hardware-profile filter for Qumran-2
Use this command to enable or disable ingress IPv4 or IPv6, egress IPv6 filter groups, EVPN-MPLS,VxLAN filter and TWAMP IPv4 or IPv6 groups. Disabling filter groups increases the configurable filter entries.
Disabling a TCAM filter group is not allowed if the group has any entries configured in hardware. Group dependent entries must be explicitly removed before disabling the TCAM group.
- This feature is supported for IPv4 unicast and IPv4 BGP/MPLS VPN service based on RFC 8955.
-
Use the
ingress-IPv4-subif
andingress-IPv6-subif-ext
groups when ACL is required on the subinterfaces and IRB interfaces only. Useingress-IPv4-ext
andingress-IPv6
groups when ACL is required on physical, subinterface and LAGLink Aggregation Group.
- Updating the access list may take a long time in a scaled configuration because the hardware must reshuffle the filter entries when configuring a high-priority filter.
- In the ingress direction, Qumran-2C (Q2C) series platforms hardware supports stats for 16k filter entries, andQumran-2A (Q2A) series platforms supports 8k filter entries. For the egress direction,Qumran-2C (Q2C) series platforms supports 8k, and Qumran-2A (Q2A) series platforms supports 4k.
- In Qumran2 (Q2) series platforms, either two 160-bit groups or one 320-bit group can be created in the egress direction.
-
In Qumran2 series platforms, Egress ACls are not applicable for packets which sent from cpu.
-
Disabling and Enabling the hardware-profile filter command in a single commit is not recommended.
Example:
OcNOS(config)#hardware-profile filter ingress-ipv4 disable
OcNOS(config)#hardware-profile filter ingress-ipv4-ext enable
OcNOS(config)#commit
-
Configuring and unconfiguring access-list to the interface in a single commit is not recommended.
Example:
OcNOS(config)#interface xe8
OcNOS(config-if)#no ip access-group ACL1v4 out
OcNOS(config-if)#exit
OcNOS(config)#interface xe3
OcNOS(config-if)#ip access-group ACL2v4 out
OcNOS(config-if)#commit
- For better utilization of TCAM resources it is recommended to enable large groups first and then smaller groups.
Enabling TWAMP hardware profiles requires a system reboot.
Example
hardware-profile filter qos-policer enable # QoS policer/storm control
hardware-profile filter ingress-ipv6 enable # IPV6 ACL
hardware-profile filter ingress-l2-subif enable # MAC ACL
hardware-profile filter ingress-ipv4-subif enable # IPv4 ACL
Command Syntax
hardware-profile filter (dhcp-snoop|dhcp-snoop-ipv6|egress-dst-
ipv6|egressipv4|egress-ipv4-ext|egress-ipv6|egress-l2|egress-l2-ext|egress-qospolicer|egress-
qos-policer-ext|egress-src-ipv6|ingress-arp|ingress-ipv4|ingressipv4-ext|ingress-ipv4-
qos|ingress-ipv4-qos-copp|ingress-ipv4-subif|ingress-ipv6|ingress-ipv6- ext|ingress-ipv6-ext-
vlan|ingress-ipv6-qos|ingress-l2|ingress-l2-ext|ingress-l2- subif|ipsg|ipsg-ipv6|qos|qos-ext|qos-
ipv6|qos-policer|evpn-mpls-cw|evpn-mplsmh|vxlan|vxlan-mh|twamp-ipv4|twamp-ipv6|twamp-
ipv6-mpls|vxlan|ipv4-bgpflowspec|) (enable|disable)
Parameters
dhcp-snoop |
Ingress DHCP |
dhcp-snoop-ipv6 |
Ingress IPv6 DHCP Snooping group |
ingress-arp |
Ingress ARP group for ARP ACL support |
ingress-l2 |
Ingress L2 ACL filter group. |
ingress-l2-ext |
Ingress L2 ACL, QoS, mirror filter group. |
ingress-l2-subif |
Ingress L2 group for ACL on L2/L3 Subinterfaces. |
ipsg |
Ingress IP Source Guard group |
ipsg-ipv6 |
Ingress IPv6 Source Guard group |
ingress-ipv4 |
Ingress IP ACL filter group. |
ingress-ipv4-ext |
Ingress IP ACL, mirror, PBR filter group. |
ingress-ipv4-qos |
Ingress IPv4 group for ACL match QoS. |
ingress-ipv4-subif |
Ingress IPv4 group for ACL on L2/L3 Subinterfaces. |
ingress-ipv6 |
Ingress IPv6 ACL, mirror, PBR filter group |
Ingress-ipv4-qos-copp |
Ingress IPv4 group for ACL match QoS and CoPP. |
ingress-ipv6-ext |
Ingress IPv6 extended group with 128-bit address support for ACL , ACL match QOS on physical interfaces. |
ingress-ipv6-ext-vlan |
Ingress IPv6 extended group with 128-bit address support for ACL, ACL match QOS on SVI |
ingress-ipv6-ext-subif |
Ingress IPv6 extended group with 128-bit address support for ACL, ACL match QOS on Sub interfaces. |
ingress-ipv6-qos |
Ingress IPv6 group for ACL match QoS. |
qos-ipv6 |
Ingress QOS IPv6 group for IPv6 QoS support with statistics. |
qos |
Ingress QoS filter group |
qos-ext |
Ingress QoS extended filter group. |
qos-ipv6 |
Ingress QOS IPv6 group for IPv6 QoS support with statistics |
qos-policer |
Ingress extended QoS group for hierarchical policer support with statistics. |
egress-l2 |
Egress L2 ACL filter group |
egress-l2-mlag |
Egress L2 group for ACL only on MLAG interface. |
egress-l2-ext |
Egress L2 extended (mac) group for ACL on subinterface. |
egress-dst-ipv6 |
Egress Destination IPv6 group for ACL |
egress-ipv4 |
Egress IP ACL filter group. |
egress-ipv4-ext |
Egress IPv4 extended group for ACL on subinterface |
egress-ipv6 |
Egress IPv6 group for ACL |
egress-qos-policer |
Egress QoS policer group only for physical and LAG interface |
egress-qos-policer-ext |
Egress extended QOS policer group |
egress-src-ipv6 |
Egress Source IPv6 group for ACL |
twamp-ipv4 |
Ingress TWAMP IPv4 Forwarding group. |
twamp-ipv6 |
Ingress TWAMP IPv6 Forwarding group. |
twamp-ipv6-mpls |
Ingress TWAMP IPv6 MPLS Forwarding group. |
ipv4-bgp-flowspec |
BGP FlowSpec filter group. |
|
Ingress EVPN MPLS Multi-Homing Forwarding Group |
|
Ingress VxLAN Forwarding group |
|
Ingress VxLAN Multi-Homing Forwarding Group. |
vxlan |
Ingress Vxlan Forwarding group |
enable |
Enable filter group. |
disable |
Disable filter group |
Default
By default, all filter groups are disabled.
Command Mode
Configure mode
Applicability
This command was introduced before OcNOS version 1.3 and changed in OcNOS version 3.0.
Examples
OcNOS#configure terminal
OcNOS(config)#hardware-profile filter ingress-ipv4 enable
OcNOS(config)#hardware-profile filter ingress-ipv4 disable
OcNOS(config)#hardware-profile filter egress-ipv4 enable
OcNOS(config)#hardware-profile filter egress-ipv4 disable
Group |
Key Size |
Security |
QoS |
PBR |
Mirror |
Statistics |
||
|
|
|
|
|
|
Q2U |
Q2A |
Q2C, J2C+ |
dhcp-snoop |
160 |
Yes |
No |
N/A |
No |
Yes |
Yes |
Yes |
Dhcp-snoop-ipv6 |
160 |
Yes |
No |
N/A |
No |
Yes |
Yes |
Yes |
Ingress-arp |
320 |
Yes |
No |
N/A |
No |
Yes |
Yes |
Yes |
ingress-l2 |
160 |
Yes |
No |
N/A |
No |
Yes |
Yes |
Yes |
ingress-l2-ext |
320 |
Yes |
No |
N/A |
Yes |
Yes |
Yes |
Yes |
ingress-l2-subif |
160 |
Yes |
No |
N/A |
No |
Yes |
Yes |
Yes |
ingress-ipv4 |
160 |
Yes |
No |
No |
No |
Yes |
Yes |
Yes |
ingress-ipv4-ext |
320 |
Yes |
No |
Yes |
Yes |
Yes |
Yes |
Yes |
ingress-ipv4-qos |
320 |
N/A |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
ingress-ipv4-subif |
160 |
Yes |
No |
Yes |
No |
Yes |
Yes |
Yes |
ingress-ipv6 |
320 |
Yes |
No |
Yes |
Yes |
Yes |
Yes |
Yes |
Ingress-ipv6-ext |
320 |
N/A |
Yes |
No |
Yes |
Yes |
Yes |
Yes |
Ingress-ipv6-ext-vlan |
320 |
N/A |
Yes |
No |
Yes |
Yes |
Yes |
Yes |
Ingress-ipv6-ext-subif |
320 |
N/A |
Yes |
No |
Yes |
Yes |
Yes |
Yes |
ingress-ipv6-qos |
320 |
N/A |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
Ipsg |
160 |
Yes |
No |
N/A |
N/A |
Yes |
Yes |
Yes |
Ipsg-ipv6 |
160 |
Yes |
No |
N/A |
N/A |
Yes |
Yes |
Yes |
qos-ipv6 |
320 |
N/A |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
qos |
160 |
N/A |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
qos-ext |
320 |
N/A |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
qos-policer |
320 |
N/A |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
egress-l2 |
320 |
Yes |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
egress-l2-mlag |
80 |
Yes |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
egress-l2-ext |
160 |
Yes |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
egress-dst-ipv6 |
160 |
Yes |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
egress-ipv4 |
160 |
Yes |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
egress-ipv4-ext |
320 |
Yes |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
Egress-ipv6 |
320 |
Yes |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
Egress-qos-policer |
160 |
No |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
Egress-qos-policer-ext |
160 |
No |
Yes |
N/A |
N/A |
Yes |
Yes |
Yes |
Egress-src-ipv6 |
160 |
Yes |
No |
N/A |
N/A |
Yes |
Yes |
Yes |
evpn-mpls-mh |
160 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
vxlan |
160 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
vxlan-mh |
160 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
twamp-ipv4 (Having MPLS enabled SKUs) |
320 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
Twamp-ipv4 (MPLS disabled SKUs) |
160 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
twamp-ipv6 |
320 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
twamp-ipv6-mpls |
320 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
Vxlan |
160 |
N/A |
N/A |
N/A |
N/A |
Yes |
Yes |
Yes |
Ipv4-bgp-flowspec |
320 |
N/A |
N/A |
N/A |
N/A |
No |
No |
No |
Basic Group |
Extended Qualifiers |
Supported Actions |
Extended Group |
Supported Qualifiers |
Supported Actions |
dhcp-snoop |
SourcePort L4 DestinationPort IPv4 Protocol Destination Mac InterfaceClass Ethertype Vlan |
|
|
|
|
dhcp-snoop-ipv6 |
L4 Destination port IP6NextHeader DstIp6High Ethertype |
|
|
|
|
ingress-l2 |
Source MAC Destination MAC Ether Type VLAN ID Inner VLAN ID |
Permit, Deny |
ingress-l2-ext |
Source MAC Destination MAC Ether Type VLAN ID Inner VLAN ID COS Inner CoS IPv4 Protocols |
Permit, Deny, Policer, Mirror, Assign Queue, COS Remark |
ingress-l2-subif |
Source Mac Destination Mac Ethertype |
Permit, Deny |
|
|
|
ingress-ipv4 |
Source IP Destination IP IP Protocols L4 Dest Ports L4 Src Ports |
Permit, Deny |
ingress-ipv4-ext |
Source IP Destination IP IP Protocols DSCP/ToS L4 Dest Ports L4 Src Ports VLAN ID Inner VLAN ID TCP flags Packet Length range check L4 Source/Destination Port Range Check |
Permit, Deny, Mirror |
Ingress-ipv4-subif |
Source IP Destination IP IPv4 Protocol Type L4 Destination Port L4 Source Port Packet Length Range Check L4 Source/Destination Port Range Check |
Permit, Deny |
|
|
|
ingress-ipv4-qos |
Source IP Destination IP IPv4 Protocols L4 Destination Port L4 Source Port L4 Source/Destination Port Range Check DSCP VLAN ID Inner VLAN ID TCP flags |
Policer, Assign Queue, DSCP Remark |
|
|
|
ingress-ipv6 |
Source IPv6 (n/w part) Destination IPv6 (n/w part) IPv6 NextHeader L4 Destination Port L4 Source Port VLAN ID IPv6 Traffic Class IPv6 Hop Limit L4 Source/Destination Port Range Packet Length Range Check |
Permit, Deny, Assign Queue, Mirror |
ingress-ipv6-ext |
Source ipv6 address full 128 bits Destination ipv6 address full 128 bits L4 Destination Port L4 Source Port IPv6 NextHeader |
Permit, Deny, Assign Queue, DSCP Remark, |
ingress-ipv6-ext-vlan |
Source ipv6 address full 128 bits Destination ipv6 address full 128 bits L4 Destination Port L4 Source Port IPv6 NextHeader |
Permit, Deny, Assign Queue, DSCP Remark, s |
|
|
|
ingress-ipv6-ext-subif |
Source ipv6 address full 128 bits Destination ipv6 address full 128 bits L4 Destination Port L4 Source Port IPv6 NextHeader |
Permit, Deny, Assign Queue, DSCP Remark, s |
|
|
|
ingress-ipv6-qos |
Source IPv6 (n/w part) Destination IPv6 (n/w part) IPv6 NextHeader L4 Destination Port L4 Source Port L4 Source/Destination Port Range VLAN ID IPv6 Traffic Class |
Assign Queue, DSCP Remark, Policer |
|
|
|
ipsg |
Source MAC Source IP VLAN ID |
|
|
|
|
Ipsg-ipv6 |
Source MAC Source IP6 High VLAN ID |
|
|
|
|
Group |
Supported Qualifiers |
Supported Actions |
Extended Group |
Supported Qualifiers |
Supported Actions |
egress-l2 |
Source MAC Destination MAC VLAN ID Inner VLAN ID CoS Inner CoS |
Permit, Deny |
egress-l2-ext |
Source Mac Destination Mac VLAN ID Inner VLAN ID CoS Inner CoS |
Permit, Deny |
egress-l2-mlag |
Source Port Destination Port Layer Record Type |
Deny |
|||
egress-ipv4 |
Source IP Destination IP IPv4 Protocol L4 Destination Port L4 Source Port DSCP VLAN ID Inner VLAN ID |
Permit, Deny |
egress-ipv4-ext |
Source IP Destination IP IPv4 Protocol L4 Destination Port L4 Source Port DSCP VLAN ID Inner VLAN ID |
Permit, Deny |
egress-dst-ipv6 |
Destination IPv6 High (N/W part) IPv6 Next Header IPv6 Traffic Class L4 Destination Port L4 Source Port |
Permit, Deny |
|
|
|
egress-ipv6 |
Destination IPv6 High (N/W part) Source IPv6 High (N/W part) IPv6 Next Header IPv6 Traffic Class L4 Destination Port L4 Source Port VLAN ID |
Permit, Deny |
|
|
|
egress-qos-policer |
Destination Mac VLAN ID CoS DSCP L4 Destination Port L4 Source Port IPv4 Protocols |
Policer |
egress-qos-policer-ext |
Destination Mac VLAN ID CoS DSCP L4 Destination Port L4 Source Port IPv4 Protocols SVI interface Subinterface |
Policer |
egress-src-ipv6 |
Source IPv6 High (N/W part) IPv6 Next Header IPv6 Traffic Class L4 Destination Port L4 Source Port |
Permit, Deny |
|
|
|
qos |
Ether Type VLAN ID CoS Inner VLAN ID Inner CoS DSCP Topmost EXP IP Flags |
Assign Queue, COS Remark, DSCP Remark, Policers |
qos-ext |
Ether Type VLAN ID COS Inner VLAN ID Inner COS DSCP Topmost EXP IP Flags IP Protocols L4 Destination Port L4 Source Port L4 Source/Destination Port Range |
Assign Queue, COS Remark, DSCP Remark, Policer |
evpn-mpls-mh |
USER_DEFINED_IP MPLS LABEL |
|
|
|
|
vxlan |
|
|
|
|
|
vxlan-mh |
Source IP |
|
|
|
|
qos-policer |
Destination MAC Ether Type VLAN ID COS Inner VLAN ID Inner CoS DSCP IP Protocols IP Flags Topmost EXP L4 Destination Port L4 Source Port L4 Source/Destination Port Range Traffic type |
Assign Queue, COS Remark, DSCP Remark, Policer, Hierarchical Policer and Storm Control |
|
|
|
qos-ipv6 |
Ether Type VLAN ID COS Inner VLAN ID Inner CoS IPv6 Next Header IPv6 Traffic Class L4 Destination Port L4 Source Port L4 Source/Destination Port Range |
Assign Queue, COS Remark, DSCP Remark, Policer |
|
|
|
ingress-arp |
ARP Request/Response ARP IP address ARP MAC address VLAN ID Inner VLAN ID |
Permit, Deny |
|
|
|
twamp-ipv4 |
IPv4 Source IP IPv4 Destination IP UDP UDP Destination port IPv4 Type of Service |
|
|
|
|
twamp-ipv6 |
UDP Source port UDP Destination port IPv6 Source IP IPv6 Destination IP |
|
|
|
|
twamp-ipv6-mpls |
UDP Source port UDP Destination port IPv6 Source IP IPv6 Destination IP |
|
|
|
|
vxlan |
Forwarding Types Ethernet Type IPv4 Y1731 |
|
|
|
|
Ipv4-bgp-flowspec |
VRF Source IP Destination IP IP Protocols L4 Ports TCP Flags PacketSize DSCP IP Fragmentation The following traffic filter types of the components range value can be specified only with non-range value. Type 3: IP Protocol Type 7: ICMP type Type 8: ICMP code Type 10: Packet length Type 11: DSCP (Diffserv Code Point) |
|
|
|
|
Group Name |
Q2U |
Q2A |
Q2C |
Q2C+ |
dhcp-snoop |
10240 |
10240 |
19456 |
19456 |
dhcp-snoop-ipv6 |
10240 |
10240 |
19456 |
19456 |
Ingress-arp |
Table 126. 4608 |
Table 127. 4608 |
Table 128. 8704 |
Table 129. 8704 |
Table 130. Ingress-l2 |
Table 131. 10240 |
Table 132. 10240 |
Table 133. 19456 |
Table 134. 19456 |
Table 135. Ingress-l2-ext |
Table 136. 4608 |
Table 137. 4608 |
Table 138. 8704 |
Table 139. 8704 |
Table 140. Ingress-l2-subif |
Table 141. 10240 |
Table 142. 10240 |
Table 143. 19456 |
Table 144. 19456 |
Table 145. Ipsg |
Table 146. 10240 |
Table 147. 10240 |
Table 148. 19456 |
Table 149. 19456 |
Table 150. Ipsg-ipv6 |
Table 151. |
Table 152. |
Table 153. |
Table 154. |
Table 155. Ingress-ipv4 |
Table 156. 10240 |
Table 157. 10240 |
Table 158. 19456 |
Table 159. 19456 |
Table 160. Ingress-ipv4-ext |
Table 161. 4608 |
Table 162. 4608 |
Table 163. 8704 |
Table 164. 8704 |
Table 165. Ingress-ipv4-qos |
Table 166. 4608 |
Table 167. 4608 |
Table 168. 8704 |
Table 169. 8704 |
Table 170. Ingress-ipv4-subif |
Table 171. 10240 |
Table 172. 10240 |
Table 173. 19456 |
Table 174. 19456 |
Table 175. Ingress-ipv6 |
Table 176. 4608 |
Table 177. 4608 |
Table 178. 8704 |
Table 179. 8704 |
Table 180. Ingress-ipv6-ext |
Table 181. 4608 |
Table 182. 4608 |
Table 183. 8704 |
Table 184. 8704 |
Table 185. ingress-ipv6-ext-vlan |
Table 186. 4608 |
Table 187. 4608 |
Table 188. 8704 |
Table 189. 8704 |
Table 190. ingress-ipv6-ext-subif |
Table 191. 4608 |
Table 192. 4608 |
Table 193. 8704 |
Table 194. 8704 |
Table 195. Ingress-ipv6-qos |
Table 196. 4608 |
Table 197. 4608 |
Table 198. 8704 |
Table 199. 8704 |
Table 200. Qos-ipv6 |
Table 201. 4608 |
Table 202. 4608 |
Table 203. 8704 |
Table 204. 8704 |
Table 205. Qos |
Table 206. 4605/4608 |
Table 207. 4608 |
Table 208. 8704 |
Table 209. 8704 |
Table 210. Qos-ext |
Table 211. 4605/4608 |
Table 212. 4608 |
Table 213. 8704 |
Table 214. 8704 |
Table 215. Qos-policer |
Table 216. 4605/4608 |
Table 217. 4608 |
Table 218. 8704 |
Table 219. 8704 |
Table 220. Egress-l2 |
Table 221. 4608 |
Table 222. 4608 |
Table 223. 8704 |
Table 224. 8704 |
Table 225. Egress-l2-ext |
Table 226. 10240 |
Table 227. 10240 |
Table 228. 19456 |
Table 229. 19456 |
Table 230. Egress-l2-mlag |
Table 231. 20480 |
Table 232. 20480 |
Table 233. 38912 |
Table 234. 38912 |
Table 235. Egress-dst-ipv6 |
Table 236. 10240 |
Table 237. 10240 |
Table 238. 19456 |
Table 239. 19456 |
Table 240. Egress-ipv4 |
Table 241. 10240 |
Table 242. 10240 |
Table 243. 19456 |
Table 244. 19456 |
Table 245. Egress-ipv4-ext |
Table 246. 10240 |
Table 247. 10240 |
Table 248. 19456 |
Table 249. 19456 |
Table 250. Egress-ipv6 |
Table 251. 4608 |
Table 252. 4608 |
Table 253. 8704 |
Table 254. 8704 |
Table 255. Egress-qos-policer |
Table 256. 10240 |
Table 257. 10240 |
Table 258. 19456 |
Table 259. 19456 |
Table 260. Egress-qos-policer-ext |
Table 261. 10240 |
Table 262. 10240 |
Table 263. 19456 |
Table 264. 19456 |
Table 265. Egress-src-ipv6 |
Table 266. 10240 |
Table 267. 10240 |
Table 268. 19456 |
Table 269. 19456 |
Table 270. Twamp-ipv4 |
Table 271. 4608 |
Table 272. 4608 |
Table 273. 8704 |
Table 274. 8704 |
Table 275. Twamp-ipv6 |
Table 276. 4608 |
Table 277. 4608 |
Table 278. 8704 |
Table 279. 8704 |
Table 280. Twamp-ipv6-mpls |
Table 281. 4608 |
Table 282. 4608 |
Table 283. 8704 |
Table 284. 8704 |
Table 285. Vxlan |
Table 286. 10240 |
Table 287. 10240 |
Table 288. 19456 |
Table 289. Not supported |