firewall hash-mode

Function

The firewall hash-mode command configures the hash-based mode to select a CPU that processes service packets.

The undo firewall hash-mode command restores the default configuration.

Format

firewall hash-mode { source-and-destination | source-only }

undo firewall hash-mode

Parameters

Parameter	Description	Value
source-and-destination	Indicates the HASH-based mode that is oriented to the source and destination IP addresses.	-
source-only	Indicates the HASH-based mode that is oriented to the source IP address.	-

Views

System view

Default Level

2: Configuration level

Usage Guidelines

By default, the HASH-based mode is oriented to the source and destination IP addresses.

Only the USG6635E/6655E, USG6680E and USG6712E/6716E support this command.

You must set the hash-based mode to the source address mode to use the following functions:

After you disable the distributed bandwidth adjustment using the undo traffic-policy per-ip distributed adjust enable command and use the per-IP traffic limiting function, you must set the hash-based mode to the source address hash mode so that the traffic from the same IP address is assigned to the same CPU for processing, which ensures the bandwidth control accuracy.
3-tuple NAT
CAR-NAT
Port pre-allocation in NAT444
Port quantity limit in DS-Lite
Static Mapping

The configuration takes effect after you restart the device.

When the hash mode takes effect after the device restarts, the hash mode of the active and standby devices are different during the active/standby switchover. As a result, sessions cannot be correctly backed up, and services are interrupted for a short time.

When the hash mode change takes effect, NAT, IPSec, and forwarding services are interrupted for a short period of time. After the sessions of these services are re-established, the services are restored.

The configuration takes effect after you restart the device.

When the hash gene takes effect after the device restarts, the hash gene of the active and standby devices are different during the active/standby switchover. As a result, sessions cannot be correctly backed up, and services are interrupted for a short time.

When the hash genechange takes effect, NAT, IPSec, and forwarding services are interrupted for a short period of time. After the sessions of these services are re-established, the services are restored.

Example

# Configure the HASH-based mode that is oriented to the source IP address.

<sysname> system-view
[sysname] firewall hash-mode source-only