe) Services") for
information on assigning IP filter policies to SAPs and spoke SDPs, and see "MAC Filters"
(under VPLS Features), for information on assigning MAC filter policies to VPLS SAPs and
SDPs.
276 7705 SAR OS Router Configuration Guide