# Via op.py (especial_op)
/opt/homebrew/bin/python3.13 /Users/danielantonio/Developer/especial_op/op.py --device NOKIA-SP4-001 run "COMANDO"
/opt/homebrew/bin/python3.13 /Users/danielantonio/Developer/especial_op/op.py --device NOKIA-SP4-001 config "CMD1" "CMD2"
# Via sshpass direto
sshpass -p "pkq@HKN8abd-zat4fzq" ssh -o RequestTTY=force -o StrictHostKeyChecking=no dafranco@10.230.16.77
Atenção: sshpass com heredoc funciona localmente com RequestTTY=force.
Do DEADPOOL (SSH sem TTY), usa Python + paramiko.
| Filter | Nome | Scope | Descrição |
|---|---|---|---|
| 10 | deepfield-parent-v4 | Normal | Parent aplicado nas interfaces. Embeda filter 1000 offset 10 |
| 1000 | deepfield-mitigation-v4 | Embedded | Entries Deepfield (NETCONF, ~821 entries ativas) |
| 15 | UPSTREAM-IFACE-PARENT-v4 | Normal | Teste: embedou fSpec-0 na ORC001. Ainda aplicado! |
| 20 | SYNANCK_DYNAMIC | Template | Redirect SYN-ACK 209.14.7.57 → 198.51.100.250 |
| fSpec-0 | — | Embedded | FlowSpec BGP auto-criado. ~29 entries |
IMPORTANTE: Filter 15 (UPSTREAM-IFACE-PARENT-v4) ainda está aplicado na ORC001.
Antes de criar o MASTER-PARENT-v4, verificar e reverter se necessário:
show router interface "ORC001" detail
show filter ip 10 # filter 10 básico
show filter ip 10 detail # todas entries (truncado pelo pager)
show filter ip 10 embed # filtros embedados e status
show filter ip 10 association # interfaces com filter 10 aplicado
show filter ip fSpec-0 # FlowSpec filter
show filter ip fSpec-0 hunt # detalhe completo
show filter ip "SYNANCK_REDIRECT" # filtro SYNANCK
show filter ip "SYNANCK_REDIRECT" | match "Entry" # só números de entry
admin show configuration | match "NOME" post-lines 30 # config de filtro
edit-config exclusive
/configure filter ip-filter "MASTER-PARENT-v4" default-action accept
/configure filter ip-filter "MASTER-PARENT-v4" embed filter "SYNANCK_REDIRECT" offset 10 admin-state enable
/configure filter ip-filter "MASTER-PARENT-v4" embed filter "deepfield-mitigation-v4" offset 50010 admin-state enable
commit
quit-config
/configure filter ip-filter "NOME" embed flowspec offset N admin-state enable
NÃO usar embed filter "fSpec-0" — Nokia rejeita. Usar embed flowspec.
TCP flags múltiplos no FlowSpec: Nokia NÃO instala entry no fSpec-0 quando
a regra FlowSpec tem mais de uma flag TCP (AND ou OR). Aceita no BGP mas não
traduz para filtro. Funciona: flag única OU protocolo sem flags.
filter-cam-type: normal (padrão) vs packet-length. deepfield-parent-v4
usa packet-length. Para embedar fSpec-0 em filter packet-length, mudar
filter-cam-type packet-length no router flowspec.
Redirect-to-ip FlowSpec: não aparece no fSpec-0 — Nokia processa via FIB
(rota), não via filtro. Verificar show router route-table <prefix> detail.
embed filter vs embed flowspec: fSpec-0 só pode ser embedado via
embed flowspec, nunca via embed filter "fSpec-0".
Scope embedded: filtros com scope embedded podem ser embedados.
Filtros normal/template: precisam testar se Nokia aceita o embed.
edit-config exclusive
/configure router "Base" interface "ORC001" ingress filter ip "MASTER-PARENT-v4"
commit
quit-config
edit-config exclusive
/configure router "Base" interface "ORC001" ingress filter ip "deepfield-parent-v4"
commit
quit-config
edit-config exclusive
delete /configure filter ip-filter "NOME"
commit
quit-config
/configure filter ip-filter "NOME" entry 100 match protocol tcp
/configure filter ip-filter "NOME" entry 100 match dst-ip address 209.14.7.57
/configure filter ip-filter "NOME" entry 100 match dst-ip mask 255.255.255.255
/configure filter ip-filter "NOME" entry 100 match tcp-flags ack true
/configure filter ip-filter "NOME" entry 100 match tcp-flags syn true
/configure filter ip-filter "NOME" entry 100 action forward next-hop nh-ip address 198.51.100.250
Erros comuns já encontrados:
dst-ip 209.14.7.57/32 → ERRO. Correto: dst-ip address X + dst-ip mask Ytcp-syn true → ERRO. Correto: tcp-flags syn trueaction forward next-hop 198.51.100.250 → ERRO. Correto: action forward next-hop nh-ip address Xembed filter "fSpec-0" → ERRO. Correto: embed flowspec offset N