Navigation
Supported Platforms
Firewall Configuration Statement Hierarchy
Use the statements in the firewall configuration hierarchy to configure stateless firewall filters—also known as access control lists (ACLs)—on the device.
firewall {family {any {filter filter-name {term term-name {from {forwarding-class [forwarding-class-name]; forwarding-class-except [forwarding-class-name];interface interface-name;interface-set interface-set-name; packet-length [range]; packet-length-except [range];}then { accept;count value;discard; forwarding-class forwarding-class-name; loss-priority (high |low |medium-high |medium-low);next term;policer policer-name;}}}}bridge {filter filter-name { accounting-profile [accounting-profile-name];interface-specific;term term-name {filter filter-name;from {forwarding-class [forwarding-class-name]; forwarding-class-except [forwarding-class-name];interface interface-name;interface-set interface-set-name; packet-length [range]; packet-length-except [range];}then { accept;count value;discard; forwarding-class forwarding-class-name; loss-priority (high |low |medium-high |medium-low);next term;policer policer-name;}}}}ccc {filter filter-name { accounting-profile [accounting-profile-name];interface-specific;term term-name {filter filter-name;from {(forwarding-class [ class-names ] | forwarding-class-except [ class-names ]);(interface-group [ group-names ] | interface-group-except [ group-names ]);}then { accept;count value;discard; forwarding-class forwarding-class-name; loss-priority (high |low |medium-high |medium-low);next term;packet mode;policer policer-name;}}}}inet {dialer-filter filter-name {accounting-profile [accounting-profile-name];term term-name {from {address {ip-prefix</prefix-length> <except>;}destination-address {ip-prefix</prefix-length> <except>;}(destination-port [ port-names ] | destination-port-except [ port-names ]);destination-prefix-list {list-name <except>;}(dscp [ code-point-values ] | dscp-except [ code-point-values ]);(esp-spi [ values ] | esp-spi-except [ values ]);first-fragment;fragment-flags flag;(fragment-offset [ offsets ] | fragment-offset-except [ offsets ]);(icmp-code [ codes ] | icmp-code-except [ codes ]);(icmp-type [ types ] | icmp-type-except [ types ]);(ip-options [ option-names ] | ip-options-except [ option-names ]);is-fragment;(packet-length [ values ] | packet-length-except [ values ]);(port [ port-names ] | port-except [ port-names ]);(precedence [ precedence-names ] | precedence-except [ precedence-names ]);prefix-list {list-name <except>;}(protocol [ protocol-names ] | protocol-except [ protocol-names ]);source-address {ip-prefix</prefix-length> <except>;}(source-port [ port-names ] | source-port-except [ port-names ]);source-prefix-list {list-name <except>;}tcp-established;tcp-flags flag;tcp-initial;(ttl [ ttl-values ] | ttl-except [ ttl-values ]);}then {(ignore | note);log;sample;syslog;}}}filter filter-name { accounting-profile [accounting-profile-name];interface-specific;term term-name {from {address {ip-prefix</prefix-length> <except>;}destination-address {ip-prefix</prefix-length> <except>;}(destination-port [ port-names ] | destination-port-except [ port-names ]);destination-prefix-list {list-name <except>;}(dscp [ code-point-values ] | dscp-except [ code-point-values ]);(esp-spi [ values ] | esp-spi-except [ values ]);first-fragment;(forwarding-class [ class-names ] | forwarding-class-except [ class-names ]);fragment-flags flag;(fragment-offset [ offsets ] | fragment-offset-except [ offsets ]);(icmp-code [ codes ] | icmp-code-except [ codes ]);(icmp-type [ types ] | icmp-type-except [ types ]);(interface-group [ group-names ] | interface-group-except [ group-names ]);interface-set set-name;(ip-options [ option-names ] | ip-options-except [ option-names ]);is-fragment;(packet-length [ values ] | packet-length-except [ values ]);(port [ port-names ] | port-except [ port-names ]);(precedence [ precedence-names ] | precedence-except [ precedence-names ]);prefix-list {list-name <except>;}(protocol [ protocol-names ] | protocol-except [ protocol-names ]);service-filter-hit;source-address {ip-prefix</prefix-length> <except>;}(source-port [ port-names ] | source-port-except [ port-names ]);source-prefix-list {list-name <except>;}tcp-established;tcp-flags flag;tcp-initial;}then {(accept | discard | reject);count counter-name;forwarding-class class-name;log;loss-priority (high | low);next;packet-mode;policer policer-name;port-mirror;routing-instance routing-instance-name> <topology topology-name>;sample;service-accounting;service-filter-hit;syslog;topology topology-name;virtual-channel;}}} prefix-action prefix-action-name {count;destination-prefix-length length;filter-specific;policer policer-name;source-prefix-length length;subnet-prefix-length length;}service-filter filter-name {term term-name {from {address {ip-prefix</prefix-length> <except>;}destination-address {ip-prefix</prefix-length> <except>;}(destination-port [ port-names ] | destination-port-except [ port-names ]);destination-prefix-list {list-name <except>;}(esp-spi [ values ] | esp-spi-except [ values ]);first-fragment;fragment-flags flag;(fragment-offset [ offsets ] | fragment-offset-except [ offsets ]);(interface-group [ group-names ] | interface-group-except [ group-names ]);(ip-options [ option-names ] | ip-options-except [ option-names ]);is-fragment;(packet-length [ values ] | packet-length-except [ values ]);(port [ port-names ] | port-except [ port-names ]);prefix-list {list-name <except>;}(protocol [ protocol-names ] | protocol-except [ protocol-names ]);source-address {ip-prefix</prefix-length> <except>;}(source-port [ port-names ] | source-port-except [ port-names ]);source-prefix-list {list-name <except>;}tcp-flags flag;}then {count counter-name;log;port-mirror;sample;(service | skip);}}} simple-filter filter-name {term term-name {from {destination-address ip-prefix</prefix-length>;destination-port port-name;protocol protocol-name;source-address ip-prefix</prefix-length>;source-port port-name;}then {(accept | discard);forwarding-class class-name;policer policer-name;three-color-policer policer-name {(single-rate single-rate-policer-name | two-rate two-rate-policer-name);}}}}}inet6 {dialer-filter filter-name {accounting-profile [accounting-profile-name];term term-name {from {address {ip-prefix</prefix-length> <except>;}destination-address {ip-prefix</prefix-length> <except>;}(destination-port [ port-names ] | destination-port-except [ port-names ]);destination-prefix-list {list-name <except>;}(icmp-code [ codes ] | icmp-code-except [ codes ]);(icmp-type [ types ] | icmp-type-except [ types ]);(next-header [ protocol-types ] | next-header-except [ protocol-types ]);(packet-length [ values ] | packet-length-except [ values ]);(port [ port-names ] | port-except [ port-names ]);(precedence [ precedence-names ] | precedence-except [ precedence-names ]);prefix-list {list-name <except>;}source-address {ip-prefix</prefix-length> <except>;}(source-port [ port-names ] | source-port-except [ port-names ]);source-prefix-list {list-name <except>;}}then {(ignore | note);log;sample;syslog;}}}filter filter-name { accounting-profile [accounting-profile-name];interface-specific;term term-name {filter filter-name;from {address {ip-prefix</prefix-length> <except>;}destination-address {ip-prefix</prefix-length> <except>;}(destination-port [ port-names ] | destination-port-except [ port-names ]);destination-prefix-list {list-name <except>;}(forwarding-class [ class-names ] | forwarding-class-except [ class-names ]);(icmp-code [ codes ] | icmp-code-except [ codes ]);(icmp-type [ types ] | icmp-type-except [ types ]);interface interface-name;(interface-group [ group-names ] | interface-group-except [ group-names ]);interface-set set-name;(next-header [ protocol-types ] | next-header-except [ protocol-types ]);(packet-length [ values ] | packet-length-except [ values ]);(port [ port-names ] | port-except [ port-names ]);prefix-list {list-name <except>;}service-filter-hit;source-address {ip-prefix</prefix-length> <except>;}(source-port [ port-names ] | source-port-except [ port-names ]);source-prefix-list {list-name <except>;}tcp-established;tcp-flags flag;tcp-initial;(traffic-class [ code-point-values ] | traffic-class-except [ code-point-values ]);}then {then {(accept | discard | reject);count counter-name;forwarding-class class-name;log;loss-priority (high | low);next;packet-mode;policer policer-name;routing-instance routing-instance-name> <topology topology-name>;sample;service-accounting;service-filter-hit;syslog;topology topology-name;}}}}service-filter filter-name {term term-name {from {address {ip-prefix</prefix-length> <except>;}destination-address {ip-prefix</prefix-length> <except>;}(destination-port [ port-names ] | destination-port-except [ port-names ]);destination-prefix-list {list-name <except>;}(esp-spi [ values ] | esp-spi-except [ values ]);(interface-group [ group-names ] | interface-group-except [ group-names ]);(next-header [ protocol-types ] | next-header-except [ protocol-types ]);(port [ port-names ] | port-except [ port-names ]);prefix-list {list-name <except>;}source-address {ip-prefix</prefix-length> <except>;}(source-port [ port-names ] | source-port-except [ port-names ]);source-prefix-list {list-name <except>;}tcp-flags flag;}then {count counter-name;log;port-mirror;sample;(service | skip);}}}}mpls {dialer-filter filter-name { accounting-profile [accounting-profile-name];term term-name {from {(exp [ exp-bits ] | exp-except [ exp-bits ]);}then {(ignore | note);log;sample;syslog;}}}filter filter-name { accounting-profile [accounting-profile-name];interface-specific;term term-name {filter filter-name;from {(exp [ exp-bits ] | exp-except [ exp-bits ]);(forwarding-class [ class-names ] | forwarding-class-except [ class-names ]);interface interface-name;interface-set set-name;}then {(accept | discard);count value; forwarding-class forwarding-class-name; loss-priority (high |low |medium-high |medium-low);next term;policer policer-name;sample;three-color-policer policer-name {(single-rate single-rate-policer-name | two-rate two-rate-policer-name);}}}}}vpls {filter filter-name { accounting-profile [accounting-profile-name];interface-specific;term term-name {filter filter-name;from {destination-mac-address {mac-address;}(ether-type [ protocol-types ] | ether-type-except [ protocol-types ]);(forwarding-class [ class-names ] | forwarding-class-except [ class-names ]);interface interface-name;(interface-group [ group-names ] | interface-group-except [ group-names ]);interface-set interface-set-name;source-mac-address {mac-address <except>;}(vlan-ether-type [ protocol-types ] | vlan-ether-type-except [ protocol-types ]);}then {(accept | discard);count value; forwarding-class forwarding-class-name; loss-priority (high |low |medium-high |medium-low);next term;policer policer-name;}}}}}filter filter-name { accounting-profile [accounting-profile-name];interface-specific;term term-name {filter filter-name;from {address {ip-prefix</prefix-length> <except>;}destination-address {ip-prefix</prefix-length> <except>;}(destination-port [ port-names ] | destination-port-except [ port-names ]);destination-prefix-list {list-name <except>;}(dscp [ code-point-values ] | dscp-except [ code-point-values ]);(esp-spi [ values ] | esp-spi-except [ values ]);first-fragment;(forwarding-class [ class-names ] | forwarding-class-except [ class-names ]);fragment-flags flag;(fragment-offset [ offsets ] | fragment-offset-except [ offsets ]);(icmp-code [ codes ] | icmp-code-except [ codes ]);(icmp-type [ types ] | icmp-type-except [ types ]);interface interface-name;(interface-group [ group-names ] | interface-group-except [ group-names ]);interface-set set-name;(ip-options [ option-names ] | ip-options-except [ option-names ]);is-fragment;(packet-length [ values ] | packet-length-except [ values ]);(port [ port-names ] | port-except [ port-names ]);(precedence [ precedence-names ] | precedence-except [ precedence-names ]);prefix-list {list-name <except>;}(protocol [ protocol-names ] | protocol-except [ protocol-names ]);service-filter-hit;source-address {ip-prefix</prefix-length> <except>;}(source-port [ port-names ] | source-port-except [ port-names ]);source-prefix-list {list-name <except>;}tcp-established;tcp-flags flag;tcp-initial;}then {(accept | discard | reject);count counter-name;forwarding-class class-name;log;loss-priority (high | low);next;packet-mode;policer policer-name;port-mirror;routing-instance routing-instance-name> <topology topology-name>;sample;service-accounting;service-filter-hit;syslog;topology topology-name;virtual-channel;}}}interface-set interface-set-name {interface-name;}policer policer-name {filter-specific;if-exceeding {(bandwidth-limit bps | bandwidth-percent percentage);burst-size-limit bytes;}logical-interface-policer;then {discard;forwarding-class forwarding-class-name; loss-priority (high |low |medium-high |medium-low);out-of-profile;}}three-color-policer policer-name {filter-specific;single-rate { (color-aware | color-blind);committed-burst-size bytes; committed-information-rate bps;excess-burst-size bytes;}two-rate { (color-aware | color-blind);committed-burst-size bytes; committed-information-rate bps; peak-burst-size bytes; peak-information-rate bps;}}}
