Creating a Traffic Mirror Filter

Function

Traffic mirror filters filter specified traffic for mirroring. This API is used to create a traffic mirror filter. A mirror filter is a set of inbound rules and outbound rules to determine the traffic that is mirrored. You can specify priority, action, and other match conditions for each rule.

• Inbound rules match the traffic received by a mirror source.

• Outbound rules match the traffic sent by a mirror source.

A mirror filter takes effect only after it is associated with mirror sessions.

Calling Method

For details, see Calling APIs.

URI

POST /v3/{project_id}/vpc/traffic-mirror-filters

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition: ID of the project that a traffic mirror filter belongs to. Range: N/A

Request Parameters

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
traffic_mirror_filter	Yes	CreateTrafficMirrorFilterOption object	Traffic mirror filter.

**Table 3** CreateTrafficMirrorFilterOption
Parameter	Mandatory	Type	Description
description	No	String	Description of a traffic mirror filter. The value can contain no more than 255 characters and cannot contain angle brackets (< or >).
name	Yes	String	Traffic mirror filter name. The value can contain 1 to 64 characters, including letters, digits, underscores (_), hyphens (-), and periods (.).

Response Parameters

Status code: 201

**Table 4** Response body parameters
Parameter	Type	Description
traffic_mirror_filter	TrafficMirrorFilter object	Definition: Response body for querying details about a traffic mirror filter. Range: N/A
request_id	String	Definition: Request ID. Range: N/A

**Table 5** TrafficMirrorFilter
Parameter	Type	Description
id	String	Definition: ID of a traffic mirror filter. After a traffic mirror filter is created, a traffic mirror filter ID is generated, which uniquely identifies the traffic mirror filter. Range: N/A
project_id	String	Definition: ID of the project that a traffic mirror filter belongs to. Range: N/A
description	String	Definition: Description of a traffic mirror filter. Range: The value can contain 0 to 255 characters and cannot contain angle brackets (< or >).
name	String	Definition: Name of a traffic mirror filter. Range: The value can contain 1 to 64 characters, including letters, digits, underscores (_), hyphens (-), and periods.
ingress_rules	Array of TrafficMirrorFilterRule objects	Definition: Inbound mirror filter rules in a traffic mirror filter. Range: N/A
egress_rules	Array of TrafficMirrorFilterRule objects	Definition: Outbound mirror filter rules in a traffic mirror filter. Range: N/A
created_at	String	Definition: Time when a traffic mirror filter was created. Range: The value is a UTC time in the format of yyyy-MM-ddTHH:mm:ssZ.
updated_at	String	Definition: Time when a traffic mirror filter was updated. Range: The value is a UTC time in the format of yyyy-MM-ddTHH:mm:ssZ.

**Table 6** TrafficMirrorFilterRule
Parameter	Type	Description
id	String	Definition: ID of a traffic mirror filter rule. Range: N/A
project_id	String	Definition: ID of the project that a traffic mirror filter rule belongs to. Range: N/A
description	String	Definition: Description of a traffic mirror filter rule. Range: The value can contain 0 to 255 characters and cannot contain angle brackets (< or >).
traffic_mirror_filter_id	String	Definition: ID of the traffic mirror filter that a traffic mirror filter rule belongs to. Range: N/A
direction	String	Definition: Traffic direction of a traffic mirror filter rule. Range: ingress: inbound traffic egress: outbound traffic
source_cidr_block	String	Definition: Source of a traffic mirror filter rule. Range: Single IP address: IP address/subnet mask. For example, 192.168.10.10/32 for a single IPv4 address or 2002:50::44/128 for a single IPv6 address. CIDR block: IP address/subnet mask. For example, 192.168.52.0/24 for an IPv4 CIDR block or 2407:c080:802:469::/64 for an IPv6 CIDR block. All IP addresses: 0.0.0.0/0 indicates all IPv4 addresses, and ::/0 indicates all IPv6 addresses.
destination_cidr_block	String	Definition: Destination of a traffic mirror filter rule. Range: Single IP address: IP address/subnet mask. For example, 192.168.10.10/32 for a single IPv4 address or 2002:50::44/128 for a single IPv6 address. CIDR block: IP address/subnet mask. For example, 192.168.52.0/24 for an IPv4 CIDR block or 2407:c080:802:469::/64 for an IPv6 CIDR block. All IP addresses: 0.0.0.0/0 indicates all IPv4 addresses, and ::/0 indicates all IPv6 addresses.
source_port_range	String	Definition: Source port range of a traffic mirror filter rule. Range: Port range: 1 to 65535 Use a hyphen (-) to connect the start port and the end port, for example, 22-23. The end port cannot be smaller than the start port.
destination_port_range	String	Definition: Destination port range of a traffic mirror filter rule. Range: Port range: 1 to 65535 Use a hyphen (-) to connect the start port and the end port, for example, 22-23. The end port cannot be smaller than the start port.
ethertype	String	Definition: IP address version. Range: IPv4 or IPv6
protocol	String	Definition: Network protocol type. Range: TCP: If you select TCP, you can customize the source and destination port ranges. UDP: If you select UDP, you can customize the source and destination port ranges. ICMP: If you set IP address version to IPv4 and select ICMP, all ports are specified for source and destination port ranges by default. ICMPV6: If you set IP address version to IPv6 and select ICMPv6, all ports are specified for source and destination port ranges by default. ALL: If you select ALL, all network protocols are supported and all ports are specified for source and destination port ranges by default.
action	String	Definition: Action of a traffic mirror filter rule. Range: accept reject
priority	Integer	Definition: Priority of a traffic mirror filter rule. Range: The value is from 1 to 65535. A smaller value indicates a higher priority.
created_at	String	Definition: Time when a traffic mirror filter rule was created. Range: The value is a UTC time in the format of yyyy-MM-ddTHH:mm:ssZ.
updated_at	String	Definition: Time when a traffic mirror filter rule was updated. Range: The value is a UTC time in the format of yyyy-MM-ddTHH:mm:ssZ.

Example Requests

Create a traffic mirror filter named test1 with description set to description.

POST https://{endpoint}/v3/{project_id}/vpc/traffic-mirror-filters

{
  "traffic_mirror_filter" : {
    "name" : "test1",
    "description" : "description"
  }
}

Example Responses

Status code: 201

Created

{
  "traffic_mirror_filter" : {
    "id" : "59d2b2e7-0d35-41f7-a12e-f7699366cd21",
    "project_id" : "49a42f378df747bf8b8f6a70e25b63fb",
    "name" : "test1",
    "description" : "description",
    "ingress_rules" : [ ],
    "egress_rules" : [ ],
    "created_at" : "2022-08-29T06:22:01.000+00:00",
    "updated_at" : "2022-08-29T06:22:01.000+00:00"
  },
  "request_id" : "f05abcd9-fa75-43a5-a795-b3d8e8b7a9e9"
}