tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: ipfilter: keep state per-interface?


I assume that is because I keep state on the packets when they
arrive on vr1.

You are right - state table has precedence over filter rules.

Is this a bug, or is it working as designed?  For some reason, I
assumed there to be per-interface state tables and hence
consideration of the vr0 rules (i.e. I assumed a 'keep state' on a
vr1 rule would only> skip looking at the vr1 rules for future
matching packets)

It's by design. There's only one state table.


Home | Main Index | Thread Index | Old Index