spdGroupContFilter points to a filter that is evaluated to determine whether the spdGroupContComponentName within this row is exercised. Managers can use this object to classify groups of rules, or subgroups, together in order to achieve a greater degree of control and optimization over the execution order of the items within the group. If the

filter evaluates to false, the rule or subgroup will be skipped and the next rule or subgroup will be evaluated instead. This value can be used to indicate a scalar or row in a table. When indicating a row in a table, this value MUST point to the first column instance in that row.

An example usage of this object would be to limit a group of rules to executing only when the IP packet being processed is designated to be processed by IKE. This effectively creates a group of IKE-specific rules.

The following tables and scalars can be pointed to by this column. All but diffServMultiFieldClfrTable are defined in this MIB:

diffServMultiFieldClfrTable spdIpOffsetFilterTable spdTimeFilterTable spdCompoundFilterTable spdTrueFilter spdIpsoHeaderFilterTable

Implementations MAY choose to provide support for other filter tables or scalars.

If this column is set to a VariablePointer value, which references a non-existent row in an otherwise supported table, the inconsistentName exception MUST be returned. If the table or scalar pointed to by the VariablePointer is not supported at all, then an inconsistentValue exception MUST be returned.

If, during packet processing, a row in this table is applied to a packet and the value of this column in that row references a non-existent or non-supported object, the packet MUST be dropped.