1 of 13

Configuring Flows and Rules

This section provides information about configuring flows and rules.

Configuring Network Ports

Network ports are the source port(s) that can be specified in a flow for matching and filtering on one or more ingress traffic ports.

Reference

Configuring Tool Ports

You can specify the destination(s) for packets matching the flow. The supported destinations are as follows:

port-id(s): matching traffic redirected to one or more tool ports
port-channel: matching traffic redirected to multiple tool ports with symmetric load balancing

Reference

Example

You can verify the configuration by using the command(s) below:

Configuring Flows

You can configure flows with rules to replicate and filter traffic between the network and tool ports.

Flow can be used to create a traffic stream between the network port and tool port, The traffic can be filtered by configuring rule(s) to permit/deny matching traffic.

Reference

Configuring Flow Description

You can specify the description of the flow. The description can contain upto 48 characters long and is case-sensitive.

Reference

Command

description <string>

Description

Example

You can verify the configuration by using the command(s) below:

Configuring Flow Rules (NVIDIA)

NVIDIA ASIC

You can configure a rule with certain qualifiers to aggregate and filter traffic from network port(s) to tool port(s) for monitoring.

Before configuring flow rules, Network and Tool ports must be configured

Reference

Example

You can verify the configuration by using the command(s) below:

Configuring Flow Rules (Broadcom)

Broadcom ASIC

You can configure a rule with certain qualifiers to aggregate and filter traffic from network port(s) to tool port(s) for monitoring.

Before configuring flow rules, Network and Tool ports must be configured

Configuring Flow Match Expression Rules

Using this command, users can configure a rule using an expression string for both inner and outer headers in encapsulated packets.

Before configuring flow rules, Network and Tool ports must be configured

This feature is supported only on NVIDIA spectrum-2/3 platforms

Reference

Expression qualifiers -
ethertype - L2 Ethertype, vlan - Vlan header value, src-ip - Source IP prefix, src-netmask - Source IP mask, dest-ip- Destination IP prefix, dest-netmask- Destination IP mask, protocol - Protocol type, l4portsrc- Transport layer source port, l4portdst - Transport layer destination port, tosval - Type of Service value, dscp - Differentiated services field value, ttl - Packet TTL, tcpctl - TCP control value, tcpctlmask - TCP control mask, teid - Encapsulation tunnel ID, inner-sip - Inner IP Source Address, inner-dip - Inner IP Destination Address, inner-protocol - Inner Header Protocol, inner_l4srcport - Inner Header UDP Source Port, inner_l4destport - Inner Header UDP Destination Port

Example

You can verify the configuration by using the command(s) below:

Configuring Flow UDF Rules

User Defined Filtering can be considered an inspection of a packet based on offset values. An ACL can be defined with UDF matching capabilities to give granularity and flexibility when identifying traffic patterns. It is often used for deeper packet analysis. Typical use cases include finding patterns inside the inner header when packets are tunnelled.

Using UDF, users can configure a rule to match specific bytes in the ingress packet based on a given offset to permit or deny matched packets

Offset for the L3 packet starts from the IP header in the packet

Configuring Push/Pop VLAN

VLAN aware mode provides OPB administrators with the ability to match and modify packets in the flow before forwarding them to the tool port(s).

You can configure the OPBNOS to modify the flow as below:

Push VLAN - Push a new VLAN Tag onto the egress traffic.
Pop VLAN - Pop(remove) the VLAN Tag from the egress traffic.

Configuring Flow Override Action(s)

You can configure a rule to override the configured flow action for egress ports to and/or VLAN. You can also override tool port(s) for egress traffic.

override-action is per-rule and will require override-action for every rule in the flow

Display Flow Information

Use the following command to check the rate of data flowing through a flow:

Reference

Command

show flow (all | <flow-name> ) rate

Description

Example

You can display the flow configuration and operational status as follows:

Reference

Example

Use the following command to show the flow summary:

Reference

Example

Use the following command to display the counters of all the flows:

Reference

Example

Clear Flow Counters

You can use the following command to clear all ASIC Flow counters:

Reference

pbnoscli# configure terminal 
pbnoscli(config)# flow flow01
pbnoscli(config-flow-flow01)# 
  !                     Exit from the current prompt
  description           Configure description for flow
  enable                Enable the flow
  end                   Exit to exec prompt
  exit                  Exit from the current prompt
  network-ports         Configure network or TAP ports
  no                    no form
  pop-vlan              Pop Vlan Tag
  push-vlan-tag         Push VLAN tag
  rule                  Configure rule
  show                  Show commands
  tool-ports            Configure network tool or analyzer ports
  top                   Exit to the configuration prompt
pbnoscli(config-flow-flow01)# rule 1 permit description "Match Expression" 
  <cr>
  counters              Enable counters
  dest-ip               Destination IP address
  dscp                  Differentiated services code point
  ethertype             ethernet type, 0x800, 0x8100
  gtp                   GTP Tunneling
  l4portdst             L4 destination port
  l4portsrc             L4 source port
  match-all             Match all
  match-expression      Flow Rule Qualifiers
  protocol              IP protocol
  src-ip                Source IP address
  tcpctl                TCP Control Flags (maximum value is 0x3f)
  tosval                Type of Service
  ttl                   Time-to-live
  udf-data              User Defined Data
  vlan                  Vlan Identifier
pbnoscli(config-flow-flow01)# rule 1 permit description "Match Expression" 
pbnoscli(config-flow-flow01)# $Match Expression" match-expression 
  <matchexpression>     Example qualifiers: ethertype, vlan, src-ip, src-netmask, 
                                            dest-ip, dest-netmask, protocol, l4portsrc,
                                            l4portdst, tosval, dscp, ttl, tcpctl, tcpctlmask,
                                            teid, inner-sip, inner-dip, inner-protocol, 
                                            inner_l4srcport, inner_l4destport
pbnoscli(config-flow-flow01)# $Match Expression" match-expression "vlan 100 src-ip 1.1.1.1/32 dest-ip 2.2.2.2/32 protocol udp inner-sip 10.10.10.1/32 inner-dip 20.20.20.2/32" counters enable
pbnoscli(config-flow-flow01)# end

pbnoscli# configure terminal 
pbnoscli(config)# flow flow01
pbnoscli(config-flow-flow01)# 
  !                     Exit from the current prompt
  description           Configure description for flow
  enable                Enable the flow
  end                   Exit to exec prompt
  exit                  Exit from the current prompt
  network-ports         Configure network or TAP ports
  no                    no form
  pop-vlan              Pop Vlan Tag
  push-vlan-tag         Push VLAN tag
  rule                  Configure rule
  show                  Show commands
  tool-ports            Configure network tool or analyzer ports
  top                   Exit to the configuration prompt
pbnoscli(config-flow-flow01)# rule 1 permit description "Match Expression" 
  <cr>
  counters              Enable counters
  dest-ip               Destination IP address
  dscp                  Differentiated services code point
  ethertype             ethernet type, 0x800, 0x8100
  gtp                   GTP Tunneling
  l4portdst             L4 destination port
  l4portsrc             L4 source port
  match-all             Match all
  match-expression      Flow Rule Qualifiers
  protocol              IP protocol
  src-ip                Source IP address
  tcpctl                TCP Control Flags (maximum value is 0x3f)
  tosval                Type of Service
  ttl                   Time-to-live
  udf-data              User Defined Data
  vlan                  Vlan Identifier
pbnoscli(config-flow-flow01)# rule 1 permit description "Match Expression" 
pbnoscli(config-flow-flow01)# $Match Expression" match-expression 
  <matchexpression>     Example qualifiers: ethertype, vlan, src-ip, src-netmask, 
                                            dest-ip, dest-netmask, protocol, l4portsrc,
                                            l4portdst, tosval, dscp, ttl, tcpctl, tcpctlmask,
                                            teid, inner-sip, inner-dip, inner-protocol, 
                                            inner_l4srcport, inner_l4destport
pbnoscli(config-flow-flow01)# $Match Expression" match-expression "vlan 100 src-ip 1.1.1.1/32 dest-ip 2.2.2.2/32 protocol udp inner-sip 10.10.10.1/32 inner-dip 20.20.20.2/32" counters enable
pbnoscli(config-flow-flow01)# end

Configuring Flows and Rules

Configuring Network Ports

hashtagReference

Configuring Tool Ports

hashtagReference

hashtagExample

Configuring Flows

hashtagReference

Configuring Flow Description

hashtagReference

hashtagExample

Configuring Flow Rules (NVIDIA)

hashtagReference

hashtagExample

Configuring Flow Rules (Broadcom)

hashtag

Configuring Flow Match Expression Rules

hashtagReference

hashtagExample

Configuring Flow UDF Rules

Configuring Push/Pop VLAN

Configuring Flow Override Action(s)

hashtag

Display Flow Information

hashtagReference

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

Clear Flow Counters

hashtagReference

Configuring Flow Description

hashtagReference

hashtagExample

Configuring Flows and Rules

Configuring Tool Ports

hashtagReference

hashtagExample

Configuring Flow Override Action(s)

hashtag

Configuring Flow Rules (Broadcom)

hashtag

Configuring Flow UDF Rules

Configuring Push/Pop VLAN

Configuring Flows

hashtagReference

Clear Flow Counters

hashtagReference

Configuring Network Ports

hashtagReference

hashtagExample

hashtagExample

hashtagExample

hashtagCLI Example

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

Display Flow Information

hashtagReference

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

Configuring Flow Match Expression Rules

hashtagReference

hashtagExample

Configuring Flow Rules (NVIDIA)

hashtagReference

hashtagExample

Reference

Reference

Example

Reference

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Reference

Example

Reference

Example

Reference

Reference

Reference

Example

Example

Example

CLI Example

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example