packet-length filtering

[Mollerstrom]

I’m looking for a way to create and apply outbound filter on a ASR9K (ios-xr is currently 5.3.3 on a ASR9001 in the lab)

I would like to match for example on packet-lenght with an action drop or police traffic

A standard ACL will not work as I understand it, but you are able to match on packet-length in a class-map.

Using policy-map type pbr and class-map type traffic is only supported inbound, so now I wounder if there is another way to create a outbound filter that will match packet-length, tcp-flags, fragment-types

Just a short config example:

policy-map type pbr TEST_VER1

class type traffic PACKET_LENGTH_1

drop

!

end-policy-map

!

class-map type traffic match-all PACKET_LENGTH_1

match packet length ipv4 567

end-class-map

!

Thanks Jonas

[Eddie Chami · Accepted solution]

PBR is the only way to do this ingress at the moment, its not possible egress.

In 6.2.2 you will be able to natively match the pkt length with an ACL(Without PBR), but this is supported on the 800G line cards(Tomahawk). The 9001 is built on the Typhoon Arch, there is no plan to support the packet length matching there.

Regards

Eddie. 

[Mollerstrom]

Hello Eddie, thanks for the information.

I suppose the same is valid for matching fragments, tcp flags (supported in PBR) ?

Also do you know if the next gen 9001 is based on Tomahawk?

//J

[smailmilak]

There will be 9901 at the end of the year.

It will probably be Tomahawk based HW.

[Aleksandar Vidakovic]

yes, asr9901 is Tomahawk based.

[Adam Vitkovsky]

If you want to create an outbound filter that will match packet-length, you can use QOS policing for that purpose.

[Mollerstrom]

I don't think that will work if I want to have an drop or police action, it's seams to only be supported in PBR

[Adam Vitkovsky]

Of course you can:

http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-1/qos/command/reference/b_qos_cr41asr9k/b_qos_cr41asr9k_chapter_01.html#wp2433173040

either via “conform-action drop”

or via “exceed-action drop”

adam

[Mollerstrom]

Hi Adam, may I ask you for an example?

afaik matching packet length require class-typ traffic

!!% Policy manager does not support this feature: Match type "ip packet-length" not supported for class-map type "qos"

And you can not use a class-map type traffic in a QoS policy
!!% Policy manager does not support this feature: Class-map type "traffic" not supported within policy-map type "qos"

It's working in PBR, but PBR is ingress

//J