| Argument | Type | Description |
|---|
| switch ( mandatory ) | enum | Matching the switch group on which the rule will apply. |
| ports (syscap=!crs_prestera) | multi { array-id, port: enum
} | Matching switch interfaces where the rule will apply to incoming traffic. Multiple ports and hardware-offloaded bonding interfaces can be selected. Note that the switch1-cpu port cannot be selected. If ports property is left empty, the rule will apply to all switch interfaces. |
| src-mac-address | super { address: macAddr
, [mask] /macAddr
} | Matching source MAC address and mask. |
| dst-mac-address | super { address: macAddr
, [mask] /macAddr
} | Matching destination MAC address and mask. |
| mac-protocol | alt { protocol-name: enum ()
, protocol-number: num [ .. 65535]
} | Matching a particular MAC protocol specified by protocol name or number (skips VLAN tags if any). |
| enum (not-present | present) | Matching VLAN header, whether the VLAN header is present or not. Requires vlan-filtering=yes. |
| vlan-id | num | Matching VLAN ID. Requires vlan-filtering=yes. |
| vlan-priority | num | Matching VLAN priority (priority code point). |
| src-address | super { address: ipAddr
, [mask] /alt { bitmask: ipAddr
, netmask: num [ .. 32]
}
} | Matching source IPv4 address and mask. If mac-protocol=arp is specified, matches the source IP in ARP packets. Without mac-protocol, matches only IPv4 packets. |
| dst-address | super { address: ipAddr
, [mask] /alt { bitmask: ipAddr
, netmask: num [ .. 32]
}
} | Matching destination IPv4 address and mask. If mac-protocol=arp is specified, matches the destination IP in ARP packets. Without mac-protocol, matches only IPv4 packets. |
| protocol | alt { protocol-name: enum ()
, protocol-number: num [ .. 255]
} | Matching a particular IP protocol specified by protocol name or number. Only applies to IPv4 packets if mac-protocol is not specified. To match certain IPv6 protocols, use the mac-protocol=ipv6 setting. |
| src-port | range | Matching source protocol port number (applies to IPv4 and IPv6 packets if mac-protocol is not specified). |
| dst-port | range | Matching destination protocol port number or range (applies to IPv4 and IPv6 packets if mac-protocol is not specified). |
| dscp | num | Matching the DSCP field of the packet (only applies to IPv4 packets). |
| src-address6 | super { address: ip6Addr
, [mask] /alt { bitmask: ip6Addr
, netmask: num
}
} | Matching source IPv6 address and mask. |
| dst-address6 | super { address: ip6Addr
, [mask] /alt { bitmask: ip6Addr
, netmask: num
}
} | Matching destination IPv6 address and mask. |
| traffic-class | num | Matching IPv6 traffic class. |
| flow-label | num | Matching IPv6 flow label. |
| copy-to-cpu | bool | Clones the matching packet and sends it to the CPU. |
| redirect-to-cpu | bool | Changes the destination port of a matching packet to the switch CPU. |
| mirror (syscap=switch-mirror-prestera) | bool | Clones the matching packet and sends it to the mirror-target port. |
| new-dst-ports | multi { array-id, port: alt { port: enum
, bond: iface_enum
}
} | Changes the destination port as specified, multiple ports allowed, including a switch CPU port.
- If the setting is left empty (e.g.
new-dst-ports=""), the packet will be dropped;
- If a port or hardware-offloaded bonding interface is specified, the packet will be redirected to that port. Only a single port or bond interface is supported;
- if you use the
all argument, packet will be allowed to pass through to the egress processing without being dropped;
- If this parameter is not used, the packet will be accepted as is.
|
| mirror-ports (syscap=switch-mv88e6xxx) | multi { array-id, port: enum
} | Selects multiple mirroring target ports, only available on the 88E6393X switch chip. Matched packets in the ACL rule will be copied and sent to selected ports. |
| new-qos-profile (syscap=crs_prestera) | enum | The name of the QoS profile to assign to the matched packets. |
| keep-qos-fields (syscap=crs_prestera) | bool | Should the original values of QoS fields (PCP, DSCP) be kept (yes), or replaced with the ones from the assigned QoS profile (no)? Relevant only if new-qos-profile is set. |
| new-vlan-id | num | Changes the VLAN ID to the specified value. Requires vlan-filtering=yes. |
| new-vlan-priority | num | Changes the VLAN priority (priority code point). Requires vlan-filtering=yes. |
| new-vrf (syscap=crs_prestera) | enum | Assigns ingress traffic to a specified VRF. Requires hardware-offloaded VRF support on the switch chip. On VRF-unaware switches (98DX3xxx and 98DX2xxx series), setting new-vrf to anything other than main will be treated as redirect-to-cpu=yes. |
| rate | num | Sets ingress traffic limitation (bits per second) for matched traffic. |