Implementing Protocol Filtering in ExtremeXOS
In
ExtremeXOS, the protocol filtering data-plane is implemented partially in
hardware and partially in software. Filtering is performed only on the ingress. When a
protocol filter is attached to a port, the following
ACL (Access Control List) rules
are configured:
- For each protocol in the protocol filter:
If the protocol does not define a user-defined field, and the protocol identifier is
EtherType, or does not have a protocol identifier:
- An ACL rule is added to drop all
packets on the port that match the destination address of the packet. The rule is also
qualified with the EtherType of the protocol if it defines one.
Else:
- An ACL rule is added to copy and drop
all packets on the port that match the destination address of the packet. The rule is
also qualified with the EtherType of the protocol if it defines one.
The protocol filtering data-plane inspects all packets received from ports that have protocol
filters attached, and drops any packet that matches any of the protocols configured in the
protocol filter.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB