Add policy-forwarding network-instance attachment point #1224
+181
−13
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
No major YANG version changes in commit d203259 |
rgwilton
reviewed
Nov 20, 2024
release/models/policy-forwarding/openconfig-pf-network-instances.yang
Outdated
Show resolved
Hide resolved
rgwilton
reviewed
Nov 20, 2024
release/models/policy-forwarding/openconfig-pf-network-instances.yang
Outdated
Show resolved
Hide resolved
LimeHat
reviewed
Nov 20, 2024
release/models/policy-forwarding/openconfig-pf-network-instances.yang
Outdated
Show resolved
Hide resolved
|
Last call for comments. This will merge on Jan 6th, 2025 |
LimeHat
reviewed
Dec 12, 2024
Comment on lines
+105
to
+113
| description | ||
| "The policy to be applied on the network-instance. Packets ingress | ||
| on the referenced interface should be compared to the match | ||
| criteria within the specified policy, and in the case that | ||
| these criteria are met, the forwarding actions specified | ||
| applied. These policies should be applied following quality of | ||
| service classification, and ACL actions if such entities are | ||
| referenced by the corresponding interface."; | ||
| } |
There was a problem hiding this comment.
This description still talks about the "referenced interface".
LimeHat
reviewed
Dec 12, 2024
|
|
||
| When attached to a network-instance, the policy-forwarding rules | ||
| should be evaluated against packets in the specified | ||
| network-instances."; |
There was a problem hiding this comment.
Similar comment to what I left in the previous PR #1150: what are the "packets in the specified network-instances"?
- does that mean that the policy applied to all interfaces associated with the network-instance on ingress (e.g. this change introduces only a new way of configuring the existing functionality), or
- are there any additional expectations w.r.t what packets should be matched (e.g packets redirected from another network-instance via a policy)?
There was a problem hiding this comment.
The operational use case motivating this PR is for packets ingress to the device which arrive on interfaces (including virtual interfaces) which are mapped to a network-instance.
I am not aware of an operational use case that we have for packets re-directed from another network-instance.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change Scope
Today policy-forwarding policies can only be attached to interfaces. This change adds network-instance as an attachment point for policy-forwarding rules. This causes packets in the specified network-instance to be evaluated against the specified policy-forwarding rules and actions.
This change is backwards compatible.
Tree diff view
We are at:
/network-instances/network-instance/policy-forwarding/| +--rw interfaces | | +--rw interface* [interface-id] | | +--rw interface-id -> ../config/interface-id | | +--rw config | | | +--rw interface-id? oc-if:interface-id | | | +--rw apply-forwarding-policy? -> ../../../../policies/policy/config/policy-id | | | +--rw apply-vrf-selection-policy? -> ../../../../policies/policy/config/policy-id | | +--ro state | | | +--ro interface-id? oc-if:interface-id | | | +--ro apply-forwarding-policy? -> ../../../../policies/policy/config/policy-id | | | +--ro apply-vrf-selection-policy? -> ../../../../policies/policy/config/policy-id | | +--rw interface-ref | | +--rw config | | | +--rw interface? -> /oc-if:interfaces/interface/name | | | +--rw subinterface? -> /oc-if:interfaces/interface[oc-if:name=current()/../interface]/subinterfaces/subinterface/index | | +--ro state | | +--ro interface? -> /oc-if:interfaces/interface/name | | +--ro subinterface? -> /oc-if:interfaces/interface[oc-if:name=current()/../interface]/subinterfaces/subinterface/index + | +--rw network-instances + | | +--rw network-instance* [name] + | | +--rw name -> ../config/name + | | +--rw config + | | | +--rw name? -> /network-instances/network-instance/config/name + | | | +--rw apply-forwarding-policy? -> ../../../../policies/policy/config/policy-id + | | | +--rw apply-vrf-selection-policy? -> ../../../../policies/policy/config/policy-id + | | +--ro state + | | +--ro name? -> /network-instances/network-instance/config/name + | | +--ro apply-forwarding-policy? -> ../../../../policies/policy/config/policy-id + | | +--ro apply-vrf-selection-policy? -> ../../../../policies/policy/config/policy-id | +--rw path-selection-groups | +--rw path-selection-group* [group-id] | +--rw group-id -> ../config/group-id | +--rw config | | +--rw group-id? string | | +--rw mpls-lsp* -> ../../../../../mpls/lsps/constrained-path/tunnels/tunnel/config/name | +--ro state | +--ro group-id? string | +--ro mpls-lsp* -> ../../../../../mpls/lsps/constrained-path/tunnels/tunnel/config/name ### Platform Implementations Cisco IOS XRvrf-policy
vrf default address-family ipv4 policy type pbr input GRE-DECAP-PBR
ip decap-group SRTE-GRE-DECAP
tunnel type gre
tunnel decap-ip 10.5.32.0