if-match icmp-type

Function

The if-match icmp-type command configures a filtering rule based on the type of an ICMP packet.

The undo if-match icmp-type command deletes the filtering rule based on the type of an ICMP packet.

By default, no filtering rule based on the type of an ICMP packet is configured.

Format

if-match icmp-type { greater-than | less-than | equal } icmp-type

if-match icmp-type greater-than icmp-type less-than upper-icmp-type-value

undo if-match icmp-type

undo if-match icmp-type greater-than icmp-type less-than upper-icmp-type-value

undo if-match icmp-type { greater-than | less-than | equal } icmp-type

Parameters

Parameter	Description	Value
greater-than	Indicates that the type of an ICMP packet is greater than the specified one.	-
less-than	Indicates that the type of an ICMP packet is smaller than the specified one.	-
equal	Indicates that the type of an ICMP packet is equal to the specified one.	-
icmp-type	Specifies the ICMP packet type.	The value is an integer ranging from 0 to 255.
upper-icmp-type-value	Specifies the upper limit of a range that identifies ICMP packet types.	The value is an integer ranging from 0 to 255.

Views

Flow-Route IPv6 VPN instance view, Flow-Route VPN instance view, Flow-Route-IPv6 view, Flow-Route view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
flow-route	write

Usage Guidelines

Usage Scenario

To improve network performance or security, you can run the if-match icmp-type and if-match icmp-code commands to configure a filtering rule related to an ICMP packet for a BGP (IPv6) Flow Specification route or BGP (IPv6) VPN Flow Specification route to control traffic. There are two situations:

On a secure network, routers can receive ICMP packets. However, when network traffic load is heavy, host unreachable or port unreachable events frequently occur, and routers receive a large number of ICMP packets, increasing network burdens and degrading router performance.
On an insecure network, network attackers often use ICMP error packets to spy on the internal structure of the network.

Prerequisites

A static BGP (IPv6) Flow Specification route or BGP (IPv6) VPN Flow Specification route has been created using the flow-route command in the system view.

Precautions

A maximum of five filtering rules based on ICMP packet types can be configured for a BGP Flow Specification route.

Example

# Configure a filtering rule that is based on a range identifying ICMP packet types for the static BGP Flow Specification route Rule1.

<HUAWEI> system-view
[~HUAWEI] flow-route Rule1 vpn-instance va
[*HUAWEI-flow-route-va] if-match icmp-type greater-than 13 less-than 20

# Configure a filtering rule that is based on the ICMP packet type of 13 for the static BGP IPv6 Flow Specification route Rule 1.

<HUAWEI> system-view
[~HUAWEI] flow-route Rule1 ipv6
[*HUAWEI-flow-route-ipv6] if-match icmp-type equal 13

# Configure a filtering rule that is based on the type of an ICMP packet of 13 for the static BGP Flow Specification route Rule 1.

<HUAWEI> system-view
[~HUAWEI] flow-route Rule1
[*HUAWEI-flow-route] if-match icmp-type equal 13