Alcatel-Lucent 7950 SR, System Management Manual

Page: 179 / 462

Security
7950 SR OS System Management Guide Page 179
Description
This command specifies fragmented or non-fragmented IP packets as an IP filter match criterion.
Note that an entry containing Layer 4 match criteria will not match non-initial (2nd, 3rd, etc)
fragments of a fragmented packet since only the first fragment contains the Layer 4 information.
This command enables match on existence of IPv6 Fragmentation Extension Header in the IPv6 filter
policy. To match first fragment of an IP fragmented packet, specify additional Layer 4 matching
criteria in a filter policy entry. The no version of this command ignores IPv6 Fragmentation Extension
Header presence/absence in a packet when evaluating match criteria of a given filter policy entry.
The no form of the command removes the match criterion.
This command enables match on existence of IPv6 Fragmentation Extension Header in the IPv6 filter
policy. To match first fragment of an IP fragmented packet, specify additional Layer 4 matching
criteria in a filter policy entry. The no version of this command ignores IPv6 Fragmentation Extension
Header presence/absence in a packet when evaluating match criteria of a given filter policy entry.
Default no fragment
Parameters true — Specifies to match on all fragmented IP packets. A match will occur for all packets that have
either the MF (more fragment) bit set or have the Fragment Offset field of the IP header set to a
non-zero value. For IPv6, packet matches if it contains IPv6 Fragmentation Extension Header.
false — Specifies to match on all non-fragmented IP packets. Non-fragmented IP packets are packets
that have the MF bit set to zero and have the Fragment Offset field also set to zero. For IPv6,
packet matches if it does not contain IPv6 Fragmentation Extension Header.
hop-by-hop-opt
Syntax hop-by-hop-opt { true | false }
no hop-by-hop-opt
Context config>sys>sec>cpm>ipv6-filter>entry > match
Description This command enables match on existence of Hop-by-Hop Options Extension Header in the IPv6 fil-
ter policy.
The no form of this command ignores Hop-by-Hop Options Extension Header presence/absence in a
packet when evaluating match criteria of a given filter policy entry.
Default
no hop-by-hop-opt
Parameters
true — Match if a packet contains Hop-by-Hop Options Extension Header.
false — Match if a packet does not contain Hop-by-Hop Options Extension Header.