map rule

Mirrors source and destination rules on Layer 2-Layer 3 address and port number.

The bidir argument automatically creates a second map rule mirroring source arguments to destination (and vice-versa). For example, consider the following map rule:

(config) # map alias map1 rule add pass ipdst 192.168.1.50 255.255.255.0 ipsrc 192.168.1.25 255.255.255.0 bidir

Because the bidir argument is included, the system automatically creates a second map rule mirroring all source/destination criteria:

rule add pass ipsrc 192.168.1.50 255.255.255.0 ipdst 192.168.1.25 255.255.255.0

Note:  The second map rule is not displayed in the output of the show map command, however, it consumes map rule resources.

You can also include the bidir argument with an IP source and port source as follows:

(config) # map alias map2 rule add pass ipsrc 192.168.1.22 /32 portsrc 23 bidir

The bidir argument causes the following rule to be added automatically:

rule add pass ipdst 192.168.1.22 /32 portdst 23

You can also include the bidir argument with just a single IP address to specify that you want to see traffic both in and out of a particular address. For example, this rule specifies that we want all traffic to and from 192.168.1.75:

(config) # map alias map3 rule add pass ipsrc 192.168.1.75 /32 bidir

The bidir argument causes the following rule to be added automatically:

rule add pass ipdst 192.168.1.75 /32

You can also include the bidir argument with an IP source and destination and a port source and destination as follows:

(config) # map alias map4 rule add pass ipsrc 192.168.1.33 /32 ipdst 192.168.1.44 /32 portsrc 23 portdst 63 bidir

The bidir argument causes the following rule to be added automatically:

rule add pass ipdst 192.168.1.33 /32 ipsrc 192.168.1.44 /32 portdst 23 portsrc 63

Note:  If the bidir argument is added to a rule that does not support bidirectional filters, the bidir argument will not appear in the output of the show running-config command and there will not be any error message displayed. For example, the TCP protocol rule does not support bidirectional filters and the bidir argument does not appear in the output of the show running-config command for this rule.

Creates a map rule pattern for a particular decimal DSCP value. You can select any value within the four Assured Forwarding (af) class ranges or ef for Expedited Forwarding (the highest priority in the DSCP model).

The valid DSCP values by Assured Forwarding Class are as follows:

For example, the following map rule passes all traffic with expedited forwarding assigned:

(config map alias mymap) # map alias m1 rule add pass dscp ef

Creates a rule for an inner VLAN ID or range of inner VLAN IDs, as follows:

Double tagged packets have both an inner and an outer VLAN tag. The outer tag is detected when the ethertype is 0x8100, 0x88A8, or 0x9100. The inner tag is detected only when the ethertype is 0x8100.

Examples:

(config map alias mymap) # rule add pass inner-vlan 100 innervlan-subset even

(config) # map alias map1 rule add pass inner-vlan 100..200

Creates a rule for the 20-bit Flow Label field in an IPv6 packet. Packets with the same Flow Label, source address, and destination address are classified as belonging to the same flow. IPv6 networks can implement flow-based QoS using this approach.

Specify the flow label as a 3-byte hexadecimal pattern. Note, however, that only the last 20 bits are used—the first four bits must be zeroes (specified as a single hexadecimal zero in the CLI). For example, to match all packets without flow labels, use the following map rule:

(config map alias mymap) # rule add pass ip6fl 0x000000

Alternatively, to match the flow label of 0x12345, use the following:

(config map alias mymap) # rule add pass ip6fl 0x12345

Note:  The CLI accepts hexadecimal entries either with or without the leading 0x.

Creates a rule for either a source or destination IPv4 address or netmask.

Use netmask to match traffic from a range of IP addresses. You can enter netmasks using either dotted-quad notation (<xxx.xxx.xxx.xxx>) or in the bit count format (refer to Using Bit Count Netmasks on page 90).

Note that netmasks used in IP rules do not need to begin from the start of the address, nor do masked bits need to be contiguous. For example, the GigaVUE H Series node will accept a netmask where the masked bits start in the third octet, 0.0.255.255.

For example:

(config map alias mymap) # rule add pass ipsrc 1.1.1.1 /32

(config map alias mymap) # rule add pass ipdst 2.2.2.2 255.255.255.248

Creates a rule for either a source or destination MAC address as follows:

For example:

(config map alias mymap) # rule add drop macsrc 00:00:00:00:00:03 ffff.ffff.fffe

Refer to How to Use MAC Address/Mask Map Rules for examples of how to use MAC address masks.

Creates a rule for a source or destination application port. You can specify the following:

(config map alias mymap) # rule add pass portsrc 5000..5100

Following are some examples:

(config map alias mymap) # rule add pass portdst 5000..5100 portdst-subset odd

(config map alias mymap)# rule add pass protocol tcp portdst 3000

(config map alias mymap)# rule add pass protocol udp portdst 3000

(config map alias mymap)# rule add pass protocol tcp portsrc 3000

(config map alias mymap)# rule add pass protocol udp portsrc 3000

Note:  For non-TCP/UDP packets, the portsrc matches the first and second bytes after the L3 header. Whereas, the portdst matches the third and fourth bytes after the L3 header.

Creates a one-byte pattern match map rule for the standard TCP control bits (URG, SYN, FIN, ACK, and so on). Use the tcpctlmask argument to specify which bits should be considered when matching packets.

Refer to the “Set Map Rules for TCP Control Bits” section in the GigaVUE Fabric Management Guide for a list of the hexadecimal patterns for each of the eight TCP flags, along with some examples.

Note:  Map rules using the tcpctl argument must also include the protocol argument set to 6 (TCP).

For example:

(config map alias mymap) # rule add pass protocol 6 tcpctl 0x02

Creates a rule for the Time to Live (TTL—IPv4) or Hop Limit (IPv6) value in an IP packet, as a number between 0 and 255 as follows:

The TTL and Hop Limit fields perform the same function, specifying the maximum number of hops a packet can cross before it reaches its destination.

For example:

(config map alias mymap) # rule add pass ttl 0