User Defined Keys

User defined keys (UDKs) allow defining custom byte keys—that is, groups of bytes that can be matched to a predefined point in the packet (an extraction point, e.g. the start of a MAC header, or an IP header)—which is useful when wanting to make a match with a part of the packet which does not have a dedicated key.

An extraction point may be defined for each packet type in a UDK. For each extraction point, an offset (from the beginning of the extraction) is defined.

To be able to modify a UDK after attaching it to an ACL rule, it is first necessary to un-match the UDK from the ACL, and then change the match mode of the UDK to none using the command “no udk match mode”.

To set UDK with ACL on a specific field:

1. Define new user defined key called ipv4_udk. Run:

   Copy

   Copied!

               
   
               
   switch (config) # udk ipv4_udk
   switch (config udk ipv4_udk) # exit
           

2. Set user defined key ipv4_udk to match on IPV4 header in offset 4 bytes from start of header. Run:

   Copy

   Copied!

               
   
               
   switch (config) # udk ipv4_udk extraction point mode l3 packet type ipv4 extraction point start-of-header offset 4
           

3. Set the len (in bytes) of the field to match on. Run:

   Copy

   Copied!

               
   
               
   switch (config) # udk ipv4_udk len 2
           

4. Set the user defined key to work with access list. Run:

   Copy

   Copied!

               
   
               
   switch (config) # udk ipv4_udk match mode acl
           

5. Define new access list table called my_acl_table. Run:

   Copy

   Copied!

               
   
               
   switch (config) # ipv4-udk access-list my_acl_table
           

6. Set new rule on the access list table with the previously defined user defined key to match 0x1234. Run:

   Copy

   Copied!

               
   
               
   switch (config) # ipv4-udk access-list my_acl_table permit ip any any udk ipv4_udk 0x1234
           

7. Bind the access list table to an ethernet interface. Run:

   Copy

   Copied!

               
   
               
   switch (config) # interface ethernet 1/1 ipv4-udk port access-group my_acl_table
           

udk

switch (config)# udk udk_name
switch (config udk udk_name)#

match mode

switch (config udk udk_name)# match mode all

extraction point

switch (config udk udk_name)# extraction point mode l3 packet type ipv4 extraction point start-of-header offset 2

len

switch (config udk udk_name)# len 4

show udk

switch (config)# show udk

UDK name: udk_name
Match mode: none
Length: 4
Extraction mode: l3
IPv4 extraction point: start-of-header
IPv4 offset: 22
IPv6 extraction point: start-of-header
IPv6 offset: 0
ARP extraction point: start-of-header
ARP offset: 0