background image

C613-16058-00 REV C

www.alliedtelesis.com

AlliedWare

TM

 OS

How To |

Introduction

The AT-9900, x900-48, and x900-24 series switches support a powerful hardware based 
packet-filtering facility.

These switches can filter on a range of Layer 2, Layer 3, and Layer 4 packet attributes, and 
perform a variety of different actions on the packets that match the filters.

Because the filters are hardware-based, they put no load on the CPU of the switch, and have 
no affect on the throughput of the switch. It is possible to configure over 

1

000 different 

filters, and still have complete wire speed throughput on the switch.

The following configuration methods are available:

1.

To filter traffic across all ports on the switch, create dedicated hardware filters. 

2.

To filter traffic on a per-port basis, apply filtering actions to QoS flow groups or traffic 
classes.

This Note only describes method 

1

. Method 2 is described in 

How To Configure Filtering Actions 

on QoS Flow Groups and Traffic Classes

, available from 

www.alliedtelesis.com/resources/

literature/howto.aspx.

Configure Hardware Filters on AT-9900, x900-48, 
and x900-24 Series Switches

Содержание AT-9900 Series

Страница 1: ...he throughput of the switch It is possible to configure over 1000 different filters and still have complete wire speed throughput on the switch The following configuration methods are available 1 To f...

Страница 2: ...en combining QoS and hardware filters 8 2 The profile mask 9 Are there enough bytes for your set of filters 10 Some protocols also use filters so use some of the length 11 How to see the current filte...

Страница 3: ...B DIAg NLSp IPXwan ipxsocketnum ANY TCPSport portid port range ANY TCPDport portid port range ANY UDPSport portid port range ANY UDPDport portid port range ANY L4SMask mask L4DMask mask L5BYTE01 byteo...

Страница 4: ...ote see page 13 Note The default value of each mask is FFFF This means that if you specify a port number without specifying a mask then the classifier matches only that one value of the port number Th...

Страница 5: ...hey will all be treated like core ports if at least one of the ports is a core port Creating hardware filters Once you have created a classifier create a filter The filter uses the classifier and spec...

Страница 6: ...matches the packets in the stream and specify copy discard for the action setl2qos Note that this action has the other parameters associated with it as the following syntax shows add switch hwfilter f...

Страница 7: ...cket as if it belongs to the default traffic class for the port s QoS policy For this reason we only recommend combining hardware filters and QoS if all your hardware filters result in traffic being d...

Страница 8: ...an be configured on different ports So the rules for allocating packet to flow groups can differ from port to port Hence QoS can result in the rule table containing different sets of rules for differe...

Страница 9: ...filters that can be created Also the protocols that use filters see page 11 create at least one entry each 2 The profile mask The other item that affects the number of filters you can create is called...

Страница 10: ...already matches on those fields If you next make a hardware filter that matches on source UDP port this also does not add any length to the mask because it shares the same 2 bytes as the source TCP po...

Страница 11: ...n IP address destination TCP UDP port 6 6 1 4 2 19 bytes Some protocols also use filters so use some of the length The following protocols use filters and therefore use up some of the available profil...

Страница 12: ...one block on the base system for packets arriving in via any other port z one block allocated on the IPv6 accelerator Number of rules per application MLD Snooping 4 Accel Card IPv6 1 Switch HwFilter 2...

Страница 13: ...they are both 1 then the result is 1 otherwise the result is 0 Let s look at some examples Profile 1 IPv4 bytes used 3 of 16 Other Eth bytes used 5 of 16 Profile used to match on packets z Number of b...

Страница 14: ...choose the number of the ports as 4 power of 2 to simplify the example Before going into the complex examples there are some points to remember for the L4 mask calculation z if the beginning port is...

Страница 15: ...drop Example 3 ports 333 777 A more complex situation let s try to write the classifiers for UDP ports between 333 777 As we are trying to get rid of odd numbers in the beginning of our port range we...

Страница 16: ...ed 2 x 2 blocks one at the start classifier 2 and one at the end classifier 8 256 384 383 511 Port range Number of ports Command 333 334 335 336 351 352 383 384 511 512 767 768 775 776 777 1 2 16 32 1...

Страница 17: ...12288 24576 49152 4096 8192 16384 32768 65536 5120 10240 20480 40960 6144 12288 24576 49152 7168 14336 28672 57344 8192 16384 32768 65536 9216 18432 36864 10240 20480 40960 11264 22528 45056 12288 245...

Страница 18: ...ts reserved Information in this document is subject to change without notice All company names logos and product designs that are trademarks or registered trademarks are the property of their respecti...

Отзывы: