1 of 13

Configuring Flows and Rules

This section provides information about configuring flows and rules.

Configuring Network Ports

Network ports are the source port(s) that can be specified in a flow for matching and filtering on one or more ingress traffic ports.

Reference

Command

network-ports <network-ports>

Description

CLI Example

You can verify the configuration by using the command(s) below:

Configuring Tool Ports

You can specify the destination(s) for packets matching the flow. The supported destinations are as follows:

port-id(s): matching traffic redirected to one or more tool ports
port-channel: matching traffic redirected to multiple tool ports with symmetric load balancing

Reference

Example

You can verify the configuration by using the command(s) below:

Configuring Flows

You can configure flows with rules to replicate and filter traffic between the network and tool ports.

Flow can be used to create a traffic stream between the network port and tool port, The traffic can be filtered by configuring rule(s) to permit/deny matching traffic.

Reference

Command

Example

Configuring Flow Description

You can specify the description of the flow. The description can contain upto 48 characters long and is case-sensitive.

Reference

Configuring Flow Rules (NVIDIA)

NVIDIA ASIC

You can configure a rule with certain qualifiers to aggregate and filter traffic from network port(s) to tool port(s) for monitoring.

Before configuring flow rules, Network and Tool ports must be configured

Reference

Example

You can verify the configuration by using the command(s) below:

Configuring Flow Rules (Broadcom)

Broadcom ASIC

You can configure a rule with certain qualifiers to aggregate and filter traffic from network port(s) to tool port(s) for monitoring.

Before configuring flow rules, Network and Tool ports must be configured

Configuring Flow Match Expression Rules

Using this command, users can configure a rule using an expression string for both inner and outer headers in encapsulated packets.

Before configuring flow rules, Network and Tool ports must be configured

This feature is supported only on NVIDIA spectrum-2/3 platforms

Reference

Expression qualifiers -
ethertype - L2 Ethertype, vlan - Vlan header value, src-ip - Source IP prefix, src-netmask - Source IP mask, dest-ip- Destination IP prefix, dest-netmask- Destination IP mask, protocol - Protocol type, l4portsrc- Transport layer source port, l4portdst - Transport layer destination port, tosval - Type of Service value, dscp - Differentiated services field value, ttl - Packet TTL, tcpctl - TCP control value, tcpctlmask - TCP control mask, teid - Encapsulation tunnel ID, inner-sip - Inner IP Source Address, inner-dip - Inner IP Destination Address, inner-protocol - Inner Header Protocol, inner_l4srcport - Inner Header UDP Source Port, inner_l4destport - Inner Header UDP Destination Port

Example

You can verify the configuration by using the command(s) below:

Configuring Flow UDF Rules

User Defined Filtering can be considered an inspection of a packet based on offset values. An ACL can be defined with UDF matching capabilities to give granularity and flexibility when identifying traffic patterns. It is often used for deeper packet analysis. Typical use cases include finding patterns inside the inner header when packets are tunnelled.

Using UDF, users can configure a rule to match specific bytes in the ingress packet based on a given offset to permit or deny matched packets

Offset for the L3 packet starts from the IP header in the packet
offset for the L2 packet starts from EtherType in the packet

Note: The maximum length that can be matched is 40 characters (i.e. 20 bytes), and the minimum is 4 characters (i.e. 2 bytes), excluding the "0x" prefix. The character string must be an even number of characters.

Before configuring flow rules, Network and Tool ports must be configured

This feature is supported only on NVIDIA spectrum-2/3 platforms

UDF and GTP can not be configured together on a device

Reference

Example

You can verify the configuration by using the command(s) below:

Configuring Push/Pop VLAN

VLAN aware mode provides APB administrators with the ability to match and modify packets in the flow before forwarding them to the tool port(s).

You can configure the APB to modify the flow as below:

Push VLAN - Push a new VLAN Tag onto the egress traffic.
Pop VLAN - Pop(remove) the VLAN Tag from the egress traffic.

This feature is only supported on the NVIDIA platforms

Reference

Example

You can verify the configuration by using the command(s) below:

Reference

Example

You can verify the configuration by using the command(s) below:

Configuring Flow Override Action(s)

You can configure a rule to override the configured flow action for egress ports to push and/or pop VLAN. You can also override tool port(s) for egress traffic.

override-action is per-rule and will require override-action for every rule in the flow

Reference

Example

You can verify the configuration by using the command(s) below:

Display Flow Information

Use the following command to check the rate of data flowing through a flow:

Reference

Command

show flow (all | <flow-name> ) rate

Description

EC5812 device: Need to execute "collect-flow-stats" before collecting the flow counters "show flow summary" and "show flow counters all" each time.

EC5812

Example

You can display the flow configuration and operational status as follows:

Reference

Example

Use the following command to show the flow summary:

Reference

Example

Use the following command to display the counters of all the flows:

Reference

Example

Clear Flow Counters

You can use the following command to clear all ASIC Flow counters:

Reference

Command

clear flow counters (all | <flow-name> [rule <ruleid> ])

Description

Example

pbnoscli# configure terminal pbnoscli(config)# flow flow01 pbnoscli(config-flow-flow01)# ! Exit from the current prompt description Configure description for flow enable Enable the flow end Exit to exec prompt exit Exit from the current prompt network-ports Configure network or TAP ports no no form pop-vlan Pop Vlan Tag push-vlan-tag Push VLAN tag rule Configure rule show Show commands tool-ports Configure network tool or analyzer ports top Exit to the configuration prompt pbnoscli(config-flow-flow01)# rule 1 permit description "Match Expression" <cr> counters Enable counters dest-ip Destination IP address dscp Differentiated services code point ethertype ethernet type, 0x800, 0x8100 gtp GTP Tunneling l4portdst L4 destination port l4portsrc L4 source port match-all Match all match-expression Flow Rule Qualifiers protocol IP protocol src-ip Source IP address tcpctl TCP Control Flags (maximum value is 0x3f) tosval Type of Service ttl Time-to-live udf-data User Defined Data vlan Vlan Identifier pbnoscli(config-flow-flow01)# rule 1 permit description "Match Expression" pbnoscli(config-flow-flow01)# $Match Expression" match-expression <matchexpression> Example qualifiers: ethertype, vlan, src-ip, src-netmask, dest-ip, dest-netmask, protocol, l4portsrc, l4portdst, tosval, dscp, ttl, tcpctl, tcpctlmask, teid, inner-sip, inner-dip, inner-protocol, inner_l4srcport, inner_l4destport pbnoscli(config-flow-flow01)# $Match Expression" match-expression "vlan 100 src-ip 1.1.1.1/32 dest-ip 2.2.2.2/32 protocol udp inner-sip 10.10.10.1/32 inner-dip 20.20.20.2/32" counters enable pbnoscli(config-flow-flow01)# end

Configuring Flows and Rules

Configuring Network Ports

hashtagReference

hashtagCLI Example

Configuring Tool Ports

hashtagReference

hashtagExample

Configuring Flows

hashtagReference

hashtagExample

Configuring Flow Description

hashtagReference

Configuring Flow Rules (NVIDIA)

hashtagReference

hashtagExample

Configuring Flow Rules (Broadcom)

hashtag

Configuring Flow Match Expression Rules

hashtagReference

hashtagExample

Configuring Flow UDF Rules

hashtagReference

hashtagExample

Configuring Push/Pop VLAN

hashtagReference

hashtagExample

hashtagReference

hashtagExample

Configuring Flow Override Action(s)

hashtagReference

hashtagExample

Display Flow Information

hashtagReference

hashtagEC5812

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

Clear Flow Counters

hashtagReference

hashtagExample

Configuring Tool Ports

hashtagReference

hashtagExample

Configuring Flows and Rules

Configuring Flows

hashtagReference

hashtagExample

Configuring Network Ports

hashtagReference

hashtagCLI Example

Configuring Flow Rules (NVIDIA)

hashtagReference

hashtagExample

Configuring Flow Rules (Broadcom)

hashtag

Configuring Flow Description

hashtagReference

hashtagExample

hashtagExample

Clear Flow Counters

hashtagReference

hashtagExample

Configuring Flow Match Expression Rules

hashtagReference

hashtagExample

Display Flow Information

hashtagReference

hashtagEC5812

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

hashtagReference

hashtagExample

Configuring Push/Pop VLAN

Reference

CLI Example

Reference

Example

Reference

Example

Reference

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

EC5812

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

CLI Example

Reference

Example

Reference

Example

Example

Reference

Example

Reference

Example

Reference

EC5812

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example

Reference

Example