Merge pull request #2434 from CumulusNetworks/stage

RM3851444 and RM 3820426

content/cumulus-linux-50/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-51/Layer-2/Virtual-Router-Redundancy-VRR-and-VRRP.md

@@ -89,7 +89,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-51/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-52/Layer-2/Virtual-Router-Redundancy-VRR-and-VRRP.md

@@ -89,7 +89,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-52/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-53/Layer-2/Virtual-Router-Redundancy-VRR-and-VRRP.md

@@ -89,7 +89,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-53/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-54/Layer-2/Virtual-Router-Redundancy-VRR-and-VRRP.md

@@ -89,7 +89,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-54/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-55/Layer-2/Virtual-Router-Redundancy-VRR-and-VRRP.md

@@ -89,7 +89,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-55/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-56/Layer-2/Virtual-Router-Redundancy-VRR.md

@@ -81,7 +81,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-56/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-57/Layer-2/Virtual-Router-Redundancy-VRR.md

@@ -81,7 +81,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-57/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-58/Layer-2/Virtual-Router-Redundancy-VRR.md

@@ -81,7 +81,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-58/System-Configuration/Netfilter-ACLs.md

@@ -84,7 +84,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.

content/cumulus-linux-59/Layer-2/Virtual-Router-Redundancy-VRR.md

@@ -81,7 +81,7 @@ Cumulus Linux sets a fabric-wide MAC address to ensure consistency across VRR sw
 
 To set the VRR MAC address globally with one NVUE command, either:
 - Set the fabric-wide VRR MAC address to a value in the reserved range between 00:00:5E:00:01:00 and 00:00:5E:00:01:FF. Be sure to use an address in this reserved range to prevent MAC address conflicts with other interfaces in the same bridged network. 
-- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 225. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 225, the VRR MAC address is 00:00:5E:00:01:FF.
+- Set a fabric ID, from which Cumulus Linux derives the MAC address. You can specify a number between 1 and 255. Cumulus Linux adds the number to the MAC address 00:00:5E:00:01:00 in hex. For example, if you specify 255, the VRR MAC address is 00:00:5E:00:01:FF.
 
 The default VRR MAC address is 00:00:5E:00:01:01, which the switch derives from a fabric ID setting of 1.
 

content/cumulus-linux-59/System-Configuration/Access-Control-Lists/Access-Control-List-Configuration.md

@@ -83,7 +83,7 @@ The Linux packet forwarding construct is an overlay for how the silicon undernea
     ```
 
 - When using rules that do a mangle and a filter lookup for a packet, Cumulus Linux processes them in parallel and combines the action.
-- If a switch port has a bond, you must assign any egress rules to the bond.
+- If there is no ingress interface or egress interface match, Cumulus Linux installs FORWARD chain rules in ingress by default.
 - When using the OUTPUT chain, you must assign rules to the source. For example, if you assign a rule to the switch port in the direction of traffic but the source is a bridge (VLAN), the rule does not affect the traffic and you must apply it to the bridge.
 - If you need to apply a rule to all transit traffic, use the FORWARD chain, not the OUTPUT chain.
 - The switch puts `ebtable` rules into either the IPv4 or IPv6 memory space depending on whether the rule uses IPv4 or IPv6 to make a decision. The switch only puts layer 2 rules that match the MAC address into the IPv4 memory space.