Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Configure traffic protection for Linux networking

Updated: June 12, 2026

Want to summarize with AI?

Log in

Configure Linux firewall rules from IOS XR to restrict traffic reaching Linux applications, allowing you to permit or deny traffic based on protocol, port, and ingress interface.

Use this procedure to configure traffic protection rules in IOS XR to control which traffic reaches Linux applications. Traffic protection provides a mechanism to configure Linux firewalls using IOS XR configuration, and applies rules based on any combination of remote address, local address, and ingress interface.

Any combination of remote address, local address, and ingress interface can be specified as rules to either allow or deny traffic. At least one parameter must be specified for a traffic protection rule to be valid.

Note

Do not use both native Linux firewalls and IOS XR Linux traffic protection simultaneously. If traffic is received on a protocol or port combination with no traffic protection rules configured, all traffic is allowed by default.

Procedure

1.

Configure the traffic protection rule. The following example configures a rule that denies all TCP traffic on port 999 except traffic arriving on interface HundredGigE0/0/0/25.

Example:

Router(config)#linux networking vrf default address-family ipv4 protection protocol
tcp local-port 999 default-action deny permit hundredgigE0/0/0/25
Router(config)#commit

Key parameters in this command:

  • address-family: Configuration for a particular IPv4 or IPv6 address family.

  • protection: Configure traffic protection for Linux networking.

  • protocol: Select the supported protocol — TCP or UDP.

  • local-port: L4 port number (1–65535 or all) for the traffic protection rule.

  • default-action deny: Drop all packets for this service unless a permit rule applies.

  • permit: Allow packets to reach the Linux application for the specified interface or address.
2.

Verify that the traffic protection rule is applied.

Example:

Router#show run linux networking
linux networking
 vrf default
  address-family ipv4
   protection
    protocol tcp local-port 999 default-action deny
     permit interface HundredGigE0/0/0/25
     !
    !
   !
 !

The running configuration confirms that the traffic protection rule is active. TCP traffic on port 999 is denied by default, and traffic arriving on interface HundredGigE0/0/0/25 is permitted.

The traffic protection rule is configured and active. Linux applications receive only the traffic that is permitted by the defined rules, and all other traffic on the specified port is denied.