Add initial prefix filter

release/models/aft/openconfig-aft-common.yang

@@ -23,7 +23,13 @@ submodule openconfig-aft-common {
     "Submodule containing definitions of groupings that are re-used
     across multiple contexts within the AFT model.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
@@ -194,6 +200,7 @@ submodule openconfig-aft-common {
       "Structural grouping describing a next-hop entry.";
 
     container next-hops {
+      config false;
       description
         "The list of next-hops that are to be used for entry within
         the AFT table. The structure of each next-hop is address
@@ -868,6 +875,7 @@ submodule openconfig-aft-common {
       "Logical grouping for groups of next-hops.";
 
     container next-hop-groups {
+      config false;
       description
         "Surrounding container for groups of next-hops.";
 

release/models/aft/openconfig-aft-ethernet.yang

@@ -20,7 +20,13 @@ submodule openconfig-aft-ethernet {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for Ethernet.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description

release/models/aft/openconfig-aft-global-filter.yang

@@ -0,0 +1,89 @@
+submodule openconfig-aft-global-filter {
+  belongs-to "openconfig-aft" {
+    prefix "oc-aft";
+  }
+
+  import openconfig-extensions { prefix "oc-ext"; }
+  import openconfig-routing-policy { prefix "oc-rpol"; }
+
+  organization
+    "OpenConfig working group";
+
+  contact
+    "OpenConfig working group
+    www.openconfig.net";
+
+  description
+    "Submodule containing definitions of groupings for the global
+    filter configuration applicable to abstract forwarding tables.";
+
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance and per
+      AFT filtering, with routing policy split by address family.";
+    reference "3.3.0";
+  }
+
+  grouping aft-global-filter-config {
+    description
+      "Configuration parameters for the AFT global filter.";
+
+    leaf ipv4-policy {
+      type leafref {
+        path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
+             "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
+      }
+      description
+        "Reference to a routing policy that is used to filter the
+        IPv4 prefixes that are installed into the AFT. Only prefixes
+        that are accepted by the referenced policy are installed.
+        The policy may, for example, use an explicit prefix set to
+        match prefixes, or match prefixes that are more specific than
+        a given prefix.";
+    }
+
+    leaf ipv6-policy {
+      type leafref {
+        path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
+             "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
+      }
+      description
+        "Reference to a routing policy that is used to filter the
+        IPv6 prefixes that are installed into the AFT. Only prefixes
+        that are accepted by the referenced policy are installed.
+        The policy may, for example, use an explicit prefix set to
+        match prefixes, or match prefixes that are more specific than
+        a given prefix.";
+    }
+  }
+
+  grouping aft-global-filter-structural {
+    description
+      "Structural grouping defining the schema for the global filter
+      applied to the abstract forwarding tables.";
+
+    container global-filter {
+      description
+        "Configuration and state for a global filter applied to the
+        AFT. The filter is used to restrict which prefixes are
+        installed into the AFT for the network instance.";
+
+      container config {
+        description
+          "Configuration parameters for the AFT global filter.";
+
+        uses aft-global-filter-config;
+      }
+
+      container state {
+        config false;
+        description
+          "Operational state parameters for the AFT global filter.";
+
+        uses aft-global-filter-config;
+      }
+    }
+  }
+}

release/models/aft/openconfig-aft-ipv4.yang

@@ -20,7 +20,13 @@ submodule openconfig-aft-ipv4 {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for IPv4.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description

release/models/aft/openconfig-aft-ipv6.yang

@@ -20,7 +20,13 @@ submodule openconfig-aft-ipv6 {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for IPv6.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description

release/models/aft/openconfig-aft-mpls.yang

@@ -21,7 +21,13 @@ submodule openconfig-aft-mpls {
     "Submodule containing definitions of groupings for the abstract
     forwarding table for MPLS label forwarding.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description

release/models/aft/openconfig-aft-pf.yang

@@ -28,7 +28,13 @@ submodule openconfig-aft-pf {
     fields other than the destination address that is used in
     other forwarding tables.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description

release/models/aft/openconfig-aft-state-synced.yang

@@ -16,7 +16,13 @@ submodule openconfig-aft-state-synced {
     "Submodule containing definitions of groupings for the state
     synced signals corresponding to various abstract forwarding tables.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description

release/models/aft/openconfig-aft-summary.yang

@@ -20,7 +20,13 @@ module openconfig-aft-summary {
     "This module provides summary of aft entry counts per protocol type for each network
     instance.";
 
-  oc-ext:openconfig-version "0.2.0";
+  oc-ext:openconfig-version "0.2.1";
+
+  revision "2026-03-11" {
+    description
+      "Add config false to protocols and state containers.";
+    reference "0.2.1";
+  }
 
   revision "2024-01-12" {
     description
@@ -49,7 +55,7 @@ module openconfig-aft-summary {
 
     container counters {
       description
-      "Enclosing container for aft entry counters";
+        "Enclosing container for aft entry counters";
 
       leaf aft-entries {
         description
@@ -64,6 +70,7 @@ module openconfig-aft-summary {
       "A summary of aft entries by protocol type.";
 
     container protocols {
+      config false;
       description
         "Enclosing container for a list of protocols";
       list protocol {
@@ -81,6 +88,7 @@ module openconfig-aft-summary {
         }
 
         container state {
+          config false;
           description
             "State parameters for the aft entry list.";
           uses protocols-state;

release/models/aft/openconfig-aft.yang

@@ -22,6 +22,8 @@ module openconfig-aft {
   include openconfig-aft-common;
   // Include the state synced submodule.
   include openconfig-aft-state-synced;
+  // Include the global filter submodule.
+  include openconfig-aft-global-filter;
 
   organization
     "OpenConfig working group";
@@ -42,7 +44,13 @@ module openconfig-aft {
     is referred to as an Abstract Forwarding Table (AFT), rather than
     the FIB.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
@@ -222,7 +230,6 @@ module openconfig-aft {
       AFT.";
 
     container afts {
-      config false;
       description
         "The abstract forwarding tables (AFTs) that are associated
         with the network instance. An AFT is instantiated per-protocol
@@ -234,6 +241,7 @@ module openconfig-aft {
         forwarding entry.";
 
       container ipv4-unicast {
+        config false;
         description
           "The abstract forwarding table for IPv4 unicast. Entries
           within this table are uniquely keyed on the IPv4 unicast
@@ -248,6 +256,7 @@ module openconfig-aft {
       }
 
       container ipv6-unicast {
+        config false;
         description
           "The abstract forwarding table for IPv6 unicast. Entries
           within this table are uniquely keyed on the IPv6 unicast
@@ -262,6 +271,7 @@ module openconfig-aft {
       }
 
       container policy-forwarding {
+        config false;
         description
           "The abstract forwarding table for policy-based forwarding
           entries. Since multiple match criteria can be utilised
@@ -279,6 +289,7 @@ module openconfig-aft {
       }
 
       container mpls {
+        config false;
         description
           "The abstract forwarding table for MPLS label based
           forwarding entries. Entries within the table are keyed based
@@ -289,6 +300,7 @@ module openconfig-aft {
       }
 
       container ethernet {
+        config false;
         description
           "The abstract forwarding table for Ethernet based forwarding
           entries. Entries within the table are keyed based on the
@@ -298,6 +310,7 @@ module openconfig-aft {
       }
 
       container state-synced {
+        config false;
         description
           "In some cases AFT streaming (e.g., over gNMI) is an eventually consistent system.
           When the device updates an entry it is usually expected to
@@ -320,6 +333,7 @@ module openconfig-aft {
 
       uses aft-next-hop-groups-structural;
       uses aft-nhop-structural;
+      uses aft-global-filter-structural;
     }
   }
 }