map rule

Mirrors source and destination rules on Layer 2-Layer 3 address and port number.

The bidir argument automatically creates a second map rule mirroring source arguments to destination (and vice-versa). For example, consider the following map rule:

(config) # map alias map1 rule add pass ipdst 192.168.1.50 255.255.255.0 ipsrc 192.168.1.25 255.255.255.0 bidir

Because the bidir argument is included, the system automatically creates a second map rule mirroring all source/destination criteria:

rule add pass ipsrc 192.168.1.50 255.255.255.0 ipdst 192.168.1.25 255.255.255.0

Note:  The second map rule is not displayed in the output of the show map command, however, it consumes map rule resources.

You can also include the bidir argument with an IP source and port source as follows:

(config) # map alias map2 rule add pass ipsrc 192.168.1.22 /32 portsrc 23 bidir

The bidir argument causes the following rule to be added automatically:

rule add pass ipdst 192.168.1.22 /32 portdst 23

You can also include the bidir argument with just a single IP address to specify that you want to see traffic both in and out of a particular address. For example, this rule specifies that we want all traffic to and from 192.168.1.75:

(config) # map alias map3 rule add pass ipsrc 192.168.1.75 /32 bidir

The bidir argument causes the following rule to be added automatically:

rule add pass ipdst 192.168.1.75 /32

You can also include the bidir argument with an IP source and destination and a port source and destination as follows:

(config) # map alias map4 rule add pass ipsrc 192.168.1.33 /32 ipdst 192.168.1.44 /32 portsrc 23 portdst 63 bidir

The bidir argument causes the following rule to be added automatically:

rule add pass ipdst 192.168.1.33 /32 ipsrc 192.168.1.44 /32 portdst 23 portsrc 63

Note:  If the bidir argument is added to a rule that does not support bidirectional filters, the bidir argument will not appear in the output of the show running-config command and there will not be any error message displayed. For example, the TCP protocol rule does not support bidirectional filters and the bidir argument does not appear in the output of the show running-config command for this rule.

Creates a map rule pattern for a particular decimal DSCP value. You can select any value within the four Assured Forwarding (af) class ranges or ef for Expedited Forwarding (the highest priority in the DSCP model).

The valid DSCP values by Assured Forwarding Class are as follows:

For example, the following map rule passes all traffic with expedited forwarding assigned:

(config map alias mymap) # map alias m1 rule add pass dscp ef

Creates a rule for an inner VLAN ID or range of inner VLAN IDs, as follows:

Double tagged packets have both an inner and an outer VLAN tag. The outer tag is detected when the ethertype is 0x8100, 0x88A8, or 0x9100. The inner tag is detected only when the ethertype is 0x8100.

Examples:

(config map alias mymap) # rule add pass inner-vlan 100 innervlan-subset even

(config) # map alias map1 rule add pass inner-vlan 100..200

Creates a rule for the 20-bit Flow Label field in an IPv6 packet. Packets with the same Flow Label, source address, and destination address are classified as belonging to the same flow. IPv6 networks can implement flow-based QoS using this approach.

Specify the flow label as a 3-byte hexadecimal pattern. Note, however, that only the last 20 bits are used—the first four bits must be zeroes (specified as a single hexadecimal zero in the CLI). For example, to match all packets without flow labels, use the following map rule:

(config map alias mymap) # rule add pass ip6fl 0x000000

Alternatively, to match the flow label of 0x12345, use the following:

(config map alias mymap) # rule add pass ip6fl 0x12345

Note:  The CLI accepts hexadecimal entries either with or without the leading 0x.

Creates a rule for either a source or destination IPv4 address or netmask.

Use netmask to match traffic from a range of IP addresses. You can enter netmasks using either dotted-quad notation (<xxx.xxx.xxx.xxx>) or in the bit count format (refer to Using Bit Count Netmasks on page 90).

Note that netmasks used in IP rules do not need to begin from the start of the address, nor do masked bits need to be contiguous. For example, the GigaVUE H Series node will accept a netmask where the masked bits start in the third octet, 0.0.255.255.

For example:

(config map alias mymap) # rule add pass ipsrc 1.1.1.1 /32

(config map alias mymap) # rule add pass ipdst 2.2.2.2 255.255.255.248

Creates a rule for either a source or destination MAC address as follows:

For example:

(config map alias mymap) # rule add drop macsrc 00:00:00:00:00:03 ffff.ffff.fffe

Refer to How to Use MAC Address/Mask Map Rules for examples of how to use MAC address masks.

Creates a map rule for a particular protocol. For example, to create a map rule that excludes all GRE traffic, use the following

(config map alias gre-map) # rule add drop protocol gre

Protocol Map Rules and IPv6

The predefined protocol map-rules available for IPv4 (GRE, RSVP, and so on) are not allowed when ipver is set to 6. This is because with the next header approach used by IPv6, the next layer of protocol data is not always at a fixed offset as it is in IPv4.

To address this, the GigaVUE H Series node provides the <1-byte-hex> option to match against the standard hex values for these protocols in the Next Header field. The standard 1-byte-hex values for both IPv4 and IPv6 are as follows:

0x00: Hop-By-Hop Option (v6 only)

0x01: ICMP (v4 only)

0x02: IGMP

0x04: IP over IP

0x06: TCP

0x11: UDP

0x29: IPv6 over IPv4

0x2b: Routing Option (v6 only)

0x2c: Fragment (v6 only)

0x2E: RSVP (v4 only)

0x2F: GRE (v4 only)

0x32: Encapsulation Security Payload (ESP) Header

0x33: Authentication (v6 only)

0x3a: ICMP (v6 only)

0x3b: No Next Header (v6 only)

0x3c: Destination Option (v6 only)

Creates a rule for the Type of Service (TOS) value in an IPv4 header. The TOS value is how some legacy IPv4 equipment implements quality of service traffic engineering. The standard values are:

Note:  Most network equipment now uses DSCP to interpret the TOS byte instead of the IP precedence and TOS value fields.

For example:

(config map alias mymap) # rule add pass tosval 0000

Creates up to two user-defined, 16-byte pattern matches in a rule. A pattern is a particular sequence of bits at a specified offset from the start of a frame.

User-defined pattern matches consists of the following:

A single rule can contain up to two user-defined pattern matches.

Note:  Always use the predefined map rule elements instead of user-defined pattern matches when possible.

Refer to the “Working with User-Defined Pattern Match Rules” section in the GigaVUE Fabric Management Guide for details.