doc/user/filter.rst

   1 *********
   2 Filtering
   3 *********
   4
   5 FRR provides many very flexible filtering features. Filtering is used
   6 for both input and output of the routing information. Once filtering is
   7 defined, it can be applied in any direction.
   8
   9 IP Access List
  10 ==============
  11
  12 .. index:: access-list NAME [seq (1-4294967295)] permit IPV4-NETWORK
  13 .. clicmd:: access-list NAME [seq (1-4294967295)] permit IPV4-NETWORK
  14
  15 .. index:: access-list NAME [seq (1-4294967295)] deny IPV4-NETWORK
  16 .. clicmd:: access-list NAME [seq (1-4294967295)] deny IPV4-NETWORK
  17
  18    seq
  19       seq `number` can be set either automatically or manually. In the
  20       case that sequential numbers are set manually, the user may pick any
  21       number less than 4294967295. In the case that sequential number are set
  22       automatically, the sequential number will increase by a unit of five (5)
  23       per list. If a list with no specified sequential number is created
  24       after a list with a specified sequential number, the list will
  25       automatically pick the next multiple of five (5) as the list number.
  26       For example, if a list with number 2 already exists and a new list with
  27       no specified number is created, the next list will be numbered 5. If
  28       lists 2 and 7 already exist and a new list with no specified number is
  29       created, the new list will be numbered 10.
  30
  31    Basic filtering is done by `access-list` as shown in the
  32    following example.
  33
  34    .. code-block:: frr
  35
  36       access-list filter deny 10.0.0.0/9
  37       access-list filter permit 10.0.0.0/8
  38       access-list filter seq 13 permit 10.0.0.0/7
  39
  40
  41 IP Prefix List
  42 ==============
  43
  44 *ip prefix-list* provides the most powerful prefix based
  45 filtering mechanism. In addition to *access-list* functionality,
  46 *ip prefix-list* has prefix length range specification and
  47 sequential number specification. You can add or delete prefix based
  48 filters to arbitrary points of prefix-list using sequential number specification.
  49
  50 If no ip prefix-list is specified, it acts as permit. If *ip prefix-list*
  51 is defined, and no match is found, default deny is applied.
  52
  53 .. index:: ip prefix-list NAME (permit|deny) PREFIX [le LEN] [ge LEN]
  54 .. clicmd:: ip prefix-list NAME (permit|deny) PREFIX [le LEN] [ge LEN]
  55
  56 .. index:: ip prefix-list NAME seq NUMBER (permit|deny) PREFIX [le LEN] [ge LEN]
  57 .. clicmd:: ip prefix-list NAME seq NUMBER (permit|deny) PREFIX [le LEN] [ge LEN]
  58
  59    You can create *ip prefix-list* using above commands.
  60
  61    seq
  62       seq `number` can be set either automatically or manually. In the
  63       case that sequential numbers are set manually, the user may pick any
  64       number less than 4294967295. In the case that sequential number are set
  65       automatically, the sequential number will increase by a unit of five (5)
  66       per list. If a list with no specified sequential number is created
  67       after a list with a specified sequential number, the list will
  68       automatically pick the next multiple of five (5) as the list number.
  69       For example, if a list with number 2 already exists and a new list with
  70       no specified number is created, the next list will be numbered 5. If
  71       lists 2 and 7 already exist and a new list with no specified number is
  72       created, the new list will be numbered 10.
  73
  74    le
  75       Specifies prefix length. The prefix list will be applied if the prefix
  76       length is less than or equal to the le prefix length.
  77
  78    ge
  79       Specifies prefix length. The prefix list will be applied if the prefix
  80       length is greater than or equal to the ge prefix length.
  81
  82
  83    Less than or equal to prefix numbers and greater than or equal to
  84    prefix numbers can be used together. The order of the le and ge
  85    commands does not matter.
  86
  87    If a prefix list with a different sequential number but with the exact
  88    same rules as a previous list is created, an error will result.
  89    However, in the case that the sequential number and the rules are
  90    exactly similar, no error will result.
  91
  92    If a list with the same sequential number as a previous list is created,
  93    the new list will overwrite the old list.
  94
  95    Matching of IP Prefix is performed from the smaller sequential number to the
  96    larger. The matching will stop once any rule has been applied.
  97
  98    In the case of no le or ge command, the prefix length must match exactly the
  99    length specified in the prefix list.
 100
 101 .. index:: no ip prefix-list NAME
 102 .. clicmd:: no ip prefix-list NAME
 103
 104 .. _ip-prefix-list-description:
 105
 106 ip prefix-list description
 107 --------------------------
 108
 109 .. index:: ip prefix-list NAME description DESC
 110 .. clicmd:: ip prefix-list NAME description DESC
 111
 112    Descriptions may be added to prefix lists. This command adds a
 113    description to the prefix list.
 114
 115 .. index:: no ip prefix-list NAME description [DESC]
 116 .. clicmd:: no ip prefix-list NAME description [DESC]
 117
 118    Deletes the description from a prefix list. It is possible to use the
 119    command without the full description.
 120
 121 .. _ip-prefix-list-sequential-number-control:
 122
 123 ip prefix-list sequential number control
 124 ----------------------------------------
 125
 126 .. index:: ip prefix-list sequence-number
 127 .. clicmd:: ip prefix-list sequence-number
 128
 129    With this command, the IP prefix list sequential number is displayed.
 130    This is the default behavior.
 131
 132 .. index:: no ip prefix-list sequence-number
 133 .. clicmd:: no ip prefix-list sequence-number
 134
 135    With this command, the IP prefix list sequential number is not
 136    displayed.
 137
 138 .. _showing-ip-prefix-list:
 139
 140 Showing ip prefix-list
 141 ----------------------
 142
 143 .. index:: show ip prefix-list
 144 .. clicmd:: show ip prefix-list
 145
 146    Display all IP prefix lists.
 147
 148 .. index:: show ip prefix-list NAME
 149 .. clicmd:: show ip prefix-list NAME
 150
 151    Show IP prefix list can be used with a prefix list name.
 152
 153 .. index:: show ip prefix-list NAME seq NUM
 154 .. clicmd:: show ip prefix-list NAME seq NUM
 155
 156    Show IP prefix list can be used with a prefix list name and sequential
 157    number.
 158
 159 .. index:: show ip prefix-list NAME A.B.C.D/M
 160 .. clicmd:: show ip prefix-list NAME A.B.C.D/M
 161
 162    If the command longer is used, all prefix lists with prefix lengths equal to
 163    or longer than the specified length will be displayed. If the command first
 164    match is used, the first prefix length match will be displayed.
 165
 166 .. index:: show ip prefix-list NAME A.B.C.D/M longer
 167 .. clicmd:: show ip prefix-list NAME A.B.C.D/M longer
 168 .. index:: show ip prefix-list NAME A.B.C.D/M first-match
 169 .. clicmd:: show ip prefix-list NAME A.B.C.D/M first-match
 170 .. index:: show ip prefix-list summary
 171 .. clicmd:: show ip prefix-list summary
 172 .. index:: show ip prefix-list summary NAME
 173 .. clicmd:: show ip prefix-list summary NAME
 174 .. index:: show ip prefix-list detail
 175 .. clicmd:: show ip prefix-list detail
 176 .. index:: show ip prefix-list detail NAME
 177 .. clicmd:: show ip prefix-list detail NAME
 178
 179 Clear counter of ip prefix-list
 180 -------------------------------
 181
 182 .. index:: clear ip prefix-list [NAME [A.B.C.D/M]]
 183 .. clicmd:: clear ip prefix-list [NAME [A.B.C.D/M]]
 184
 185    Clears the counters of all IP prefix lists. Clear IP Prefix List can be used
 186    with a specified NAME or NAME and prefix.