create access_profile ip udp dst_port_mask 0xFFFF profile_id 1
config access_profile profile_id 1 add access_id auto_assign ip udp dst_port 137 port 1 deny
config access_profile profile_id 1 add access_id auto_assign ip udp dst_port 138 port 1 deny
config access_profile profile_id 1 add access_id auto_assign ip udp dst_port 1900 port 1 deny
config access_profile profile_id 1 add access_id auto_assign ip udp dst_port 3702 port 1 deny
config access_profile profile_id 1 add access_id auto_assign ip udp dst_port 5355 port 1 deny
config access_profile profile_id 1 add access_id auto_assign ip udp dst_port 7533 port 9 deny
... тоже самое для других портов

create access_profile ethernet ethernet_type profile_id 2
config access_profile profile_id 2 add access_id 1 ethernet ethernet_type 0x86DD port 1 deny
...
...
// далее идут правила для доступа абонентов

create access_profile  ip  udp dst_port_mask 0xFFFF    profile_id 1
config access_profile profile_id 1  add access_id 1  ip  udp dst_port 137  port 1-26 deny
config access_profile profile_id 1  add access_id 2  ip  udp dst_port 138  port 1-26 deny
config access_profile profile_id 1  add access_id 3  ip  udp dst_port 3702  port 1-26 deny
config access_profile profile_id 1  add access_id 4  ip  udp dst_port 7533  port 1-26 deny
config access_profile profile_id 1  add access_id 5  ip  udp dst_port 1900  port 1-26 deny
config access_profile profile_id 1  add access_id 6  ip  udp dst_port 5355  port 1-26 deny

// служебные, всегда разрешены
create access_profile  packet_content_mask   offset1 l3 16 0xFFFF  offset2 l3 18 0xFFFF  profile_id 2
config access_profile profile_id 2  add access_id 1  packet_content   offset1 0x0a04 offset2 0x0001 port 1-26 permit
config access_profile profile_id 2  add access_id 2  packet_content   offset1 0x0a04 offset2 0x000b port 1-26 permit
config access_profile profile_id 2  add access_id 3  packet_content   offset1 0x0a08 offset2 0x0021 port 1-26 permit
config access_profile profile_id 2  add access_id 4  packet_content   offset1 0x0a08 offset2 0x0063 port 5 permit

// MAC source filter
create access_profile  packet_content_mask   source_mac FF-FF-FF-FF-FF-FF  offset1 l2 0 0xFFFF  profile_id 3
config access_profile profile_id 3  add access_id 1  packet_content   source_mac XX-XX-XX-XX-XX-XX  port 1-24 permit counter enable

// MAC dst filter
create access_profile  packet_content_mask   destination_mac FF-FF-FF-FF-FF-FF  offset1 l2 0 0xFFFF  profile_id 4
config access_profile profile_id 4  add access_id 1  packet_content   destination_mac YY-YY-YY-YY-YY-YY  port 1-26 permit
config access_profile profile_id 4  add access_id 2  packet_content   destination_mac FF-FF-FF-FF-FF-FF  port 1-26 permit

// IPv6 filter
create access_profile  ethernet  ethernet_type  profile_id 5
config access_profile profile_id 5  add access_id 1  ethernet  ethernet_type 0x86DD    port 1-24 deny

// далее идут правила для доступа абонентов
create access_profile  packet_content_mask   source_mac FF-FF-FF-FF-FF-FF  offset1 l3 12 0xFFFF  offset2 l3 14 0xFFFF  profile_id 6
config access_profile profile_id 6  add access_id 1  packet_content   source_mac XX-XX-XX-XX-XX-XX  offset1 0xZZZZ offset2 0xZZZZ port 5 permit
...

create access_profile  packet_content_mask   offset1 l3 12 0xFFFF  offset2 l3 14 0xFFFF  profile_id 7
config access_profile profile_id 7  add access_id 1  packet_content   offset1 0xZZZZ offset2 0xZZZZ port 5 permit

create access_profile  packet_content_mask   offset1 l2 0 0xFFFF  profile_id 15
config access_profile profile_id 15  add access_id 1  packet_content   offset1 0x0800 port 1-26 deny

12:52:17.322275 00:1e:90:81:ea:de > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 166: fe80::9cfe:6a47:6486:b0b6 > ff02::1: ICMP6, router advertisement, length 112
12:52:17.347807 00:11:5b:31:6d:94 > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 102: fe80::1f:9c81:cc83:2246 > ff02::1: ICMP6, router advertisement, length 48
12:52:21.321172 00:1e:90:81:ea:de > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 166: fe80::9cfe:6a47:6486:b0b6 > ff02::1: ICMP6, router advertisement, length 112
12:52:21.347744 00:11:5b:31:6d:94 > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 102: fe80::1f:9c81:cc83:2246 > ff02::1: ICMP6, router advertisement, length 48
12:52:25.320167 00:1e:90:81:ea:de > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 166: fe80::9cfe:6a47:6486:b0b6 > ff02::1: ICMP6, router advertisement, length 112
12:52:25.347579 00:11:5b:31:6d:94 > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 102: fe80::1f:9c81:cc83:2246 > ff02::1: ICMP6, router advertisement, length 48
13:01:29.627528 10:78:d2:1e:6d:4b > 33:33:ff:1e:c1:47, ethertype IPv6 (0x86dd), length 86: fe80::7575:6d56:7cdf:1b4 > ff02::1:ff1e:c147: ICMP6, neighbor solicitation, who has fe80::2489:a2b1:41e:c147, length 32

config multicast port_filtering_mode all filter_unregistered_groups

# ena cpu_interface_filtering
# create cpu access_profile profile_id 1 ethernet ethernet_type
# config cpu access_profile profile_id 1 add access_id 1 ethernet ethernet_type 0x86DD port 1-24 deny