Guidelines for Configuring Firewall Filters

Statement Hierarchy for Configuring Firewall Filters

To configure a standard firewall filter, you can include the following statements. For an IPv4 standard firewall filter, the family inet statement is optional. For an IPv6 standard firewall filter, the family inet6 statement is mandatory.

firewall {
    family family-name {
        filter filter-name {
            accounting-profile name; 
            instance-shared;
            interface-specific; 
            physical-interface-filter; 
            term term-name {
                filter filter-name; 
            }
            term term-name {
                from {
                    match-conditions; 
                    ip-version ip-version { 
                        match-conditions;
                        protocol (tcp | udp) {
                            match conditions; 
                        }
                    }
                }
                then {
                    actions;
                }
            }
        }
    }
}

You can include the firewall configuration at one of the following hierarchy levels:

• [edit]

• [edit logical-systems logical-system-name]

set interfaces re0:mgmt-0 unit logical-unit-number family family-name filter input filter-name.

Firewall Filter Protocol Families

A firewall filter configuration is specific to a particular protocol family. Under the firewall statement, include one of the following statements to specify the protocol family for which you want to filter traffic:

• family any—To filter protocol-independent traffic.

• family inet—To filter Internet Protocol version 4 (IPv4) traffic.

• family inet6—To filter Internet Protocol version 6 (IPv6) traffic.

• family mpls—To filter MPLS traffic.

• family vpls—To filter virtual private LAN service (VPLS) traffic.

• family ccc—To filter Layer 2 circuit cross-connection (CCC) traffic.

• family bridge—To filter Layer 2 bridging traffic for MX Series 3D Universal Edge Routers only.

• family ethernet-switching—To filter Layer 2 (Ethernet) traffic.

The family family-name statement is required only to specify a protocol family other than IPv4. To configure an IPv4 firewall filter, you can configure the filter at the [edit firewall] hierarchy level without including the family inet statement, because the [edit firewall] and [edit firewall family inet] hierarchy levels are equivalent.

Firewall Filter Names and Options

Under the family family-name statement, you can include filter filter-name statements to create and name firewall filters. The filter name can contain letters, numbers, and hyphens (-) and be up to 64 characters long. To include spaces in the name, enclose the entire name in quotation marks (“ ”).

At the [edit firewall family family-name filter filter-name] hierarchy level, the following statements are optional:

• accounting-profile

• instance-shared (MX Series routers with Modular Port Concentrators (MPCS) only)

• interface-specific

• physical-interface-filter

Firewall Filter Terms

Under the filter filter-name statement, you can include term term-name statements to create and name filter terms.

• You must configure at least one term in a firewall filter.

• You must specify a unique name for each term within a firewall filter. The term name can contain letters, numbers, and hyphens (-) and can be up to 64 characters long. To include spaces in the name, enclose the entire name in quotation marks (“ ”).

• The order in which you specify terms within a firewall filter configuration is important. Firewall filter terms are evaluated in the order in which they are configured. By default, new terms are always added to the end of the existing filter. You can use the insert configuration mode command to reorder the terms of a firewall filter.

At the [edit firewall family family-name filter filter-name term term-name] hierarchy level, the filter filter-name statement is not valid in the same term as from or then statements. When included at this hierarchy level, the filter filter-name statement is used to nest firewall filters.

Firewall Filter Match Conditions

Firewall filter match conditions are specific to the type of traffic being filtered.

With the exception of MPLS-tagged IPv4 or IPv6 traffic, you specify the term’s match conditions under the from statement. For MPLS-tagged IPv4 traffic, you specify the term’s IPv4 address-specific match conditions under the ip-version ipv4 statement and the term’s IPv4 port-specific match conditions under the protocol (tcp | udp) statement.

For MPLS-tagged IPv6 traffic, you specify the term’s IPv6 address-specific match conditions under the ip-version ipv6 statement and the term’s IPv6 port-specific match conditions under the protocol (tcp | udp) statement.

Table 1 describes the types of traffic for which you can configure firewall filters.

If you specify an IPv6 address in a match condition (the address, destination-address, or source-address match conditions), use the syntax for text representations described in RFC 4291, IP Version 6 Addressing Architecture. For more information about IPv6 addresses, see IPv6 Overview and Supported IPv6 Standards.

Firewall Filter Actions

Under the then statement for a firewall filter term, you can specify the actions to be taken on a packet that matches the term.

Table 2 summarizes the types of actions you can specify in a firewall filter term.