This document describes how IPX filtering works and how to set up IPX filters. It includes the following sections:

How Filters Work

There are two types of IPX filters: global filters and circuit filters. Global filters apply to all IPX circuits on the router. Circuit filters apply only to the IPX circuits that you specify.

Figure 4 shows how to set up a circuit filter.

Before the circuit receives or transmits an IPX packet, the filter software compares the packet against any input or output filter on the circuit. To do so, the software checks the packet against each filter list in order and, within a filter list, it checks each filter item in order.

• If it finds a match, it takes the action specified for the filter list, either include or exclude.

• If it does not find a match, it takes the default filter action specified for the filter, either include or exclude.

SAP filters act on the server entries of SAP response packets. They filter based on the maximum hop count for a service or group of services.

Setting up SAP filters to exclude server entries from a packet has the following effect:

• On input filters, the router ignores server entries and does not enter them into the SAP table. This filter setup prevents all networks from learning about the selected service, at least through this router.

• On output filters, the router does not advertise the service. This filter setup prevents some networks from learning about the selected service, at least through this circuit.

RIP Router filters act on the IPX header of RIP response packets that the circuit receives. They filter based on the source node field.

You cannot set up RIP Router output filters.

Setting up RIP Router input filters to exclude packets means the router does not enter matching packets into the RIP routing table. This filter setup prevents all networks from learning about the selected network, at least through this router.

RIP Filters

RIP filters act on the network entries of RIP response packets. They filter based on the network address.

Setting up RIP filters to exclude network entries from a packet has the following effect:

• On input filters, the router ignores network entries and does not enter them into the RIP routing table. This filter setup prevents all networks from learning about the selected network, at least through this router.

• On output filters, the router does not advertise routing information. This filter setup prevents some networks from learning about the selected network, at least through this circuit.

IPX filters act on the IPX header of IPX packets. They filter based on source and destination network, node, and socket, as well as protocol type and hop count.

Note: Because IPX filters act on each packet the router receives, you should use them only when you require a high degree of specificity. That is, when you cannot use the RIP Router, RIP, or SAP filters.

• On input filters, the router discards the packets and prevents them from being transmitted on all circuits.

• On output filters, the router forwards packets that it receives out some circuits and not others.

Displaying the IPX Filtering Prompts

Configuration Prompts

Filter Type	How to Access the Configuration Prompt
IPX	IPX config>filter-lists ipx IPX IPX-List Config>
RIP Router	IPX config>filter-lists router IPX Router-List Config>
RIP	IPX config>filter-lists rip IPX RIP-List Config>
SAP	IPX config>filter-lists sap IPX SAP-List Config>

Monitoring Prompts

Filter Type	How to Access the Monitoring Prompt
IPX	IPX>filter-lists ipx IPX IPX-Lists>
RIP Router	IPX>filter-lists router IPX Router-Lists>
RIP	IPX>filter-lists rip IPX RIP-Lists>
SAP	IPX>filter-lists sap IPX SAP-Lists>

Configuring Filters

1. Display the appropriate configuration prompt.

IPX config>filter-list rip
IPX RIP-List Config>

2. Create a filter list and give it a name.

IPX RIP-List Config>create list
Enter a filter list name []? rip01

3. Display the configuration prompt for the filter list you created.

IPX RIP-List Config>update
Enter a filter list name []? rip01
IPX RIP-List 'rip01' Config>

4. Add filter criteria to the filter list.

IPX RIP-List 'rip01' Config>add
Network range start (in hex) [1]?
Network range end (in hex) [FFFFFFFE]?

The filter criteria vary according to the type of filter you are creating.

5. Set the action for the filter list to include or exclude.

IPX RIP-List 'rip01' Config>set-action include

When the software finds a match to an item in the filter list, it takes this action. See Table 7 and Table 8 for the results of including or excluding a packet.

6. Return to the filter configuration prompt.

IPX RIP-List 'rip01' Config>exit
IPX RIP-List Config>

7. Create an input or output filter for the desired circuit.

IPX RIP-List Config>create filter input
Enter an interface to filter [0]? 1

The software attaches a number to each filter. You use the number to configure the filter. To see a list of filter numbers, enter list all.

8. Set the default action for the filter to include or exclude.

IPX RIP-List Config>default exclude
Enter a filter number [1]? 1

If a packet does not match any of the filter criteria, the software takes the default action on the packet. See Table 7 and Table 8 for the results of including or excluding a packet.

9. Attach the filter list to a filter.

IPX RIP-List Config>attach
Enter a filter list name []? rip01
Enter a filter number [1]? 1

You can attach a filter list to more than one filter.

Enter Space after you type a command to display the available parameters for each command. Enter the help command for information about using the command line interface.

Enter these commands at the appropriate filtering prompt, shown in Displaying the IPX Filtering Prompts.

[C] means the command is available at the filtering configuration prompts.

[M] means the command is available at the filtering monitoring prompts.

Table 6 IPX Filter Commands

Command	Function
Attach [C]	Adds a filter list to a filter.
Cache [M]	Displays the entries in the IPX filter cache.
Clear [M]	Clears the statistics listed using the list filter command.
Create [C]	Creates a filter list or an input or output filter.
Default [C]	Sets the default action for a specified filter to include or exclude.
Delete [C]	Deletes a filter list or a filter.
Detach [C]	Deletes a filter list from a filter.
Disable [C] [M]	Globally disables this type of filtering or disables a specified filter.
Enable [C] [M]	Globally enables this type of filtering or enables a specified filter.
List [C] [M]	Lists a summary of statistics and settings for each filter currently running in the router.
Move [C]	Changes the order of filter lists within a specified filter.
Set-Cache [C]	Changes the cache size for IPX filters.
Update [C]	Displays the prompt that lets you configure a specific filter list.
Exit [C] [M]	Returns to the previous prompt.

Attach [C]

Syntax: attach filter-list-name filter-number

Enter a filter list name []? atm_list
Enter a filter number [1]? 3

Syntax: cache

filter

Enter a filter number [1]?
Hops Type Dst Net  Address      Sock Src Net  Address      Sock Action
---- ---- -------- ------------ ---- -------- ------------ ---- -------

Syntax: clear

all

filter

Example: clear all

filter filter-number

Example: clear filter

Enter a filter number [1]?6

Syntax: create

list

filter

Example: create list

Enter a filter list name []? newyork

By default, a new filter has no attached filter lists, it has a default action of include, and it is enabled.

You cannot create output filters for RIP Router filters.

Example: create filter input

Enter an interface to filter [0]?2

Syntax: default

exclude

include

Enter a filter number [1]? 3

Enter a filter number [1]? 2

Syntax: delete

list

filter

Example: delete list

Enter a filter list name []? newyork

Example: delete filter

Enter a filter number [1]?

Note: If the filter that you delete is not the highest number, all other filter numbers that are higher change.

Enter a filter list name []? newyork
Enter a filter number [1]?

Note: When you enter this command at the configuration prompt, the configuration is permanent and takes effect when you restart your router. When you enter this command at the monitoring prompt, the effect is immediate, but the configuration reverts to the configuration in SRAM when you restart your router.

all

filter

Example: disable all

filter filter-number

Example: disable filter

Enter a filter number [1]? 3

Syntax: enable

all

filter

Example: enable all

filter filter-number

Example: enable filter

Enter a filter number [1]? 3

Syntax: list

all

filter

Example: list all

Filtering: DISABLED
Filter Lists:
Name                           Action
------------------------------ ----------
smkipxlist                     EXCLUDE

Filters:
Id   Default    State      Direction  Cache Circuit
---- ---------- ---------- ---------- ----- -------
1    INCLUDE    ENABLED    INPUT      10    1:hotstuff

Example: list filter

Enter a filter number (1-1) [1]?
Filters:
Id   Default    State      Direction  Cache Circuit
---- ---------- ---------- ---------- ----- -------
1    INCLUDE    ENABLED    INPUT      10    1:hotstuff

Filter Lists:
Name                           Action     Count
------------------------------ ---------- ------------
smkipxlist                     EXCLUDE    0  

Syntax: move

Enter filter list name to move []? ipx03
Enter filter list name before which to move []? ipx01
Enter a filter number [1]? 3

Syntax: set-cache cache-size filter-number

Number of cache entries [10]?16
Enter a filter number [1]? 3

Syntax: update filter list-name

Enter a filter list name []? newyork
IPX SAP-List 'newyork' Config>

Syntax: exit

Update Commands

[C] means the command is available at the configuration prompt.

Table 9 Update Commands

Command	Function
Add [C]	Adds filter items to a filter list.
Delete [C]	Deletes filter items from a filter list.
List [C]	Lists a summary of all the filter lists and filters. Also generates a list of attached filter lists for this filter.
Move [C]	Changes the order of filter items within the filter list.
Set-Action [C]	Sets a filter item to include or exclude.
Exit [C]	Returns to the previous prompt.

Add [C]

The order in which you add filter items is important because the router applies the filter items in order. The router stops comparing the packet to a filter when it finds the first match. Entering the most common filter items first makes the filtering process more efficient because the software is more likely to find a match at the beginning of the list. Use the move command to change the order of filter items after you have added them.

The following are examples of how to add each type of filter.

Syntax: add

Hop count comparator [<=]?
Hop count [16]?
Service type (in hex) [4]?
Server Name []?

Example: IPX RIP-List 'riplist' Config>add

Network range start (in hex) [1]?
Network range end (in hex) [FFFFFFFE]?

Example: IPX Router-List 'routerlist' Config>add

Node number []? 0000000000f4
Node number mask [ffffffffffff]? 

Example: IPX IPX-List 'ipx' Config>add

Hop count comparator [<=]?
Hop count [16]?
Packet type (in hex) [0]?
Destination network range start (in hex) [1]?
Destination network range end (in hex) [FFFFFFFE]?
Destination node number []? 0000000000F4
Destination node number mask [ffffffffffff]?
Destination socket range start (in hex) [0]?
Destination socket range end (in hex) [FFFF]?
Source network range start (in hex) [1]?
Source network range end (in hex) [FFFFFFFE]?
Source node number []? 0000000000F1
Source node number mask [ffffffffffff]?
Source socket range start (in hex) [0]?
Source socket range end (in hex) [FFFF]?

Delete [C]

Syntax: delete item-number

Enter an item number [1]? 2

Syntax: list

Action: EXCLUDE
Id  Hops Type  Net Range     Address      Mask         Sock Range
--- ---- ----  ----------  ----------- ------------   -----------
1   <=16  0   1 - FFFFFFFE 0000000000F4 FFFFFFFFFFFF  0 - FFFF (Dest)
              1 - FFFFFFFE 0000000000F1 FFFFFFFFFFFF  0 - FFFF (Sourc)

Syntax: move

Item number to move [1]?2
Item number before which to insert item [1]?4

Syntax: set-action include or exclude

Exit [C]

Syntax: exit