The IPv6 Access Control List Configuration Mode is used to create and manage IPv6 access privileges.
{ deny | permit } [ log ] source_address source_wildcard
after { deny | permit } [ log ] source_address source_wildcard
before { deny | permit } [ log ] source_address source_wildcard
no { deny | permit } [ log ] source_address source_wildcard
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change|
•
|
deny: Indicates the rule, when matched, drops the corresponding packets.
|
|
•
|
permit: Indicates the rule, when matched, allows the corresponding packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.|
•
|
deny: Indicates the rule, when matched, drops the corresponding packets.
|
|
•
|
permit: Indicates the rule, when matched, allows the corresponding packets.
|
Important: It is suggested that any rule which is added to be a catch all should also have the log option specified. The logged packets may be used to determine if the current list of rules is adequate or needs modification to ensure proper security. The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide.{ deny | permit } [ log ] host source_host_address
after { deny | permit } [ log ] host source_host_address
before { deny | permit } [ log ] host source_host_address
no { deny | permit } [ log ] host source_host_address
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.|
•
|
deny: Indicates the rule, when matched, drops the corresponding packets.
|
|
•
|
permit: Indicates the rule, when matched, allows the corresponding packets.
|
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide.{ deny | permit } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
after { deny | permit } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
before { deny | permit } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
no { deny | permit } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.|
•
|
deny: Indicates the rule, when matched, drops the corresponding packets.
|
|
•
|
permit: Indicates the rule, when matched, allows the corresponding packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide.{ deny | permit } [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocolnum ]
after { deny | permit } [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocolnum ]
before { deny | permit } [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocolnum ]
no { deny | permit } [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocolnum ]
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.|
•
|
deny: indicates the rule, when matched, drops the corresponding packets.
|
|
•
|
permit: indicates the rule, when matched, allows the corresponding packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). Therefore, allowed masks are 0, 1, 3, 7, 15, 31, 63, 127, and 255. For example, acceptable wildcards are 0.0.0.3, 0.0.0.255, and 0.0.15.255. A wildcard of 0.0.7.15 is not acceptable since the one-bits are not contiguous.When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).protocol num
num can be any integer ranging from 0 to 255.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide.{ deny | permit } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
after { deny | permit } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
before { deny | permit } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
no { deny | permit } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.|
•
|
deny: Indicates the rule, when matched, drops the corresponding packets.
|
|
•
|
permit: Indicates the rule, when matched, allows the corresponding packets.
|
|
•
|
tcp: Filter applies to TPC packets.
|
|
•
|
udp: Filter applies to UDP packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
eq source_port
source_port must be configured to an integer from 0 through 65535.
gt source_port
source_port must be configured to an integer from 0 through 65535.
lt source_port
source_port must be configured to an integer from 0 through 65535.
neq source_port
source_port must be configured to an integer from 0 through 65535.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).eq dest_port
dest_port must be configured to an integer from 0 through 65535.
gt dest_port
dest_port must be configured to an integer from 0 through 65535.
lt dest_port
dest_port must be configured to an integer from 0 through 65535.
neq dest_port
dest_port must be configured to an integer from 0 through 65535.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.port port_number
|
•
|
tcp: Redirect applies to TCP packets.
|
|
•
|
udp: Redirect applies to UDP packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
eq source_port
source_port must be configured to an integer from 0 through 65535.
gt source_port
source_port must be configured to an integer from 0 through 65535.
lt source_port
source_port must be configured to an integer from 0 through 65535.
neq source_port
source_port must be configured to an integer from 0 through 65535.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
eq dest_port
dest_port must be configured to an integer from 0 through 65535.
gt dest_port
dest_port must be configured to an integer from 0 through 65535.
lt dest_port
dest_port must be configured to an integer from 0 through 65535.
neq dest_port
dest_port must be configured to an integer from 0 through 65535.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the server at fe80::c0a8:a04, UDP packets coming from any host with a destination of any host are matched:
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.context context_id
Specifies the context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
Filters packets for a group of addresses specified in conjunction with the source_address option.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the context with the context ID of 23 and the source IP and wildcard of 2002::c6a2:1600 and 2002::c6a2:1600:
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
Important: It is suggested that any rule which is added to be a catch all should also have the log option specified. The logged packets may be used to determine if the current list of rules is adequate or needs modification to ensure proper security. The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the context with the context ID of 23 and any source IP:
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the context with the context ID of 23 and a host IP address of fe80::c0a8:c80b:
redirect context context_id [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
after redirect context context_id [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
before redirect context context_id [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
no redirect context context_id [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the context with the context ID of 23, and ICMP packets coming from the host with the IP address 2002::c6a2:6419:
redirect context context_id [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocol num ]
after redirect context context_id [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocol num ]
before redirect context context_id [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocol num ]
no redirect context context_id [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocol num ]
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).protocol num
num is an integer from 0 through 255.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the context with the context ID of 23, and IP packets coming from the host with the IP address 2002::c6a2:6419, and fragmented packets for any destination are matched:
redirect context context_id [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
after redirect context context_id [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
before redirect context context_id [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
no redirect context context_id [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dst_port ] }
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
|
•
|
tcp: Redirect applies to TPC packets.
|
|
•
|
udp: Redirect applies to UDP packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
eq source_port
source_port must be configured to an integer from 0 through 65535.
gt source_port
source_port must be configured to an integer from 0 through 65535.
lt source_port
source_port must be configured to an integer from 0 through 65535.
neq source_port
source_port must be configured to an integer from 0 through 65535.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).eq dest_port
dest_port must be configured to an integer from 0 through 65535.
gt dest_port
dest_port must be configured to an integer from 0 through 65535.
lt dest_port
dest_port must be configured to an integer from 0 through 65535.
neq dest_port
dest_port must be configured to an integer from 0 through 65535.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the context with the context ID of 23, and UDP packets coming from any host are matched:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the CSS service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be a string of 1 through 15 characters.
Important: It is suggested that any rule definition which is added to be a catch all should also have the log option specified. The logged packets may be used to determine if the current list of rule definitions is adequate or needs modification to ensure proper security.
Important: A maximum of 16 rule definitions can be configured per ACL.
Important: Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the CSS service with the name css-svc1 and any source IP:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the CSS service with the name css-svc1 and a host IP address of fe80::c0a8:c80b:
redirect css service svc_name [ log ] icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [icmp_type [ icmp_code ] ]
after redirect css service svc_name [ log ] icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [icmp_type [ icmp_code ] ]
before redirect css service svc_name [ log ] icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [icmp_type [ icmp_code ] ]
no redirect css service svc_name [ log ] icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [icmp_type [ icmp_code ] ]
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured charging services.
svc_name must be an alphanumeric string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the CSS service named css-svc1, and ICMP packets coming from the host with the IP address 2002::c6a2:6419:
redirect css service svc_name [ log ] ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
after redirect css service svc_name [ log ] ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
before redirect css service svc_name [ log ] ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
no redirect css service svc_name [ log ] ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). Therefore, allowed masks are 0, 1, 3, 7, 15, 31, 63, 127, and 255. For example, acceptable wildcards are 0.0.0.3, 0.0.0.255, and 0.0.15.255. A wildcard of 0.0.7.15 is not acceptable since the one-bits are not contiguous.
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the CSS service named css-svc1, and IP packets coming from the host with the IP address 2002::c6a2:6419, and fragmented packets for any destination are matched:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: A maximum of 16 rule definitions can be configured per ACL.The following command defines a rule definition to redirect packets to a CSS service named css-svc1:
redirect css service svc_name [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
after redirect css service svc_name [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
after redirect css service svc_name [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
no redirect css service svc_name [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured charging services.
svc_name must be an alphanumeric string of 1 through 15 characters.
|
•
|
tcp: Redirect applies to TPC packets.
|
|
•
|
udp: Redirect applies to UDP packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).eq source_port
source_port must be configured to an integer from 0 to 65535.
gt source_port
source_port must be configured to an integer from 0 to 65535.
lt source_port
source_port must be configured to an integer from 0 to 65535.
neq source_port
source_port must be configured to an integer from 0 to 65535.
range start_source_port end_source_port
start_source_port is the initial port in the range and end_source_port is the final port in the range.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).eq dest_port
dest_port must be configured to an integer from 0 to 65535.
gt dest_port
dest_port must be configured to an integer from 0 to 65535.
lt dest_port
dest_port must be configured to an integer from 0 to 65535.
neq dest_port
dest_port must be configured to an integer from 0 to 65535.
range start_dest_port end_dest_port
start_dest_port is the initial port in the range and end_dest_port is the final port in the range.
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the CSS service named css-svc1, and UDP packets coming from any host are matched:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
Important: It is suggested that any rule definition which is added to be a catch all should also have the log option specified. The logged packets may be used to determine if the current list of rule definitions is adequate or needs modification to ensure proper security.
Important: A maximum of 16 rule definitions can be configured per ACL.
Important: Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the CSS service with the name css-svc1 and any source IP:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the charging service with the name css-svc1 and a host IP address of fe80::c0a8:c80b:
redirect css service svc_name [ log ] downlink icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ icmp_type [ icmp_code ] ]
after redirect css service svc_name [ log ] downlink icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ icmp_type [ icmp_code ] ]
before redirect css service svc_name [ log ] downlink icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ icmp_type [ icmp_code ] ]
no redirect css service svc_name [ log ] downlink icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ icmp_type [ icmp_code ] ]
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the charging service named css-svc1, and ICMP packets coming in the downlink (from the Mobile Node) direction from the host with the IP address 2002::c6a2:6419:
redirect css service svc_name [ log ] downlink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
after redirect css service svc_name [ log ] downlink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
before redirect css service svc_name [ log ] downlink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
no redirect css service svc_name [ log ] downlink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be a string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). Therefore, allowed masks are 0, 1, 3, 7, 15, 31, 63, 127, and 255. For example, acceptable wildcards are 0.0.0.3, 0.0.0.255, and 0.0.15.255. A wildcard of 0.0.7.15 is not acceptable since the one-bits are not contiguous.When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the charging service named css-svc1, and downlink IP packets coming from the host with the IP address 2002::c6a2:6419, and fragmented packets for any destination are matched:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: A maximum of 16 rule definitions can be configured per ACL.The following command defines a rule definition to redirect packets to a charging service named css-svc1:
redirect css service svc_name [ log ] downlink { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
after redirect css service svc_name [ log ] downlink { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
after redirect css service svc_name [ log ] downlink { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
no redirect css service svc_name [ log ] downlink { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
|
•
|
tcp: Redirect applies to TPC packets.
|
|
•
|
udp: Redirect applies to UDP packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
eq source_port
source_port must be configured to an integer value from 0 to 65535.
gt source_port
source_port must be configured to an integer value from 0 to 65535.
lt source_port
source_port must be configured to an integer value from 0 to 65535.
neq source_port
source_port must be configured to an integer value from 0 to 65535.
range start_source_port end_source_port
start_source_port is the initial port in the range and end_source_port is the final port in the range.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).eq dest_port
dest_port must be configured to an integer value from 0 to 65535.
gt dest_port
dest_port must be configured to an integer value from 0 to 65535.
lt dest_port
dest_port must be configured to an integer value from 0 to 65535.
neq dest_port
dest_port must be configured to an integer value from 0 to 65535.
range start_dest_port end_dest_port
start_dest_port is the initial port in the range and end_dest_port is the final port in the range.
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the charging service named css-svc1, and UDP packets coming from any host are matched:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
Important: It is suggested that any rule definition which is added to be a catch all should also have the log option specified. The logged packets may be used to determine if the current list of rule definitions is adequate or needs modification to ensure proper security.
Important: A maximum of 16 rule definitions can be configured per ACL.
Important: Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the charging service with the name css-svc1 and any source IP:
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must ben alphanumeric string of 1 through 15 characters.
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the charging service with the name css-svc1 and a host IP address of fe80::c0a8:c80b:
redirect css service svc_name [ log ] uplink icmp { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ icmp_type [ icmp_code ] ]
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the Content Service Steering (CSS) service to which packets are to be redirected. At the executive mode prompt, use the show css service all command to display the names of all configured CSS services.
svc_name must be an alphanumeric string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: A maximum of 16 rule definitions can be configured per ACL. Also note that “redirect” rule definitions are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule definition that redirects packets to the charging service named chgsvc1, and ICMP packets in the uplink (to the Mobile Node) direction from the host with the IP address 198.162.100.25:
redirect css service svc_name [ log ] uplink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
after redirect css service svc_name [ log ] uplink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
before redirect css service svc_name [ log ] uplink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
no redirect css service svc_name [ log ] uplink ip { any | host source_host_address | source_address source_wildcard } { any | host dest_host_address | dest_address dest_wildcard } [ fragment ]
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule definition, the insertion point does not change.css service svc_name
The name of the active charging service to which packets are to be redirected. At the executive mode prompt, use the show active-charging service all command to display the names of all configured charging services.
svc_name must be a string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). Therefore, allowed masks are 0, 1, 3, 7, 15, 31, 63, 127, and 255. For example, acceptable wildcards are 0.0.0.3, 0.0.0.255, and 0.0.15.255. A wildcard of 0.0.7.15 is not acceptable since the one-bits are not contiguous.When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
The following command defines a rule definition that redirects packets to the charging service named chgsvc1, and uplink IP packets going to the host with the IP address 198.162.100.25, and fragmented packets for any destination are matched:
css service svc_name
The name of the active charging service to which packets are to be redirected. At the executive mode prompt, use the show active-charging service all command to display the names of all configured charging services.
svc_name must be a string of 1 through 15 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
The following command defines a rule definition to redirect packets to a charging service named chgsvc1:
redirect css service svc_name [ log ] uplink { tcp | udp } { { source_address source_wildcard | any | source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
after redirect css service svc_name [ log ] uplink { tcp | udp } { { source_address source_wildcard | any | source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
before redirect css service svc_name [ log ] uplink { tcp | udp } { { source_address source_wildcard | any | source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
no redirect css service svc_name [ log ] uplink { tcp | udp } { { source_address source_wildcard | any | source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port | range start_source_port end_source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port | range start_dest_port end_dest_port ] }
css service svc_name
The name of the active charging service to which packets are to be redirected. At the executive mode prompt, use the show active-charging service all command to display the names of all configured charging services.
svc_name must be a string of 1 through 15 characters.
|
•
|
tcp: Redirect applies to TPC packets.
|
|
•
|
udp: Redirect applies to UDP packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
eq source_port
source_port must be configured to an integer value from 0 to 65535.
gt source_port
source_port must be configured to an integer value from 0 to 65535.
lt source_port
source_port must be configured to an integer value from 0 to 65535.
neq source_port
source_port must be configured to an integer value from 0 to 65535.
range start_source_port end_source_port
start_source_port is the initial port in the range and end_source_port is the final port in the range.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
eq dest_port
dest_port must be configured to an integer value from 0 to 65535.
gt dest_port
dest_port must be configured to an integer value from 0 to 65535.
lt dest_port
dest_port must be configured to an integer value from 0 to 65535.
neq dest_port
dest_port must be configured to an integer value from 0 to 65535.
range start_dest_port end_dest_port
start_dest_port is the initial port in the range and end_dest_port is the final port in the range.
The following command defines a rule definition that redirects packets to the charging service named chgsvc1, and UDP packets coming from any host are matched:
redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] source_address source_wildcard
after redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] source_address source_wildcard
before redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] source_address source_wildcard
no redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] source_address source_wildcard
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.nexthop nexthop_addr
context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
interface interface_name
The name of the logical interface to which the packets should be redirected. interface_name must be an alpha and/or numeric string from 1 to 79 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). Therefore, allowed masks are 0, 1, 3, 7, 15, 31, 63, 127, and 255. For example, acceptable wildcards are 0.0.0.3, 0.0.0.255, and 0.0.15.255. A wildcard of 0.0.7.15 is not acceptable since the one-bits are not contiguous.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the next hop host at 192.168.10.4, the context with the context ID of 23 and the source IP and wildcard of 198.162.22.0 and 0.0.0.31:
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.nexthop nexthop_addr
context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
interface interface_name
The name of the logical interface to which the packets should be redirected. interface_name must be an alpha and/or numeric string from 1 to 79 characters.
Important: It is suggested that any rule which is added to be a catch all should also have the log option specified. The logged packets may be used to determine if the current list of rules is adequate or needs modification to ensure proper security. The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the next hop host at 192.168.10.4, the context with the context ID of 23 and any source IP:
redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] host source_ip_address
after redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] host source_ip_address
before redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] host source_ip_address
no redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] host source_ip_address
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.nexthop nexthop_addr
context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
interface interface_name
The name of the logical interface to which the packets should be redirected. interface_name must be an alpha and/or numeric string from 1 to 79 characters.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the next hop host at 192.168.10.4, the context with the context ID of 23 and a host IP address of 192.168.200.11:
redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
after redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
before redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
no redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] icmp { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ icmp_type [ icmp_code ] ]
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.nexthop nexthop_addr
context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
interface interface_name
The name of the logical interface to which the packets should be redirected. interface_name must be an alpha and/or numeric string from 1 to 79 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). Therefore, allowed masks are 0, 1, 3, 7, 15, 31, 63, 127, and 255. For example, acceptable wildcards are 0.0.0.3, 0.0.0.255, and 0.0.15.255. A wildcard of 0.0.7.15 is not acceptable since the one-bits are not contiguous.When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the next hop host at fe80::c0a8:a04, the context with the context ID of 23, and ICMP packets coming from the host with the IP address 2002::c6a2:64195:
redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] ip { source_address source_wildcard | any | host source_host_address } { dest_address dest_wildcard | any | host dest_host_address } [ fragment ] [ protocol num ]
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.nexthop nexthop_addr
context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
interface interface_name
The name of the logical interface to which the packets should be redirected. interface_name must be an alphanumeric string from 1 through 79 characters.
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).protocol num
num can be an integer from 0 through 255.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port ] }
after redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port ] }
before redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port ] }
no redirect nexthop nexthop_addr { context context_id | interface interface_name } [ log ] { tcp | udp } { { source_address source_wildcard | any | host source_host_address } [ eq source_port | gt source_port | lt source_port | neq source_port ] } { { dest_address dest_wildcard | any | host dest_host_address } [ eq dest_port | gt dest_port | lt dest_port | neq dest_port ] }
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.
Important: If the options specified do not exactly match an existing rule, the insertion point does not change.nexthop nexthop_addr
context context_id
The context identification number of the context to which packets are redirected. At the executive mode prompt, use the show context all command to display context names and context IDs.
interface interface_name
The name of the logical interface to which the packets should be redirected. interface_name must be an alphanumeric string from 1 through 79 characters.
|
•
|
tcp: Redirect applies to TCP packets.
|
|
•
|
udp: Redirect applies to UDP packets.
|
When specifying a group of addresses, the initial address is configured using this option. The range can then be configured using the source_wildcard parameter.
This option is used in conjunction with the source_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the source_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB).The IP address of the destination host to filter against expressed in IPv6 colon-separated notation.
eq source_port
source_port must be configured to an integer value from 0 to 65535.
gt source_port
source_port must be configured to an integer value from 0 to 65535.
lt source_port
source_port must be configured to an integer value from 0 to 65535.
neq source_port
source_port must be configured to an integer value from 0 to 65535.
When specifying a group of addresses, the initial address is configured using this parameter. The range can then be configured using the dest_wildcard parameter.
This option is used in conjunction with the dest_address option to specify a group of addresses for which packets are to be filtered.
|
•
|
Zero-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be identical.
|
|
•
|
One-bits in this parameter mean that the corresponding bits configured for the dest_address parameter must be ignored.
|
Important: The mask must contain a contiguous set of one-bits from the least significant bit (LSB). Therefore, allowed masks are 0, 1, 3, 7, 15, 31, 63, 127, and 255. For example, acceptable wildcards are 0.0.0.3, 0.0.0.255, and 0.0.15.255. A wildcard of 0.0.7.15 is not acceptable since the one-bits are not contiguous.eq dest_port
dest_port must be configured to an integer value from 0 to 65535.
gt dest_port
dest_port must be configured to an integer value from 0 to 65535.
lt dest_port
dest_port must be configured to an integer value from 0 to 65535.
neq dest_port
dest_port must be configured to an integer value from 0 to 65535.
Important: The maximum number of rules that can be configured per ACL varies depending on how the ACL is to be used. For more information, refer to the Engineering Rules appendix in the System Administration Guide. Also note that “redirect” rules are ignored for ACLs applied to specific subscribers or all subscribers facilitated by a specific context.The following command defines a rule that redirects packets to the next hop host at fe80::c0a8:a04, the context with the context ID of 23, and UDP packets coming from any host are matched:
