Index: /branches/rel_apv_10_7_2/usr/click/lib/libparser/commands.pm
===================================================================
--- /branches/rel_apv_10_7_2/usr/click/lib/libparser/commands.pm	(revision 39189)
+++ /branches/rel_apv_10_7_2/usr/click/lib/libparser/commands.pm	(working copy)
@@ -63312,6 +63312,35 @@
 			},],
 	},
 	{
+		obj_type => "MENU",
+		name => "filter",
+		parent_menu => "root_ha_ssf",
+		uniq_name => "root_ha_ssf_filter",
+		cmd_attribute => "CMD_ARRAYOS|CMD_NORMAL",
+		user_level => "CLI_LEVEL_CONFIG",
+		help_string => "Setting HA stateful session failover filter",
+	},
+	{
+		obj_type => "ITEM",
+		name => "on",
+		menu => "root_ha_ssf_filter",
+		cmd_attribute => "CMD_ARRAYOS|CMD_NORMAL|CMD_GLOBAL | CMD_KERN_API|CMD_NON_SERIAL",
+		user_level => "CLI_LEVEL_CONFIG",
+		help_string => "Enable session failover filter",
+		function_name => "session_failover_filter_on",
+		function_args => [],
+	},
+	{
+		obj_type => "ITEM",
+		name => "off",
+		menu => "root_ha_ssf_filter",
+		cmd_attribute => "CMD_ARRAYOS|CMD_NORMAL|CMD_GLOBAL | CMD_KERN_API | CMD_NON_SERIAL",
+		user_level => "CLI_LEVEL_CONFIG",
+		help_string => "Disable session failover filter",
+		function_name => "session_failover_filter_off",
+		function_args => [],
+	},
+	{
 		obj_type => "ITEM",
 		name => "peer",
 		menu => "root_ha_ssf",
Index: /branches/rel_apv_10_7_2/usr/src/sys/click/app/cm/sf_cli.c
===================================================================
--- /branches/rel_apv_10_7_2/usr/src/sys/click/app/cm/sf_cli.c	(revision 39189)
+++ /branches/rel_apv_10_7_2/usr/src/sys/click/app/cm/sf_cli.c	(working copy)
@@ -60,6 +60,8 @@
 #include <click/app/slb/slb_cli_util.h>
 #include "kernelWrapper.h"
 
+#define sysctlbyname    u_sysctlbyname
+
 int sf_global_on = 0;
 int sf_nat_on = 0;
 
@@ -320,6 +322,28 @@
 	return 0;
 }
 
+int session_failover_filter_on(void *pcb)
+{
+	int num = 0;
+	if (sysctlbyname("net.inet.clicktcp.sf_filter_off", NULL, NULL, &num, sizeof(num))) {
+		app_printf(pcb, "Error enabling sf filter");
+		return -1;
+	}
+
+	return 0;
+}
+
+int session_failover_filter_off(void *pcb)
+{
+	int num = 1;
+	if (sysctlbyname("net.inet.clicktcp.sf_filter_off", NULL, NULL, &num, sizeof(num))) {
+		app_printf(pcb, "Error disabling sf filter");
+		return -1;
+	}
+
+	return 0;
+}
+
 int clear_segment_ha_ssf(void *pcb, char *segment_name)
 {
 	slb_vs_t *temp_vs;
@@ -480,11 +504,13 @@
 	struct in_addr tmp_addr;
 	int i;
 	struct sbuf *sbuf = (struct sbuf*)buf;
+	size_t len;
+	int num;
+	len = 4;
 	
 	sbuf_printf(sbuf, "ha ssf %s\n", sf_global_on? "on" : "off");
 	sbuf_printf(sbuf, "ha ssf %s nat\n", sf_nat_on? "on" : "off");
 	sbuf_printf(sbuf, "ha ssf timeout %d\n", sf_session_timeout/hz);
-
 	for (i = 0; i < SLB_PROTOCOL_COUNT; i++) {
 		
 		if (i != SLB_PROTOCOL_HTTP && 
@@ -510,6 +536,14 @@
 		sbuf_printf(sbuf, "ha ssf peer %s\n", inet_ntoa(tmp_addr));
 	}
 
+	if (sysctlbyname("net.inet.clicktcp.sf_filter_off", &num, &len, NULL, 0)) {
+		return;
+	}
+	if (num < 0){
+		num = 0;
+	}
+	sbuf_printf(sbuf, "ha ssf filter %s\n", (num == 1) ? "off" : "on");
+
 	return;
 }
 
@@ -589,6 +623,9 @@
 	struct sf_peer *peer;
 	struct in_addr tmp_addr;
 	int i;
+	size_t len;
+	int num;
+	len = 4;
 	
 	if(!check_ha_license(pcb)){
 	   return -1;
@@ -623,6 +660,14 @@
 		tmp_addr.s_addr = peer->ip;
 		app_printf(pcb, "ha ssf peer %s\n", inet_ntoa(tmp_addr));
 	}
+	if (sysctlbyname("net.inet.clicktcp.sf_filter_off", &num, &len, NULL, 0)) {
+		app_printf(pcb, "error retrieving sf_filter information\n");
+		return -1;
+	}
+	if (num < 0){
+		num = 0;
+	}
+	app_printf(pcb, "ha ssf filter %s\n", (num == 1) ? "off" : "on");
 
 	return 0;
 }