Service Filters

Restrictions for Inline Services Interfaces

You can apply a service filter to IPv4 traffic associated with a service set at an inline services interface only.

ACX Series routers do not support post-service filters.

Statement Hierarchy for Applying Service Filters

You can enable packet filtering of IPv4 traffic before a packet is accepted for input service processing. To do this, apply a service filter to the inline services interface input in conjunction with an interface service set.

The following configuration shows the hierarchy levels at which you can apply the service filters to inline services interfaces:

[edit]
interfaces {
    interface-name {
        unit unit-number {
            family (inet | inet6) {
                service {
                    input {
                        service-set service-set-name service-filter service-filter-name;
                    }
                    output {
                        [ service-set service-set-name <service-filter filter-name> ];
                    }
                }
            }
        }
    }
}

Associating Service Rules with Inline Services Interfaces

To define and group the service rules be applied to an inline services interface, you define an interface service set by including the service-set service-set-name statement at the [edit services] hierarchy level.

To apply an interface service set to the input of an inline services interface, you include the service-set service-set-name at the following hierarchy levels:

• [edit interfaces interface-name unit unit-number input]

Filtering Traffic Before Accepting Packets for Service Processing

To filter IPv4 traffic before accepting packets for input service processing, include the service-set service-set-name service-filter service-filter-name at the following hierarchy level:

• [edit interfaces interface-name unit unit-number family inet service input]

For the service-set-name, specify a service set configured at the [edit services service-set] hierarchy level.

The service set retains the input interface information even after services are applied, so that functions such as filter-class forwarding that depend on input interface information continue to work.

The following requirements apply to filtering inbound or outbound traffic before accepting packets for service processing:

• You configure the same service set on the input and output sides of the interface.

• If you include the service-set statement without an optional service-filter definition, Junos OS assumes that the match condition is true and selects the service set for processing automatically.

• The service filter is applied only if a service set is configured and selected.