Firewall
The IPv4 firewall is a stateful ACL classified with rte_acl. The IPv6 firewall is a completely separate stateless engine with its own rule table, counters, enable gate and uRPF flag — a v4 rule never sees a v6 packet.
Rules and apply timing
firewall enable and urpf are live on commit; mss-clamp and filter-rule changes take effect on restart. Disabling the firewall means a default policy of ACCEPT.
system-view firewall enable firewall urpf strict firewall filter add accept state established firewall filter add drop proto tcp dport 23 state new commit save
Named address lists
A named list is a set of addresses that rules match with src-list or dst-list, so one rule can cover thousands of addresses and membership changes without touching the rule. RADIUS can tag a subscriber’s framed IP into a named list for the life of the session via VSA. These edits are live and immediate and need no commit — deliberately, because it is the same code path RADIUS uses mid-session.
firewall address-list add quarantine 100.64.7.12 firewall filter add drop src-list quarantine commit show firewall address-list quarantine
IPv6 uRPF defaults off
Leave v6 uRPF disabled until subscriber v6 reverse-routes are installed in the RIB; a strict v6 check otherwise drops a legitimate static v6 host on a subscriber’s circuit. That is precisely why v6 anti-spoof is a separate toggle from v4.