Nortel business policy switch 2000, User Manual

Page: 294 / 412

294 Chapter 4 Policy-enabled networks
208700-C
IP filters have the same actions as layer 2 filters. If an IP filter is installed on a
trusted port, then it cannot change the DSCP of the matching IP traffic or 802.1p
user priority. If an IP filter is installed on an untrusted port, then it must change the
DSCP, IEEE 802.1p, and drop precedence of the matching IP traffic. If an IP filter
is installed on an unrestricted port, you configure that interface to change or not
either the DSCP, IEEE 802.1p, and drop precedence of the matching IP traffic, as
you want.
Refer to Table 57 and Table 58 for more information on layer 2 traffic, either IP or
non-IP, and trusted, untrusted, or unrestricted ports.
Changing IEEE 802.1p priority and drop precedence
You can change the IEEE 802.1p priority and drop precedence for IP traffic by
using either IP or layer 2 filters. To change IEEE 802.1p priority and drop
precedence for non-IP traffic, you must use layer 2 filters.
For example, to configure a policy that changes the IEEE 802.1p priority and drop
precedence of traffic belonging to VLAN 100 received on untrusted ports that are
associated with a specific role combination (or interface group), you would need
the following two filters:
• A layer 2 filter that changes the DSCP, IEEE 802.1p priority, and drop
precedence of IP traffic in VLAN 100
• A layer 2 filter that changes IEEE 802.1p priority and drop precedence of all
types of traffic (both IP and non-IP) in VLAN 100
The layer 2 filter is able to match against multiple layer 3 protocols. Otherwise,
numerous layer 2 filters would be necessary to match against all non-IP traffic.
The first filter identifies IP traffic, and the second filter matches everything else
for VLAN 100. Because the first filter is installed on an untrusted port, it must
change the DSCP, IEEE 802.1p priority, and drop precedence of the matching IP
traffic.
For trusted ports, you also need two layer 2 filters. However, the actions will not
re-mark the fields. Layer 2 filters that do not match IP traffic pass the traffic
through untouched. With layer 2 filters that match IP traffic, the hardware matches
the fields using mapping tables you configure (or uses the preset default tables,
which Nortel Networks recommends).