Configuration Attributes

• The left side of a comparison operation must be either an arithmetic expression or a field. (Arithmetic expressions are described in Figure 4-1, and fields are described above.) The right side must be a field. The result of applying operators in a comparison expression is true or false.
  

• The left side of an arithmetic operation must be a field (described above) and the right side must be a constant (described below). The result of applying the operator in an arithmetic expression is a numerical value to be used by a comparison operator.
  

Constant

The configurator allows you to enter constants for use in constructing the filter expression. The format of the constant depends upon the associated field (or masked field) as shown below:

Field Names	Packet Header Field
macSrc	6 hex digit pairs (xx.xx.xx.x.xx.xx)
macDst	6 hex digit pairs (xx.xx.xx.x.xx.xx)
macProto	4 hex digits (must have leading 0s if necessary)
llcSSAP	2 hex digits (must have leading 0s if necessary)
llcDSAP	2 hex digits (must have leading 0s if necessary)
snapOUI	6 hex digits (must have leading 0s if necessary)
snapProto	4 hex digits (must have leading 0s if necessary)

Parentheses

Use parentheses to:

• force the evaluation of arithmetic operators before comparison operators
  

• force the evaluation of comparison operators before Boolean operators
  

• determine the order in which Boolean operators are evaluated if some other order than strictly left to right is desired
  

Syntax

An expression is evaluated from left to right at both the top level of the expression and within a pair of parentheses. The result of a filter expression is either a Boolean true (if the received packet matches the expression) or a Boolean false (if the received packet doesn't match). Then, based on the Action attribute setting, the packet is either blocked or forwarded.

You create a filter expression using the building blocks of fields, operators, constants and parentheses, which have been described above. Figure 4-1 shows the composition of a filter expression.

Figure 4-1 : Composition Of A Filter Expression

The following are some examples of filter syntax:

llcSSAP >= 01
(snapOUI & 00ff00) >= 005500
macSrc == 00:00:dd:00:00:12
(macSrc==00:00:dd:00:00:12) && (macDst != 00:00:dd:00:00:76)
(macSrc && ff:ff:00:00:00:00) == 00:dd:00:00:00:00
((macSrc & ff:ff:00:00:00:00) == 00:dd:00:00:00:00) &&
((macDst & ff:ff:00:00:00:00) != 00:dd:00:00:00:00) 
(llcSSAP >= 01) && (macProto == 1234) && (macSrc == 00:00:dd:00:00:12)
((llcSSAP == 02) || (llcSSAP == 04)) &&
((macSrc == 00:00:dd:00:00:12) || (macSrc == 00:00:dd:00:00:14))

Sample Filters

Sample 1. Suppose that you want the network to only allow Local Area Transport (LAT) traffic to be passed between two LANs. You would create a filter for the ports that support those LANs that blocks any traffic that is not LAT and forwards only LAT traffic. This filter would be specified as follows:

macProto==6004. (6004 is the hexadecimal value assigned to the LAT protocol type in RFC 1340, Assigned Numbers.)

You would then apply this filter to the ports that you want to use exclusively for LAT traffic with the Action attribute for the filter set to forward. You would also need to set the Default Action for the port to block. This combination of settings forwards LAT frames and blocks all others.

Sample 2. Consider the connections shown in Figure 4-2. Suppose that you want to prohibit end stations xx:xx:xx:xx:xx:xx and yy:yy:yy:yy:yy:yy from communicating with each other. You would create a filter for each port that blocks the traffic to the other end station.

Figure 4-2 : Connections to Be Filtered

The filters would be specified as follows:

For Port 1:

(macSrc==xx:xx:xx:xx:xx:xx) && (macDst==yy:yy:yy:yy:yy:yy)

For Port 4:

(macDst==xx:xx:xx:xx:xx:xx) && (macSrc==yy:yy:yy:yy:yy:yy)

You then assign each filter to the appropriate port and set the Action attribute for the filter to block. You would set the Default Action for the port to forward. This combination of settings prevents communication between the two end stations, but allows all other communication.

Sample 3. Using the same connections shown in Figure 4-2, suppose that you wanted to allow communication only between end station xx:xx:xx:xx:xx:xx and yy:yy:yy:yy:yy:yy. You would create a filter for each port that allows communication between the two end stations.

The filters would be specified as follows:

For Port 1:

(macSrc==xx:xx:xx:xx:xx:xx) && (macDst==yy:yy:yy:yy:yy:yy)

For Port 4:

(macDst==xx:xx:xx:xx:xx:xx) && (macSrc==yy:yy:yy:yy:yy:yy)

You then assign each filter to the appropriate port, but this time you would set the Action attribute for the filter to forward. You would set the Default Action for the port to block. This combination forwards traffic between the two end stations and blocks all other traffic.

Assigning Filters

Action

Specifies the action to be taken if a frame meets the conditions defined by the filter. This is a filter-level attribute. You can either specify that the frame should be forwarded into the network or blocked, in which case it is dropped at the edge. If you don't specify a setting for the filter-level Action attribute, then the opposite of the setting for the port-level Default Action attribute is used.

MIB name	lightStreamBrFilterParmAction
Field Type	Multiple choice
Legal Values	Forward or block
Default value	Block if Port Default Action = Forward Forward if Port Default Action = Block
Interrelationships	Default Action

Broadcast Limit

Specifies the number of receive broadcast packets that this port accepts and attempts to forward per second. The node discards all broadcast packets above this number per second.

MIB name	lightStreamBrPortBcastRateLimit
Field Type	Fill-in
Legal Values	0 = all broadcast packets are discarded. 1 - 128 = Packets above that number per second are discarded. -1 = all broadcast packets are forwarded.
Default value	-1

Default Action

Specifies the default action (either forward or block) to be taken for the port in the absence of any specific port filters or if there is not a match with the configured filter/s for the port. This is a port-level attribute.

MIB name	lightStreamBrPortDefaultAction
Field Type	Multiple choice
Legal Values	Forward or block
Default value	Forward
Interrelationships	Action

Priority

Specifies the precedence assigned to this filter. The lower the number, then the higher the filter's priority with regard to the other filters assigned to the port. Filters are performed in order of priority, with the highest priority filter being performed first. The lowest numerical priority value has the highest priority.

The rules regarding the assignment of priority are as follows:

• No two filters on any port should have the same priority. This attribute must be filled in for each filter on each port.
  

• Do not assign priority numbers sequentially because that makes it more difficult to reprioritize the filters. We recommend that you leave a gap between priority numbers then you can use one of the unused numbers to either raise or lower the priority level of a port filter without having to adjust any others.
  

  MIB name	lightStreamBrFilterParmFilterPriority
  Field Type	Fill-in
  Legal Values	1 - 65,535
  Default value	1 (highest priority)

Static Routes Attributes

This section describes the attributes used to create static entries in the bridge's filtering database. These attributes are found in the Static Route Configuration dialog box. Attributes are listed in alphabetical order.

The filtering database equates a MAC destination address with a LightStream port that can receive the frames with this MAC destination address and a set of LightStream ports on which the frames can then be transmitted. (The association between the receive port and the transmit port/s is called a profile. The assignment of a MAC address to a profile is called a static route.) The forwarding process uses the entries in the filtering database to determine if frames with a given MAC destination address should be specifically forwarded to a given port/s.

Through the configurator (or the CLI), you can explicitly make an entry in the filtering database; this is called a static entry. You may, for instance, want to make a static entry if you are directing a broadcast to specific ports in order to limit broadcast propagation. You would also make a static entry if you have an end station that only receives traffic, in which case the bridge can't learn about the station.

The rules governing the creation of static filters are as follows:

• You can create a maximum of 256 receive port/transmit ports profiles.
  

• You can create a maximum of 1024 static routes.
  

You should be familiar with IEEE 802.1d-1990, MAC Bridges, before you attempt to set any of these attributes. Specifically, you should be familiar with the following terms: filtering database, forwarding, MAC destination addresses, and receive port and transmit ports. You can also reference RFC 1493, Definition of Managed Objects for Bridges, for more information on static filtering attributes.

MAC

Specifies the destination MAC address to which this entry in the filtering database applies. The address can be a unicast, multicast or broadcast address. You can obtain MAC addresses from the appropriate network administrators.

MIB name	dot1dStaticAddress
Field Type	Fill-in
Legal Values	xx:xx:xx:xx:xx:xx (48-bit MAC address)
Default value	None

Receive Port

Specifies the LightStream interface number that must receive the frame in order for this filtering database entry to apply.

MIB name	dot1dStaticReceivePort
Field Type	Fill-in
Legal Values	0 = this entry applies on all ports of the bridge for which there is no other applicable entry; a frame with the specified MAC address can be received on any port of the bridge. Interface number comprised of the card slot number and the port number
Default value	None