Traffic Management: Rules

Endpoints

Display rules : GET /api2/tm/rulesets/<set_id>/rules/ viewer

Json structure

Create new rule : POST /api2/tm/rulesets/<set_id>/rules/ user

Json structure

Display single rule : GET /api2/tm/rulesets/<set_id>/rules/<rule_id> viewer

Json structure

Edit rule : PUT /api2/tm/rulesets/<set_id>/rules/<rule_id> user

Json structure

Delete rule : DELETE /api2/tm/rulesets/<set_id>/rules/<rule_id> user

Dry-run preview

The mutation endpoints above accept an optional ?dry_run=true query parameter. With the flag set, the handler runs all the same checks as the non-dry-run call but does not persist to the DAO and does not push to the network module. Returns 200 {} on success; error responses (status code and body) are identical to the non-dry-run call. When the edit changes what the rule-set costs, the 200 body is instead the resource cost report described in Chain Management: the rules whose cost changed under rules, the traffic chains whose cost changed under chains — both arrays are always present — and the rule-set totals under total.

A failure in the compile of the rule set, or in the link of its compiled output against the deployed one, answers the error and persists nothing: the rule is not stored, and nothing is pushed to the network module.

Resource cost

Each rule reports two integer fields derived from real compiler output:

ingress_resource_cost — number of ingress-pipeline TCAM entries attributed to this rule (sum of compiled ingress filter costs whose source rule id matches).

resource_cost — number of egress-pipeline TCAM entries attributed to this rule (count of compiled egress filters whose source rule id matches).

Both values come from a cached compile snapshot kept on the ruleset. The snapshot is refreshed on every successful compile of the ruleset. Neither field is persisted.

The traffic chains of the ruleset are compiled alongside the rules and consume the same TCAM, but their entries belong to no rule and are charged to the chain they come from instead: they are not part of any rule's cost, while the ruleset totals do include them. A dry run reports them under chains, see Chain Management.

Json structures

Display Rule json structure

{
    "id": 1,
    "set_id": 10,
    "ingress_resource_cost": 1,
    "resource_cost": 2,
    "name": "rule_name",
    "src_ports": [{"id":1, "type":"INF"}, ...],
    "dst_ports": [{"id":1, "type":"INF"}, {"id":130, "type":"CPU"}, {"id":130, "type":"LAG"}, ...],
    "enable_counter": true,
    "filter": {
        "bidirectional": false,
        "l2": {
            "src_mac": {"type":"mac", "val":"aa:aa:aa:aa:aa:aa", "mask":"ff:ff:ff:ff:ff:ff"},
            "dst_mac": {"type":"mac", "val":"aa:aa:aa:aa:aa:aa", "mask":"ff:ff:ff:ff:ff:ff"},
            "eth_type": {"type":"hex16", "val":"86dd", "mask":"ffff"},
            "in_vid_group": 1,
            "out_vid_group": 2,
            "mpls_label_0": {"type": "mpls", "val": "ad2a3", "mask": "ffff00"},
            "mpls_label_1": {"type": "mpls", "val": "ad2a3", "mask": "ffff00"},
            "mpls_label_2": {"type": "mpls", "val": "ad2a3", "mask": "ffff00"},
            "mpls_label_3": {"type": "mpls", "val": "ad2a3", "mask": "ffff00"},
            "mpls_label_4": {"type": "mpls", "val": "ad2a3", "mask": "ffff00"},
            "mpls_label_5": {"type": "mpls", "val": "ad2a3", "mask": "ffff00"}
        },
        "l3": {
            "src_addr": {"type":"ipv4", "val":"192.168.1.20", "mask":"255.255.255.0"},
            "dst_addr": {"type":"ipv4", "val":"192.168.1.20", "mask":"255.255.255.0"},
            "src_addr6": {"type":"ipv6", "val":"...", "mask":"..."},
            "dst_addr6": {"type":"ipv6", "val":"...", "mask":"..."},
            "protocol": {"type":"hex8", "val":"2f", "mask":"ff"},
            "mf_flag": true/false/null,
            "df_flag": true/false/null,
            "offset_zero": true/false/null
        },
        "l3_advanced": {
            "src_groups": [1, 2],
            "dst_groups": [3, 4],
            "protocol": {"type":"hex8", "val":"06", "mask":"ff"}
        },
        "l4": {
            "src_port_group": 1,
            "dst_port_group": 1
        }
    },
    "actions": [
        {
            "type": "...",
            "data": {...}
        }
    ],
    "priority_class":0,
    "enable": true
}

Type	Data	Description
`drop`	`{}`	Drops packets which hits the rule.
`vlan_tag`	`"vid":<1-4095>`	Add VLAN tag with specified `vid`. This won't apply in case of QinQinQ.
`vlan_strip`	`{}`	Remove the inner or outer VLAN tag. This won't apply on untagged traffic.
`slicing`	`{"size": <num>}` where `<num>` is a decimal value between 64 and 9215	Truncates the packet to the specified size.
`erspan_strip`	`{}`	Decapsulate traffic from erspan tunnel.
`erspan_tunnel`	`{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "erspan_session_id":<id>, "timestamp":<bool>, "packet_size":<psize>, "vid":<vid>}`	Encapsulate traffic in erspan tunnel
`erspan3_tunnel`	`{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "erspan_session_id":<id>, "timestamp":<bool>, "packet_size":<psize>, "vid":<vid>}`	Encapsulate traffic in erspan3 tunnel
`gretap_tunnel`	`{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "erspan_session_id":<id>, "timestamp":<bool>, "packet_size":<psize>, "vid":<vid>}`	Encapsulate traffic in gretap tunnel
`gretap_tunnel_xx`	`{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "key":<key>, "vid":<vid>}`	Encapsulate traffic in L2GRE tunnel (XX family only)
	Where `<psize>` is `0` if not set, can be an integer between `128` and `9100` otherwise. Where `<vid>` is an integer between `1` and `4095` (further constrained by the platform's `max_ingress_vlan_tag_id`). Where `<key>` is an integer between `0` and `4294967295`.
`vxlan_strip`	`{}`	Stripping vxlan header
`mpls_strip`	`{}`	Stripping mpls tag
`teredo_strip`	`{}`	Stripping teredo header
`ipinip_strip`	`{}`	Stripping ipinip header
`gretap_strip`	`{}`	Stripping gretap header
`gtp_ip_allow`	`{"src_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}, "dst_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}}`	Allow to filter the inner IPv4 header src and destination addresses.
`gtp_ip_drop`	`{"src_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}, "dst_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}}`	A combination of gtp_ip_allow and drop actions.
`erspan_allow`	`{"session_id": {"type":"hex16", "val":"<addr>", "mask":"<mask>"}}`	Allow erspan
`erspan_drop`	`{"session_id": {"type":"hex16", "val":"<addr>", "mask":"<mask>"}}`	Erspan drop
`vxlan_allow`	`{"vni": {"type":"hex32", "val":"<addr>", "mask":"<mask>"}}`	Allow vxlan
`vxlan_drop`	`{"vni": {"type":"hex32", "val":"<addr>", "mask":"<mask>"}}`	Vxlan drop
`mpls_strip_all`	`{}`	Mpls strip all
`spoof_src_mac`	`{"mac":"<mac_address>"}`	Spoof src mac
`spoof_dst_mac`	`{"mac":"<mac_address>"}`	Spoof dst mac
`spoof_ts_mac`	`{}`	Spoof timestamp mac

drop

{}

Drops packets which hits the rule.

vlan_tag

"vid":<1-4095>

Add VLAN tag with specified vid. This won't apply in case of QinQinQ.

vlan_strip

{}

Remove the inner or outer VLAN tag. This won't apply on untagged traffic.

slicing

{"size": <num>} where <num> is a decimal value between 64 and 9215

Truncates the packet to the specified size.

erspan_strip

{}

Decapsulate traffic from erspan tunnel.

erspan_tunnel

{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "erspan_session_id":<id>, "timestamp":<bool>, "packet_size":<psize>, "vid":<vid>}

Encapsulate traffic in erspan tunnel

erspan3_tunnel

{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "erspan_session_id":<id>, "timestamp":<bool>, "packet_size":<psize>, "vid":<vid>}

Encapsulate traffic in erspan3 tunnel

gretap_tunnel

{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "erspan_session_id":<id>, "timestamp":<bool>, "packet_size":<psize>, "vid":<vid>}

Encapsulate traffic in gretap tunnel

gretap_tunnel_xx

{"src_ip": "<ipv4>", "dst_ip": "<ipv4>", "src_mac":"<mac>", "dst_mac":"<mac>", "key":<key>, "vid":<vid>}

Encapsulate traffic in L2GRE tunnel (XX family only)

Where <psize> is 0 if not set, can be an integer between 128 and 9100 otherwise.
Where <vid> is an integer between 1 and 4095 (further constrained by the platform's max_ingress_vlan_tag_id).
Where <key> is an integer between 0 and 4294967295.

vxlan_strip

{}

Stripping vxlan header

mpls_strip

{}

Stripping mpls tag

teredo_strip

{}

Stripping teredo header

ipinip_strip

{}

Stripping ipinip header

gretap_strip

{}

Stripping gretap header

gtp_ip_allow

{"src_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}, "dst_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}}

Allow to filter the inner IPv4 header src and destination addresses.

gtp_ip_drop

{"src_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}, "dst_addr": {"type":"ipv4", "val":"<addr>", "mask":"<mask>"}}

A combination of gtp_ip_allow and drop actions.

erspan_allow

{"session_id": {"type":"hex16", "val":"<addr>", "mask":"<mask>"}}

Allow erspan

erspan_drop

{"session_id": {"type":"hex16", "val":"<addr>", "mask":"<mask>"}}

Erspan drop

vxlan_allow

{"vni": {"type":"hex32", "val":"<addr>", "mask":"<mask>"}}

Allow vxlan

vxlan_drop

{"vni": {"type":"hex32", "val":"<addr>", "mask":"<mask>"}}

Vxlan drop

mpls_strip_all

{}

Mpls strip all

spoof_src_mac

{"mac":"<mac_address>"}

Spoof src mac

spoof_dst_mac

{"mac":"<mac_address>"}

Spoof dst mac

spoof_ts_mac

{}

Spoof timestamp mac

Traffic Management: Rules

Endpoints

Dry-run preview

Resource cost

Json structures

Display Rule json structure

Actions