DMR Export Filters

A Dynamic Message Routing (DMR) export filter is a per-Message VPN configuration that restricts which local subscriptions are advertised to other clusters over a gateway node's external links. Export filters give you policy-based control over subscription export at the cluster boundary, which is useful for the following scenarios:

  • protecting wide area network (WAN) bandwidth from broad remote subscriptions

  • preventing subscriptions from one environment (such as a development cluster) from leaking back into another (such as production)

  • meeting data-residency and compliance requirements by blocking specific subscriptions from being exported from clusters in a given region.

Export filters apply only to external links (between gateway nodes in different clusters). They have no effect on subscription propagation over internal links within a cluster, which you control using subscription ACLs and #noexport.

A single export filter set applies to all of a Message VPN's external links. You cannot configure a separate export filter for an individual DMR bridge.

For more information, see:

Export Filter Entries

An export filter is made up of one or more filter entries. Each entry is a standard SMF topic, which can include the single-level wildcard (*) and the multi-level wildcard (>). An export filter entry is one of the following types:

  • Allow entry: A subscription pattern that is allowed to be exported.

  • Disallow entry: A subscription pattern that is not allowed to be exported, identified by a leading ! (for example, !orders/uk/>).

When you add the first allow entry to a Message VPN, the Message VPN switches from export-all mode to allow-list mode. In allow-list mode, internal traffic from other clusters, such as replies to requests and messages to temporary queues, are no longer exported unless you explicitly allow it.

The event broker uses the following covering subscriptions to attract traffic addressed to nodes in the local cluster. When you configure allow entries, you must add entries for the covering subscriptions that correspond to the traffic types you need from remote clusters:

Covering Subscription

Traffic from Remote Clusters

#P2P/v:*/>

Replies to request/reply reply-to inboxes

#P2P/QTMP/v:*/>

Messages to temporary queues

#P2P/TTMP/v:*/>

Messages to temporary topic endpoints

#SEMP/v:*/>

SEMP management requests over the message bus

#MCAST/>

Multicast delivery on #MCAST topics

In the covering subscriptions, v:* matches every node's router name, so one entry per pattern covers every node in the gateway's DMR cluster.

If no export filter entries are configured for a Message VPN, all of its subscriptions are exported. When you add an allow entry, only subscriptions that match that allow entry (and no disallow entry) are exported.

Evaluation Rules for Export Filters

#noexport subscriptions always take precedence over export filters and work independently of them. For more information, see Preventing Subscription Export.

To decide whether to export a subscription over an external link, the event broker evaluates that subscription against the Message VPN's export filter entries:

  • An allow entry matches a subscription only if the entry's topic is as broad as, or broader than, the subscription. For example, an allow entry of orders/> matches a subscription of orders/uk/confirmed, but an allow entry of orders/uk/> does not match a broader subscription of orders/>. To allow a broad subscription such as > to be exported, you must configure an equally broad allow entry.

  • A disallow entry matches (and blocks) a subscription if there is any overlap at all between the entry's topic and the subscription's topic, even if neither is broader than the other.

  • If a subscription matches both an allow entry and a disallow entry, the disallow entry takes precedence and the subscription is not exported.

The following table illustrates some examples of the interactions between filters and subscriptions.

Filter Entry

Subscription

Exported?

orders/>

orders/uk/confirmed

Yes. The allow entry is broader than the subscription.

orders/uk/>

orders/>

No. The subscription is broader than the allow entry.

!orders/uk/>

orders/>

No. The two topics overlap, so the disallow entry blocks export.

Export filters are written in SMF topic syntax, but also apply to MQTT clients' subscriptions. Each protocol's wildcards are matched using that protocol's own semantics.

Export filter changes take effect without a restart or reload.

Export Filter Limits and Restrictions

You can configure up to 1,000 export filter entries per event broker, shared across all Message VPNs on that event broker.

The event broker rejects an export filter entry when you try to create it in either of the following cases:

  • It begins with #noexport/, #share/, #RETAIN/, or #RETAIN_MSG/.

  • It is narrower than one of the event broker's internal covering subscriptions: #P2P/v:*/>, #P2P/QTMP/v:*/>, #P2P/TTMP/v:*/>, #SEMP/v:*/>, and #MCAST/>. For example, #P2P/v:R1/> and #MCAST/orders are rejected.

Entries like these cannot express a meaningful export policy. For more information, see Reserved Topics.

Shared subscriptions are evaluated by their topic filter alone, without the #share/<group>/ prefix. This is why entries beginning with #share/ are rejected.

An export filter entry cannot be modified after it is created. To change an entry, delete it and create a new one with the updated pattern.

Configuring an Export Filter

Export filter entries are configured per Message VPN, under the VPN's dynamic-message-routing configuration.

You need read-write access to the Message VPN to create or delete export filter entries. Unlike for DMR bridges, a global/mesh-manager user cannot configure export filters.

To create an export filter entry, enter the following commands:

solace(configure)# message-vpn <message-vpn-name>
solace(configure/message-vpn)# dynamic-message-routing
solace(...e/message-vpn/dynamic-message-routing)# export
solace(...message-vpn/dynamic-message-routing/export)# create filter <subscription-filter>

To remove an export filter entry, enter the following command:

solace(...message-vpn/dynamic-message-routing/export)# no filter <subscription-filter>

Where:

<subscription-filter> is the Solace Message Format (SMF) topic for the entry. Prefix it with ! to create a disallow entry (for example, !orders/uk/>); omit the prefix to create an allow entry (for example, orders/>).

Displaying Export Filter Information

To display the export filter entries configured for a Message VPN, enter the following command:

show message-vpn <vpn-name> dynamic-message-routing export-filter <subscription-filter-pattern>

Where:

<vpn-name> displays export filter entries for the specified Message VPN.

<subscription-filter-pattern> displays entries matching the pattern. The pattern can be the entry's full topic, or part of it with the wildcard character ? representing one character, or the wildcard character * representing zero or more characters. Enter only * to display all configured entries.

The existing show message-vpn <vpn-name> dynamic-message-routing command (see Displaying Message VPN Information) also reports the number of export filter entries configured for the VPN.

To confirm whether a specific subscription is currently being exported, use show smrp subscriptions and compare the gateway node's internal (v:) and external (g:) router-name entries for that topic. If the subscription is blocked by an export filter, it appears under the v:<node> entry of whichever node in the gateway's cluster it came from (possibly the gateway itself), but not under the gateway's g:<gateway> entry. There is no command that reports which specific filter entry caused a subscription to be blocked.

To list everything the gateway is currently exporting, enter show smrp subscriptions destination-name g:<gateway>.

Feature Interactions

Export filters are independent of, and compatible with, #noexport subscriptions and Message VPN bridges. You do not need to remove or change either when you start using export filters.

You can use export filters to run a Message VPN bridge in parallel with a DMR external link between the same clusters. Configure a disallow entry to stop a topic space from being exported over the external link, and then configure a parallel Message VPN bridge that subscribes to that same topic space. Messages in that space flow over the bridge only, giving high-value traffic a dedicated link while everything else uses DMR's interest-based routing.