Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary
Navigation

Example: Configuring and Applying a Simple Filter

This example shows how to configure a simple filter.

Requirements

This example uses one of the following hardware components:

  • One Gigabit Ethernet intelligent queuing (IQ2) PIC installed on an M120, M320, or T Series router
  • One Enhanced Queuing Dense Port Concentrator (EQ DPC) installed on an MX Series router or an EX Series switch

Before you begin, make sure that you have:

  • Installed your supported router (or switch) and PIC or DPC and performed the initial router (or switch) configuration.
  • Configured basic Ethernet in the topology, and verified that traffic is flowing in the topology and that ingress IPv4 traffic is flowing into logical interface ge-0/0/1.0.

Overview

This simple filter sets the loss priority to low for TCP traffic with source address 1.1.1.1, sets the loss priority to high for HTTP (Web) traffic with source addresses in the 4.0.0.0/8 range, and sets the loss priority to low for all traffic with destination address 6.6.6.6.

Topology

The simple filter is applied as an input filter (arriving packets are checking for destination address 6.6.6.6, not queued output packets) on interface ge-0/0/1.0.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

CLI Quick Configuration

To quickly configure this example, copy the following commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

set firewall family inet simple-filter sf_classify_1 term 1 from source-address 1.1.1.1/32set firewall family inet simple-filter sf_classify_1 term 1 from protocol tcpset firewall family inet simple-filter sf_classify_1 term 1 then loss-priority lowset firewall family inet simple-filter sf_classify_1 term 2 from source-address 4.0.0.0/8set firewall family inet simple-filter sf_classify_1 term 2 from protocol tcpset firewall family inet simple-filter sf_classify_1 term 2 from source-port httpset firewall family inet simple-filter sf_classify_1 term 2 then loss-priority highset firewall family inet simple-filter sf_classify_1 term 3 from destination-address 6.6.6.6/32set firewall family inet simple-filter sf_classify_1 term 3 then loss-priority lowset firewall family inet simple-filter sf_classify_1 term 3 then forwarding-class best-effortset interfaces ge-0/0/1 unit 0 family inet simple-filter input sf_classify_1set interfaces ge-0/0/1 unit 0 family inet address 10.1.2.3/30

Configuring the Simple Firewall Filter

Step-by-Step Procedure

To configure the simple filter:

  1. Create the simple filter sf_classify_1.

    [edit]user@host# edit firewall family inet simple-filter sf_classify_1

  2. Configure classification of TCP traffic based on the source IP address.

    [edit firewall family inet simple-filter sf_classify_1]user@host# set term 1 from source-address 1.1.1.1/32user@host# set term 1 from protocol tcpuser@host# set term 1 then loss-priority low

  3. Configure classification of HTTP traffic based on the source IP address.

    [edit firewall family inet simple-filter sf_classify_1]user@host# set term 2 from source-address 4.0.0.0/8user@host# set term 2 from protocol tcpuser@host# set term 2 from source-port httpuser@host# set term 2 then loss-priority high

  4. Configure classification of other traffic based on the destination IP address.

    [edit firewall family inet simple-filter sf_classify_1]user@host# set term 3 from destination-address 6.6.6.6/32user@host# set term 3 then loss-priority lowuser@host# set term 3 then forwarding-class best-effort

Results

Confirm the configuration of the simple filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

[edit]user@host# show firewall
family inet {simple-filter sf_classify_1 {term 1 {from {source-address {1.1.1.1/32;}protocol {tcp;}}then loss-priority low;}term 2 {from {source-address {4.0.0.0/8;}source-port {http;}protocol {tcp;}}then loss-priority high;}term 3 {from {destination-address {6.6.6.6/32;}}then {loss-priority low;forwarding-class best-effort;}}}}

Applying the Simple Filter to the Logical Interface Input

Step-by-Step Procedure

To apply the simple filter to the logical interface input:

  1. Configure the logical interface to which you will apply the simple filter.

    [edit]user@host# edit interfaces ge-0/0/1 unit 0 family inet

  2. Configure the interface address for the logical interface.

    [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set address 10.1.2.3/30

  3. Apply the simple filter to the logical interface input.

    [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set simple-filter input sf_classify_1

Results

Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

[edit]user@host# show interfaces
ge-0/0/1 {unit 0 {family inet {simple-filter {input sf_classify_1;}address 10.1.2.3/30;}}}

When you are done configuring the device, commit your candidate configuration.

Verification

Confirm that the configuration is working properly.

Displaying the Mapping of Forwarding Class Maps and Names to Queue Numbers

Purpose

Display the mapping of forwarding class names to queue numbers.

Action

Enter the show class-of-service forwarding-class operational mode command.

[edit]user@host> show class-of-service forwarding-class

For information about the command output, see “show class-of-service forwarding-class” in the Junos OS Operational Mode Commands.

Displaying CoS Queue Counters for the Interface

Purpose

Verify that the class-of-service (CoS) queue counters for the interface reflect the simple filter applied to the logical interface.

Action

Enter the show interfaces command for the physical interface on which the simple filter is applied, and specify detail or extensive output level.

[edit]user@host> show interfaces ge-0/0/1 detail

In the Physical interface section, under Ingress queues, the Queue counters section displays ingress queue counters for each forwarding class.

For more detailed information about the command output, see “show interfaces (Gigabit Ethernet)” or “show interfaces (10-Gigabit Ethernet)” in the Junos OS Operational Mode Commands.

Displaying CoS Queue Counter Details for the Physical Interface

Purpose

Verify that the CoS queue counter details for the physical interface reflect the simple filter applied to the logical interface.

Action

Enter the show interfaces queue command for the physical interface on which the simple filter is applied, and specify the ingress option.

[edit]user@host> show interfaces queue ge-0/0/1 ingress

For information about the command output, see “show interfaces queue” in the Junos OS Operational Mode Commands.

 

Related Documentation

 

Published: 2013-04-10

Previous Page Next Page