hardware-profile filter for Qumran-2

Use this command to enable or disable ingress IPv4 or IPv6, egress IPv6 filter groups, EVPN-MPLS,VxLAN filter and TWAMP IPv4 or IPv6 groups. Disabling filter groups increases the configurable filter entries.

Disabling a TCAM filter group is not allowed if the group has any entries configured in hardware. Group dependent entries must be explicitly removed before disabling the TCAM group.

 

  • This feature is supported for IPv4 unicast and IPv4 BGP/MPLS VPN service based on RFC 8955.
  • Use the ingress-IPv4-subif and ingress-IPv6-subif-ext groups when ACL is required on the subinterfaces and IRB interfaces only. Use ingress-IPv4-ext and ingress-IPv6 groups when ACL is required on physical, subinterface and LAGClosed Link Aggregation Group.

  • Updating the access list may take a long time in a scaled configuration because the hardware must reshuffle the filter entries when configuring a high-priority filter.
  • In the ingress direction, Qumran-2C (Q2C) series platforms hardware supports stats for 16k filter entries, andQumran-2A (Q2A) series platforms supports 8k filter entries. For the egress direction,Qumran-2C (Q2C) series platforms supports 8k, and Qumran-2A (Q2A) series platforms supports 4k.
  • In Qumran2 (Q2) series platforms, either two 160-bit groups or one 320-bit group can be created in the egress direction.
  • In Qumran2 series platforms, Egress ACls are not applicable for packets which sent from cpu.

  • Disabling and Enabling the hardware-profile filter command in a single commit is not recommended.

Example:

OcNOS(config)#hardware-profile filter ingress-ipv4 disable

OcNOS(config)#hardware-profile filter ingress-ipv4-ext enable

OcNOS(config)#commit

  • Configuring and unconfiguring access-list to the interface in a single commit is not recommended.

Example:

OcNOS(config)#interface xe8

OcNOS(config-if)#no ip access-group ACL1v4 out

OcNOS(config-if)#exit

OcNOS(config)#interface xe3

OcNOS(config-if)#ip access-group ACL2v4 out

OcNOS(config-if)#commit

  • For better utilization of TCAM resources it is recommended to enable large groups first and then smaller groups.

Enabling TWAMP hardware profiles requires a system reboot.

Example

Copy
hardware-profile filter qos-policer enable                # QoS policer/storm control
hardware-profile filter ingress-ipv6 enable              # IPV6 ACL 
hardware-profile filter ingress-l2-subif enable       # MAC ACL
hardware-profile filter ingress-ipv4-subif enable   # IPv4 ACL 

Command Syntax

Copy
hardware-profile filter (dhcp-snoop|dhcp-snoop-ipv6|egress-dst-
ipv6|egressipv4|egress-ipv4-ext|egress-ipv6|egress-l2|egress-l2-ext|egress-qospolicer|egress-
qos-policer-ext|egress-src-ipv6|ingress-arp|ingress-ipv4|ingressipv4-ext|ingress-ipv4-
qos|ingress-ipv4-qos-copp|ingress-ipv4-subif|ingress-ipv6|ingress-ipv6- ext|ingress-ipv6-ext-
vlan|ingress-ipv6-qos|ingress-l2|ingress-l2-ext|ingress-l2- subif|ipsg|ipsg-ipv6|qos|qos-ext|qos-
ipv6|qos-policer|evpn-mpls-cw|evpn-mplsmh|vxlan|vxlan-mh|twamp-ipv4|twamp-ipv6|twamp-
ipv6-mpls|vxlan|ipv4-bgpflowspec|) (enable|disable)

Parameters

dhcp-snoop

Ingress DHCPClosed Dynamic Host Configuration Protocol Snooping group

dhcp-snoop-ipv6

Ingress IPv6 DHCP Snooping group

ingress-arp

Ingress ARP group for ARP ACL support

ingress-l2

Ingress L2 ACL filter group.

ingress-l2-ext

Ingress L2 ACL, QoS, mirror filter group.

ingress-l2-subif

Ingress L2 group for ACL on L2/L3 Subinterfaces.

ipsg

Ingress IP Source Guard group

ipsg-ipv6

Ingress IPv6 Source Guard group

ingress-ipv4

Ingress IP ACL filter group.

ingress-ipv4-ext

Ingress IP ACL, mirror, PBR filter group.

ingress-ipv4-qos

Ingress IPv4 group for ACL match QoS.

ingress-ipv4-subif

Ingress IPv4 group for ACL on L2/L3 Subinterfaces.

ingress-ipv6

Ingress IPv6 ACL, mirror, PBR filter group

Ingress-ipv4-qos-copp

Ingress IPv4 group for ACL match QoS and CoPP.

ingress-ipv6-ext

Ingress IPv6 extended group with 128-bit address support for ACL , ACL match QOS on physical interfaces.

ingress-ipv6-ext-vlan

Ingress IPv6 extended group with 128-bit address support for ACL, ACL match QOS on SVIClosed Switched Virtual Interface interfaces.

ingress-ipv6-ext-subif

Ingress IPv6 extended group with 128-bit address support for ACL, ACL match QOS on Sub interfaces.

ingress-ipv6-qos

Ingress IPv6 group for ACL match QoS.

qos-ipv6

Ingress QOS IPv6 group for IPv6 QoS support with statistics.

qos

Ingress QoS filter group

qos-ext

Ingress QoS extended filter group.

qos-ipv6

Ingress QOS IPv6 group for IPv6 QoS support with statistics

qos-policer

Ingress extended QoS group for hierarchical policer support with statistics.

egress-l2

Egress L2 ACL filter group

egress-l2-mlag

Egress L2 group for ACL only on MLAG interface.

egress-l2-ext

Egress L2 extended (mac) group for ACL on subinterface.

egress-dst-ipv6

Egress Destination IPv6 group for ACL

egress-ipv4

Egress IP ACL filter group.

egress-ipv4-ext

Egress IPv4 extended group for ACL on subinterface

egress-ipv6

Egress IPv6 group for ACL

egress-qos-policer

Egress QoS policer group only for physical and LAG interface

egress-qos-policer-ext

Egress extended QOS policer group

egress-src-ipv6

Egress Source IPv6 group for ACL

twamp-ipv4

Ingress TWAMP IPv4 Forwarding group.

twamp-ipv6

Ingress TWAMP IPv6 Forwarding group.

twamp-ipv6-mpls

Ingress TWAMP IPv6 MPLS Forwarding group.

ipv4-bgp-flowspec

BGP FlowSpec filter group.

evpn-mpls-mh

Ingress EVPN MPLS Multi-Homing Forwarding Group

vxlan

Ingress VxLAN Forwarding group

vxlan-mh

Ingress VxLAN Multi-Homing Forwarding Group.

vxlan

Ingress Vxlan Forwarding group

enable

Enable filter group.

disable

Disable filter group

Default

By default, all filter groups are disabled.

Command Mode

Configure mode

Applicability

This command was introduced before OcNOS version 1.3 and changed in OcNOS version 3.0.

Examples

Copy
OcNOS#configure terminal 
OcNOS(config)#hardware-profile filter ingress-ipv4 enable 
OcNOS(config)#hardware-profile filter ingress-ipv4 disable    
 
OcNOS(config)#hardware-profile filter egress-ipv4 enable
OcNOS(config)#hardware-profile filter egress-ipv4 disable
Table 122.

Supported groups and the feature dependency on the groups

Group

Key Size

Security

QoS

PBR

Mirror

Statistics

 

 

 

 

 

 

Q2U

Q2A

Q2C, J2C+

dhcp-snoop

160

Yes

No

N/A

No

Yes

Yes

Yes

Dhcp-snoop-ipv6

160

Yes

No

N/A

No

Yes

Yes

Yes

Ingress-arp

320

Yes

No

N/A

No

Yes

Yes

Yes

ingress-l2

160

Yes

No

N/A

No

Yes

Yes

Yes

ingress-l2-ext

320

Yes

No

N/A

Yes

Yes

Yes

Yes

ingress-l2-subif

160

Yes

No

N/A

No

Yes

Yes

Yes

ingress-ipv4

160

Yes

No

No

No

Yes

Yes

Yes

ingress-ipv4-ext

320

Yes

No

Yes

Yes

Yes

Yes

Yes

ingress-ipv4-qos

320

N/A

Yes

N/A

N/A

Yes

Yes

Yes

ingress-ipv4-subif

160

Yes

No

Yes

No

Yes

Yes

Yes

ingress-ipv6

320

Yes

No

Yes

Yes

Yes

Yes

Yes

Ingress-ipv6-ext

320

N/A

Yes

No

Yes

Yes

Yes

Yes

Ingress-ipv6-ext-vlan

320

N/A

Yes

No

Yes

Yes

Yes

Yes

Ingress-ipv6-ext-subif

320

N/A

Yes

No

Yes

Yes

Yes

Yes

ingress-ipv6-qos

320

N/A

Yes

N/A

N/A

Yes

Yes

Yes

Ipsg

160

Yes

No

N/A

N/A

Yes

Yes

Yes

Ipsg-ipv6

160

Yes

No

N/A

N/A

Yes

Yes

Yes

qos-ipv6

320

N/A

Yes

N/A

N/A

Yes

Yes

Yes

qos

160

N/A

Yes

N/A

N/A

Yes

Yes

Yes

qos-ext

320

N/A

Yes

N/A

N/A

Yes

Yes

Yes

qos-policer

320

N/A

Yes

N/A

N/A

Yes

Yes

Yes

egress-l2

320

Yes

N/A

N/A

N/A

Yes

Yes

Yes

egress-l2-mlag

80

Yes

N/A

N/A

N/A

Yes

Yes

Yes

egress-l2-ext

160

Yes

N/A

N/A

N/A

Yes

Yes

Yes

egress-dst-ipv6

160

Yes

N/A

N/A

N/A

Yes

Yes

Yes

egress-ipv4

160

Yes

N/A

N/A

N/A

Yes

Yes

Yes

egress-ipv4-ext

320

Yes

N/A

N/A

N/A

Yes

Yes

Yes

Egress-ipv6

320

Yes

N/A

N/A

N/A

Yes

Yes

Yes

Egress-qos-policer

160

No

Yes

N/A

N/A

Yes

Yes

Yes

Egress-qos-policer-ext

160

No

Yes

N/A

N/A

Yes

Yes

Yes

Egress-src-ipv6

160

Yes

No

N/A

N/A

Yes

Yes

Yes

evpn-mpls-mh

160

N/A

N/A

N/A

N/A

Yes

Yes

Yes

vxlan

160

N/A

N/A

N/A

N/A

Yes

Yes

Yes

vxlan-mh

160

N/A

N/A

N/A

N/A

Yes

Yes

Yes

twamp-ipv4

(Having MPLS enabled SKUs)

320

N/A

N/A

N/A

N/A

Yes

Yes

Yes

Twamp-ipv4

(MPLS disabled SKUs)

160

N/A

N/A

N/A

N/A

Yes

Yes

Yes

twamp-ipv6

320

N/A

N/A

N/A

N/A

Yes

Yes

Yes

twamp-ipv6-mpls

320

N/A

N/A

N/A

N/A

Yes

Yes

Yes

Vxlan

160

N/A

N/A

N/A

N/A

Yes

Yes

Yes

Ipv4-bgp-flowspec

320

N/A

N/A

N/A

N/A

No

No

No

Table 123.

Comparison between basic and extended group qualifiers

Basic Group

Extended Qualifiers

Supported Actions

Extended Group

Supported Qualifiers

Supported Actions

dhcp-snoop

SourcePort

L4 DestinationPort

IPv4 Protocol

Destination Mac

InterfaceClass

Ethertype

Vlan

 

 

 

 

dhcp-snoop-ipv6

L4 Destination port

IP6NextHeader

DstIp6High

Ethertype

 

 

 

 

ingress-l2

Source MAC

Destination MAC

Ether Type

VLAN ID

Inner VLAN ID

Permit, Deny

ingress-l2-ext

Source MAC

Destination MAC

Ether Type

VLAN ID

Inner VLAN ID

COS

Inner CoS

IPv4 Protocols

Permit, Deny, Policer, Mirror, Assign Queue, COS Remark

ingress-l2-subif

Source Mac

Destination Mac

Ethertype

Permit, Deny

 

 

 

ingress-ipv4

Source IP

Destination IP

IP Protocols

L4 Dest Ports

L4 Src Ports

Permit, Deny

ingress-ipv4-ext

Source IP

Destination IP

IP Protocols

DSCP/ToS

L4 Dest Ports

L4 Src Ports

VLAN ID

Inner VLAN ID

TCP flags

Packet Length range check

L4 Source/Destination Port Range Check

Permit, Deny, Mirror

Ingress-ipv4-subif

Source IP

Destination IP

IPv4 Protocol Type

L4 Destination Port

L4 Source Port

Packet Length Range Check

L4 Source/Destination Port Range Check

Permit, Deny

 

 

 

ingress-ipv4-qos

Source IP

Destination IP

IPv4 Protocols

L4 Destination Port

L4 Source Port

L4 Source/Destination Port Range Check

DSCP

VLAN ID

Inner VLAN ID

TCP flags

Policer, Assign Queue, DSCP Remark

 

 

 

ingress-ipv6

Source IPv6 (n/w part)

Destination IPv6 (n/w part)

IPv6 NextHeader

L4 Destination Port

L4 Source Port

VLAN ID

IPv6 Traffic Class

IPv6 Hop Limit

L4 Source/Destination Port Range

Packet Length Range Check

Permit, Deny, Assign Queue, Mirror

ingress-ipv6-ext

Source ipv6 address full 128 bits

Destination ipv6 address full 128 bits

L4 Destination Port

L4 Source Port

IPv6 NextHeader

Permit, Deny, Assign Queue, DSCP Remark,

ingress-ipv6-ext-vlan

Source ipv6 address full 128 bits

Destination ipv6 address full 128 bits

L4 Destination Port

L4 Source Port

IPv6 NextHeader

Permit, Deny, Assign Queue, DSCP Remark, s

 

 

 

ingress-ipv6-ext-subif

Source ipv6 address full 128 bits

Destination ipv6 address full 128 bits

L4 Destination Port

L4 Source Port

IPv6 NextHeader

Permit, Deny, Assign Queue, DSCP Remark, s

 

 

 

ingress-ipv6-qos

Source IPv6 (n/w part)

Destination IPv6 (n/w part)

IPv6 NextHeader

L4 Destination Port

L4 Source Port

L4 Source/Destination Port Range

VLAN ID

IPv6 Traffic Class

Assign Queue, DSCP Remark, Policer

 

 

 

ipsg

Source MAC

Source IP

VLAN ID

 

 

 

 

Ipsg-ipv6

Source MAC

Source IP6 High

VLAN ID

 

 

 

 

Table 124.

Qualifiers for other groups

Group

Supported Qualifiers

Supported Actions

Extended Group

Supported Qualifiers

Supported Actions

egress-l2

Source MAC

Destination MAC

VLAN ID

Inner VLAN ID

CoS

Inner CoS

Permit, Deny

egress-l2-ext

Source Mac

Destination Mac

VLAN ID

Inner VLAN ID

CoS

Inner CoS

Permit, Deny

egress-l2-mlag

Source Port

Destination Port

Layer Record Type

Deny

     

egress-ipv4

Source IP

Destination IP

IPv4 Protocol

L4 Destination Port

L4 Source Port

DSCP

VLAN ID

Inner VLAN ID

Permit, Deny

egress-ipv4-ext

Source IP

Destination IP

IPv4 Protocol

L4 Destination Port

L4 Source Port

DSCP

VLAN ID

Inner VLAN ID

Permit, Deny

egress-dst-ipv6

Destination IPv6 High (N/W part)

IPv6 Next Header

IPv6 Traffic Class

L4 Destination Port

L4 Source Port

Permit, Deny

 

 

 

egress-ipv6

Destination IPv6 High (N/W part)

Source IPv6 High (N/W part)

IPv6 Next Header

IPv6 Traffic Class

L4 Destination Port

L4 Source Port

VLAN ID

Permit, Deny

 

 

 

egress-qos-policer

Destination Mac

VLAN ID

CoS

DSCP

L4 Destination Port

L4 Source Port

IPv4 Protocols

Policer

egress-qos-policer-ext

Destination Mac

VLAN ID

CoS

DSCP

L4 Destination Port

L4 Source Port

IPv4 Protocols

SVI interface

Subinterface

Policer

egress-src-ipv6

Source IPv6 High (N/W part)

IPv6 Next Header

IPv6 Traffic Class

L4 Destination Port

L4 Source Port

Permit, Deny

 

 

 

qos

Ether Type

VLAN ID

CoS

Inner VLAN ID

Inner CoS

DSCP

Topmost EXP

IP Flags

Assign Queue, COS Remark, DSCP Remark, Policers

qos-ext

Ether Type

VLAN ID

COS

Inner VLAN ID

Inner COS

DSCP

Topmost EXP

IP Flags

IP Protocols

L4 Destination Port

L4 Source Port

L4 Source/Destination Port Range

Assign Queue, COS Remark, DSCP Remark, Policer

evpn-mpls-mh

USER_DEFINED_IP

MPLS LABEL

 

 

 

 

vxlan

 

 

 

 

 

vxlan-mh

Source IP

Destination IP

 

 

 

 

qos-policer

Destination MAC

Ether Type

VLAN ID

COS

Inner VLAN ID

Inner CoS

DSCP

IP Protocols

IP Flags

Topmost EXP

L4 Destination Port

L4 Source Port

L4 Source/Destination Port Range

Traffic type

Assign Queue, COS Remark, DSCP Remark, Policer, Hierarchical Policer and Storm Control

 

 

 

qos-ipv6

Ether Type

VLAN ID

COS

Inner VLAN ID

Inner CoS

IPv6 Next Header

IPv6 Traffic Class

L4 Destination Port

L4 Source Port

L4 Source/Destination Port Range

Assign Queue, COS Remark, DSCP Remark, Policer

 

 

 

ingress-arp

ARP Request/Response

ARP IP address

ARP MAC address

VLAN ID

Inner VLAN ID

Permit, Deny

 

 

 

twamp-ipv4

IPv4 Source IP

IPv4 Destination IP

UDPClosed User Datagram Protocol Source port

UDP Destination port

IPv4 Type of Service

 

 

 

 

twamp-ipv6

UDP Source port

UDP Destination port

IPv6 Source IP

IPv6 Destination IP

 

 

 

 

twamp-ipv6-mpls

UDP Source port

UDP Destination port

IPv6 Source IP

IPv6 Destination IP

 

 

 

 

vxlan

Forwarding Types

Ethernet Type

IPv4

Y1731

 

 

 

 

Ipv4-bgp-flowspec

VRFClosed Virtual Routing and Forwarding ID

Source IP

Destination IP

IP Protocols

L4 Ports

ICMPClosed Internet Control Message Protocol (ICMP) is a fundamental protocol used in networking to relay error messages and operational information. Type/Code

TCP Flags

PacketSize

DSCP

IP Fragmentation

The following traffic filter types of the components range value can be specified only with non-range value.

Type 3: IP Protocol

Type 7: ICMP type

Type 8: ICMP code

Type 10: Packet length

Type 11: DSCP (Diffserv Code Point)

 

 

 

 

 

Table 125.

Total available entries for each group

Group Name

Q2U

Q2A

Q2C

Q2C+

dhcp-snoop

10240

10240

19456

19456

dhcp-snoop-ipv6

10240

10240

19456

19456

Ingress-arp

Table 126. 4608

Table 127. 4608

Table 128. 8704

Table 129. 8704

Table 130. Ingress-l2

Table 131. 10240

Table 132. 10240

Table 133. 19456

Table 134. 19456

Table 135. Ingress-l2-ext

Table 136. 4608

Table 137. 4608

Table 138. 8704

Table 139. 8704

Table 140. Ingress-l2-subif

Table 141. 10240

Table 142. 10240

Table 143. 19456

Table 144. 19456

Table 145. Ipsg

Table 146. 10240

Table 147. 10240

Table 148. 19456

Table 149. 19456

Table 150. Ipsg-ipv6

Table 151.  

Table 152.  

Table 153.  

Table 154.  

Table 155. Ingress-ipv4

Table 156. 10240

Table 157. 10240

Table 158. 19456

Table 159. 19456

Table 160. Ingress-ipv4-ext

Table 161. 4608

Table 162. 4608

Table 163. 8704

Table 164. 8704

Table 165. Ingress-ipv4-qos

Table 166. 4608

Table 167. 4608

Table 168. 8704

Table 169. 8704

Table 170. Ingress-ipv4-subif

Table 171. 10240

Table 172. 10240

Table 173. 19456

Table 174. 19456

Table 175. Ingress-ipv6

Table 176. 4608

Table 177. 4608

Table 178. 8704

Table 179. 8704

Table 180. Ingress-ipv6-ext

Table 181. 4608

Table 182. 4608

Table 183. 8704

Table 184. 8704

Table 185. ingress-ipv6-ext-vlan

Table 186. 4608

Table 187. 4608

Table 188. 8704

Table 189. 8704

Table 190. ingress-ipv6-ext-subif

Table 191. 4608

Table 192. 4608

Table 193. 8704

Table 194. 8704

Table 195. Ingress-ipv6-qos

Table 196. 4608

Table 197. 4608

Table 198. 8704

Table 199. 8704

Table 200. Qos-ipv6

Table 201. 4608

Table 202. 4608

Table 203. 8704

Table 204. 8704

Table 205. Qos

Table 206. 4605/4608

Table 207. 4608

Table 208. 8704

Table 209. 8704

Table 210. Qos-ext

Table 211. 4605/4608

Table 212. 4608

Table 213. 8704

Table 214. 8704

Table 215. Qos-policer

Table 216. 4605/4608

Table 217. 4608

Table 218. 8704

Table 219. 8704

Table 220. Egress-l2

Table 221. 4608

Table 222. 4608

Table 223. 8704

Table 224. 8704

Table 225. Egress-l2-ext

Table 226. 10240

Table 227. 10240

Table 228. 19456

Table 229. 19456

Table 230. Egress-l2-mlag

Table 231. 20480

Table 232. 20480

Table 233. 38912

Table 234. 38912

Table 235. Egress-dst-ipv6

Table 236. 10240

Table 237. 10240

Table 238. 19456

Table 239. 19456

Table 240. Egress-ipv4

Table 241. 10240

Table 242. 10240

Table 243. 19456

Table 244. 19456

Table 245. Egress-ipv4-ext

Table 246. 10240

Table 247. 10240

Table 248. 19456

Table 249. 19456

Table 250. Egress-ipv6

Table 251. 4608

Table 252. 4608

Table 253. 8704

Table 254. 8704

Table 255. Egress-qos-policer

Table 256. 10240

Table 257. 10240

Table 258. 19456

Table 259. 19456

Table 260. Egress-qos-policer-ext

Table 261. 10240

Table 262. 10240

Table 263. 19456

Table 264. 19456

Table 265. Egress-src-ipv6

Table 266. 10240

Table 267. 10240

Table 268. 19456

Table 269. 19456

Table 270. Twamp-ipv4

Table 271. 4608

Table 272. 4608

Table 273. 8704

Table 274. 8704

Table 275. Twamp-ipv6

Table 276. 4608

Table 277. 4608

Table 278. 8704

Table 279. 8704

Table 280. Twamp-ipv6-mpls

Table 281. 4608

Table 282. 4608

Table 283. 8704

Table 284. 8704

Table 285. Vxlan

Table 286. 10240

Table 287. 10240

Table 288. 19456

Table 289. Not supported