ACL Filter Policy Overview
484 Router Configuration Guide
Auto-generation of Filter-policy Address Prefix Match Lists
It is often desired to automatically update a filter policy when the configuration on a router
changes. To allow such a touch-less filter policy management, SR OS allows auto-generation
of address prefixes for IPv4 or IPv6 address prefix match lists based on operator-configured
criteria. When the configuration on a router changes, the match lists address prefixes are
automatically updated and, in-turn, all filter policies (CPM or IOM) that use these match lists
are automatically updated.
When using auto-generation of address prefixes inside an address prefix match list operators
can:
• Specify one or more regex expression matches against SR OS router configuration
per list.
• Specify wildcard matches by specifying regex wildcard match expression (“.*”).
• Mix auto-generated entries with statically configured entries within a match list.
The following additional rules apply to auto-generated entries:
• Operational and administrative states of a given router configuration are ignored
when auto-generating address prefixes.
• Duplicates are not removed when populated by different auto-generation matches
and static configuration.
• A configuration will fail if auto-generation of address prefix would result in filer
policy resource exhaustion on a filter entry, system, or line-card level.
The following may apply to this feature:
If filter policy resources are not available for newly auto-generated address prefixes when a
BGP configuration changes, new address-prefixes will not be added to impacted match lists
or filter policies as applicable. An operator must free resources and change filter policy
configuration or must change BGP configuration to recover from this failure.
Note: See Release notes and CLI section for details on what configuration supports
address prefix list auto-generation.
To Next Page
Loading...
