Firewall Filter Match Conditions Based on Bit-Field Values

Match Conditions for Bit-Field Values

Table 1 lists the firewall filter match conditions that are based on whether certain bit fields in a packet are set or not set. The second and third columns list the types of traffic for which the match condition is supported.

Match Conditions for Common Bit-Field Values or Combinations

Table 2 describes firewall filter match conditions that are based on whether certain commonly used values or combinations of bit fields in a packet are set or not set.

You can use text synonyms to specify some common bit-field matches. In the previous example, you can specify tcp-initial as the same match condition.

Logical Operators for Bit-Field Values

Table 3 lists the logical operators you can apply to single bit-field values when specifying stateless firewall filter match conditions. The operators are listed in order, from highest precedence to lowest precedence. Operations are left-associative, meaning that the operations are processed from left to right.

Matching on a Single Bit-Field Value or Text Alias

For the fragment-flags and tcp-flags bit-match conditions, you can specify firewall filter match conditions based on whether a particular bit in the packet field is set or not set.

• Numeric value to specify a single bit—You can specify a single bit-field match condition by using a numeric value that has one bit set. Depending on the match condition, you can specify a decimal value, a binary value, or a hexadecimal value. To specify a binary value, specify the number with the prefix b. To specify a hexadecimal value, specify the number with the prefix 0x.

  In the following example, a match occurs if the RST bit in the TCP flags field is set:

  content_copy zoom_out_map

  [edit firewall family inet filter filter_tcp_rst_number term term1 from]
  user@host# set tcp-flags 0x04
  

• Text alias to specify a single bit—You generally specify a single bit-field match condition by using a text alias enclosed in double-quotation marks (“ ”).

  In the following example, a match occurs if the RST bit in the TCP flags field is set:

  content_copy zoom_out_map

  [edit firewall family inet filter filter_tcp_rst_alias term term1 from]
  user@host# set tcp-flags “rst”
  

Matching on Multiple Bit-Field Values or Text Aliases

You can specify a firewall filter match condition based on whether a particular set of bits in a packet field are set.

• Numeric values to specify multiple set bits—When you specify a numeric value whose binary representation has more than one set bit, the value is treated as a logical AND of the set bits.

  In the following example, the two match conditions are the same. A match occurs if either bit 0x01 or 0x02 is not set:

  content_copy zoom_out_map

  [edit firewall family inet filter reset_or_not_initial_packet term term5 from]
  user@host# set tcp-flags “!0x3”
  user@host# set tcp-flags “!(0x01 & 0x02)”
  

• Text aliases that specify common bit-field matches—You can use text aliases to specify some common bit-field matches. You specify these matches as a single keyword.

  In the following example, the tcp-established condition, which is an alias for “(ack | rst)”, specifies that a match occurs on TCP packets other than the first packet of a connection:

  content_copy zoom_out_map

  [edit firewall family inet filter reset_or_not_initial_packet term term6 from]
  user@host# set tcp-established
  

Matching on a Negated Bit-Field Value

To negate a match, precede the value with an exclamation point.

In the following example, a match occurs if the RST bit in the TCP flags field is not set:

[edit firewall family inet filter filter_tcp_rst term term1 from]
user@host# set tcp-flags “!rst”

Matching on the Logical OR of Two Bit-Field Values

You can use the (| or ,) to specify that a match occurs if a bit field matches either of two bit-field values specified.

In the following example, a match occurs if the packet is not the initial packet in a TCP session:

[edit firewall family inet filter not_initial_packet term term3 from]
user@host# set tcp-flags "!syn | ack"

In a TCP session, the SYN flag is set only in the initial packet sent, while the ACK flag is set in all packets sent after the initial packet. In a packet that is not the initial packet in a TCP session, either the SYN flag is not set or the ACK flag is set.

Matching on the Logical AND of Two Bit-Field Values

You can use the (& or +) to specify that a match occurs if a bit field matches both of two bit-field values specified.

In the following example, a match occurs if the packet is the initial packet in a TCP session:

[edit firewall family inet filter initial_packet term term2 from]
user@host# set tcp-flags “syn & !ack”

In a TCP session, the SYN flag is set only in the initial packet sent, while the ACK flag is set in all packets sent after the initial packet. In a packet that is an initial packet in a TCP session, the SYN flag is set and the ACK flag is not set.

Grouping Bit-Field Match Conditions

You can use the to specify that the complex match condition inside the parentheses is evaluated before any operators outside the parentheses are applied.

In the following example, a match occurs if the packet is a TCP reset or if the packet is not the initial packet in the TCP session:

[edit firewall family inet filter reset_or_not_initial_packet term term4 from]
user@host# set tcp-flags “!(syn & !ack) | rst”

In a TCP session, the SYN flag is set only in the initial packet sent, while the ACK flag is set in all packets sent after the initial packet. In a packet that is not the initial packet in a TCP session, the SYN flag is not set and the ACK field is set.