diff --git a/content/nvue-reference/Set-and-Unset-Commands/ACL-and-CoPP.md b/content/nvue-reference/Set-and-Unset-Commands/ACL-and-CoPP.md index 61cbb25215..9d61e4fe94 100644 --- a/content/nvue-reference/Set-and-Unset-Commands/ACL-and-CoPP.md +++ b/content/nvue-reference/Set-and-Unset-Commands/ACL-and-CoPP.md @@ -57,9 +57,9 @@ cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action deny
-## nv set acl \ rule \ action erspan dest-ip +## nv set acl \ rule \ action dest-nat translate-ip -Configures the ERSPAN destination IP address. +Configures a static NAT rule to match a destination IP address and translate the IP address to a public IP address. ### Command Syntax @@ -70,19 +70,19 @@ Configures the ERSPAN destination IP address. ### Version History -Introduced in Cumulus Linux 5.0.0 +Introduced in Cumulus Linux 5.7.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action erspan dest-ip 10.10.10.3 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action dest-nat translate-ip 10.0.0.1 ```
-## nv set acl \ rule \ action erspan source-ip +## nv set acl \ rule \ action dest-nat translate-port -Configures the ERSPAN source IP address. +Configures a static PAT rule to match a destination IP address together with the layer 4 port and translate the IP address and port to a public IP address and port. ### Command Syntax @@ -98,14 +98,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action erspan source-ip 10.10.10.10 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action dest-nat translate-port 5000 ```
-## nv set acl \ rule \ action erspan ttl +## nv set acl \ rule \ action erspan dest-ip -Configures the ERSPAN Time to Live (TTL). You can specify a value between 1 and 255. +Configures the ERSPAN destination IP address. ### Command Syntax @@ -121,14 +121,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action erspan ttl 200 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action erspan dest-ip 10.10.10.3 ```
-## nv set acl \ rule \ action log +## nv set acl \ rule \ action erspan source-ip -Configures logging for ACLs. +Configures the ERSPAN source IP address. ### Command Syntax @@ -144,14 +144,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action log +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action erspan source-ip 10.10.10.10 ```
-## nv set acl \ rule \ action log level +## nv set acl \ rule \ action erspan ttl -Configures the log level for the specified ACL rule. You can set a value between 0 and 7. +Configures the ERSPAN Time to Live (TTL). You can specify a value between 1 and 255. ### Command Syntax @@ -162,19 +162,19 @@ Configures the log level for the specified ACL rule. You can set a value between ### Version History -Introduced in Cumulus Linux 5.9.0 +Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action log level 5 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action erspan ttl 200 ```
-## nv set acl \ rule \ action log rate +## nv set acl \ rule \ action log level -Configures the number of logs per minute you want to generate for the specified ACL rule. You can set a value between 1 and 50000. +Configures the log level for the specified ACL rule. You can set a value between 0 and 7. ### Command Syntax @@ -190,7 +190,7 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action log rate 30000 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action log level 5 ```
@@ -219,9 +219,9 @@ cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action log log-prefix 10.10.10.1/3
-## nv set acl \ rule \ action permit +## nv set acl \ rule \ action log rate -Configures a permit action to permit packets. +Configures the number of logs per minute you want to generate for the specified ACL rule. You can set a value between 1 and 50000. ### Command Syntax @@ -232,19 +232,19 @@ Configures a permit action to permit packets. ### Version History -Introduced in Cumulus Linux 5.0.0 +Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action permit +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action log rate 30000 ```
-## nv set acl \ rule \ action recent +## nv set acl \ rule \ action permit -Configures the ACL rule to be the most recent. +Configures a permit action to permit packets. ### Command Syntax @@ -255,19 +255,19 @@ Configures the ACL rule to be the most recent. ### Version History -Introduced in Cumulus Linux 5.9.0 +Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action recent +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action permit ```
-## nv set acl \ rule \ action set class +## nv set acl \ rule \ action police burst -Modifies the class value for packet classification. +Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the police burst rate; the number of packets or kilobytes (KB) allowed to arrive sequentially. You can specify a value between 1 and 2147483647. ### Command Syntax @@ -283,14 +283,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action set class 3 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police burst 1000 ```
-## nv set acl \ rule\ action set cos +## nv set acl \ rule \ action police class -Configures the 802.1p CoS value to modify in the packet. +Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the police action class. You can specify an integer between 0 and 7. ### Command Syntax @@ -306,14 +306,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action set cos 6 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police class 5 ```
-## nv set acl \ rule \ action set dscp +## nv set acl \ rule \ action police mode -Configures the DSCP value to modify in the packet. +Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the traffic mode. You can specify `packet`, `kbps`, `mbps` or `gbps`. ### Command Syntax @@ -329,14 +329,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action set dscp af12 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police mode mbps ```
-## nv set acl \ rule \ action police burst +## nv set acl \ rule \ action police rate -Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the police burst rate; the number of packets or kilobytes (KB) allowed to arrive sequentially. You can specify a value between 1 and 2147483647. +Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the policing rate. You can specify a value between 1 and 2147483647. ### Command Syntax @@ -352,14 +352,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police burst 1000 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police rate 2000 ```
-## nv set acl \ rule \ action police class +## nv set acl \ rule \ action recent -Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the police action class. You can specify an integer between 0 and 7. +Configures the ACL rule to be the most recent. ### Command Syntax @@ -370,19 +370,19 @@ Configures quality of service for traffic on the data plane. Using QoS policers, ### Version History -Introduced in Cumulus Linux 5.0.0 +Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police class 5 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action recent ```
-## nv set acl \ rule \ action police mode +## nv set acl \ rule \ action set class -Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the traffic mode. You can specify `packet`, `kbps`, `mbps` or `gbps`. +Modifies the class value for packet classification. ### Command Syntax @@ -398,14 +398,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police mode mbps +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action set class 3 ```
-## nv set acl \ rule \ action police rate +## nv set acl \ rule\ action set cos -Configures quality of service for traffic on the data plane. Using QoS policers, you can rate limit traffic so incoming packets get dropped if they exceed specified thresholds. This command configures the policing rate. You can specify a value between 1 and 2147483647. +Configures the 802.1p CoS value to modify in the packet. ### Command Syntax @@ -421,14 +421,14 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action police rate 2000 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action set cos 6 ```
-## nv set acl \ rule \ action source-nat translate-ip +## nv set acl \ rule \ action set dscp -Configures a NAT action rule to translate a source IP address. +Configures the DSCP value to modify in the packet. ### Command Syntax @@ -439,19 +439,19 @@ Configures a NAT action rule to translate a source IP address. ### Version History -Introduced in Cumulus Linux 5.7.0 +Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl acl_3 rule 1 action source-nat translate-ip 172.30.58.80 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 action set dscp af12 ```
-## nv show acl \ rule \ action source-nat translate-ip \ to \ +## nv set acl \ rule \ action source-nat translate-ip -Configures a dynamic NAT action rule to translate a source IP address range to a public address. +Configures a NAT action rule to translate a source IP address. ### Command Syntax @@ -467,14 +467,14 @@ Introduced in Cumulus Linux 5.7.0 ### Example ``` -cumulus@switch:~$ nv set acl acl_1 rule 1 action source-nat translate-ip 172.30.58.0 to 172.30.58.80 +cumulus@switch:~$ nv set acl acl_3 rule 1 action source-nat translate-ip 172.30.58.80 ```
-## nv set acl \ rule \ action source-nat translate-mac \ +## nv show acl \ rule \ action source-nat translate-ip \ to \ -Configures MAC address translation to translate a source MAC address to a public address. MAC address translation is equivalent to static NAT but operates at layer 2 on Ethernet frames. +Configures a dynamic NAT action rule to translate a source IP address range to a public address. ### Command Syntax @@ -490,7 +490,7 @@ Introduced in Cumulus Linux 5.7.0 ### Example ``` -cumulus@switch:~$ nv set acl MACL1 rule 1 action source-nat translate-mac 99:de:fc:32:11:01 +cumulus@switch:~$ nv set acl acl_1 rule 1 action source-nat translate-ip 172.30.58.0 to 172.30.58.80 ```
@@ -710,9 +710,9 @@ cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip fragment
-## nv set acl \ rule \ match ip hashlimit name +## nv set acl \ rule \ match ip hashlimit burst -Configures the hashlimit name you want to match. +Configures the hashlimit burst rate you want to match. ### Command Syntax @@ -728,14 +728,14 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit name NAME +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit burst 10 ```
-## nv set acl \ rule \ match ip hashlimit rate-above +## nv set acl \ rule \ match ip hashlimit destination-mask -Configures how much above the hashlimit rate you want to match. You can specify an `/second` `/min`, or `/hour`. The maximum rate is 1000000 per second. +Configures the hashlimit destination mask you want to match; the destination mask used to mask the source IP address. ### Command Syntax @@ -751,14 +751,14 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit rate-above 1000/min +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit destination-mask 32 ```
-## nv set acl \ rule \ match ip hashlimit burst +## nv set acl \ rule \ match ip hashlimit expire -Configures the hashlimit burst rate you want to match. +Configures the hashlimit expire time (in milliseconds) you want to match. ### Command Syntax @@ -774,14 +774,14 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit burst 10 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit expire 1000 ```
-## nv set acl \ rule \ match ip hashlimit source-mask +## nv set acl \ rule \ match ip hashlimit mode -Configures the hashlimit source mask you want to match; the source mask used to mask the source IP address. +Configures the hashlimit mode you want to match. You can specify `src-ip` or `dst-ip`. ### Command Syntax @@ -797,14 +797,14 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit source-mask 32 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit mode dst-ip ```
-## nv set acl \ rule \ match ip hashlimit destination-mask +## nv set acl \ rule \ match ip hashlimit name -Configures the hashlimit destination mask you want to match; the destination mask used to mask the source IP address. +Configures the hashlimit name you want to match. ### Command Syntax @@ -820,14 +820,14 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit destination-mask 32 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit name NAME ```
-## nv set acl \ rule \ match ip hashlimit expire +## nv set acl \ rule \ match ip hashlimit rate-above -Configures the hashlimit expire time (in milliseconds) you want to match. +Configures how much above the hashlimit rate you want to match. You can specify an `/second` `/min`, or `/hour`. The maximum rate is 1000000 per second. ### Command Syntax @@ -843,14 +843,14 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit expire 1000 +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit rate-above 1000/min ```
-## nv set acl \ rule \ match ip hashlimit mode +## nv set acl \ rule \ match ip hashlimit source-mask -Configures the hashlimit mode you want to match. You can specify `src-ip` or `dst-ip`. +Configures the hashlimit source mask you want to match; the source mask used to mask the source IP address. ### Command Syntax @@ -866,7 +866,7 @@ Introduced in Cumulus Linux 5.9.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit mode dst-ip +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip hashlimit source-mask 32 ```
@@ -1108,6 +1108,29 @@ cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip tcp all-mss-except 536
+## nv set acl \ rule \ match ip tcp dest-port + +Configures the switch to match the TCP destination port. You can specify `ANY`, `bootpc`, `bootps`, `clag`, `dhcp-client`, `dhcp-server`, `domain`, `ftp`, `http`, `https`, `imap2`, `ldap`, `ldaps`, `ntp`, `msdp`, `pop3`, `smtp`, `snmp` `snmp-trap`, `ssh`, `telnet`, `tftp`, `bgp`, `bfd`, `bfd-echo`, `bfd-multihop`, or a value between 0 and 65535. + +### Command Syntax + +| Syntax | Description | +| --------- | -------------- | +| `` | The ACL name. | +| `` | The ACL rule number. | + +### Version History + +Introduced in Cumulus Linux 5.9.0 + +### Example + +``` +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip tcp dest-port ANY +``` + +
+ ## nv set acl \ rule \ match ip tcp flags Configures the IP TCP flag you want match in the packet. You can specify: `ack`, `all`, `fin`, `none`, `psh`, `rst`, `syn`, or `urg`. @@ -1177,6 +1200,29 @@ cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip tcp mss 536
+## nv set acl \ rule \ match ip tcp source-port + +Configures the switch to match the TCP source port. You can specify `ANY`, `bootpc`, `bootps`, `clag`, `dhcp-client`, `dhcp-server`, `domain`, `ftp`, `http`, `https`, `imap2`, `ldap`, `ldaps`, `ntp`, `msdp`, `pop3`, `smtp`, `snmp` `snmp-trap`, `ssh`, `telnet`, `tftp`, `bgp`, `bfd`, `bfd-echo`, `bfd-multihop`, or a value between 0 and 65535. + +### Command Syntax + +| Syntax | Description | +| --------- | -------------- | +| `` | The ACL name. | +| `` | The ACL rule number. | + +### Version History + +Introduced in Cumulus Linux 5.9.0 + +### Example + +``` +cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 match ip tcp source-port ANY +``` + +
+ ## nv set acl \ rule \ match ip tcp state established Configures the TCP established state you want to match. @@ -1366,7 +1412,7 @@ cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 remark "The following line permits
-## nv set acl \ rule \ type +## nv set acl \ type Configures the ACL rule type. You can specify `ipv4`, `ipv6` or `mac`. @@ -1386,7 +1432,7 @@ Introduced in Cumulus Linux 5.0.0 ### Example ``` -cumulus@switch:~$ nv set acl EXAMPLE1 rule 10 type ipv4 +cumulus@switch:~$ nv set acl EXAMPLE1 type ipv4 ```
@@ -1489,9 +1535,9 @@ Configures a control plane ACL to apply a single rule for all packets forwarded
-## nv set system control-plane acl \ inbound control-plane +## nv set system control-plane acl \ inbound -Configures an inbound control plane ACL. +Configures an inbound ACL. ### Command Syntax @@ -1506,12 +1552,12 @@ Introduced in Cumulus Linux 5.5.0 ### Example ``` -cumulus@switch:~$ nv set system control-plane acl ACL1 inbound control-plane +cumulus@switch:~$ nv set system control-plane acl ACL1 inbound ```
-## nv set system control-plane acl \ outbound control-plane +## nv set system control-plane acl \ outbound Configures an outbound control plane ACL. @@ -1528,5 +1574,5 @@ Introduced in Cumulus Linux 5.5.0 ### Example ``` -cumulus@switch:~$ nv set system control-plane acl ACL1 outbound control-plane +cumulus@switch:~$ nv set system control-plane acl ACL1 outbound ```