Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Filter to Count Accepted and Rejected Packets

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you use a stateless firewall filter to reject all addresses except 192.168.5.0/24.

Topology

In the first term, the match condition address 192.168.5.0/24 except causes this address to be considered a mismatch, and this address is passed to the next term in the filter. The match condition address 0.0.0.0/0 matches all other packets, and these are counted, logged, and rejected.

In the second term, all packets that passed though the first term (that is, packets whose address matches 192.168.5.0/24) are counted, logged, and accepted.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configure the Stateless Firewall Filter
• Apply the Stateless Firewall Filter to a Logical Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the stateless firewall filter fire1.

   [edit]user@host# edit firewall family inet filter fire1

2. Configure the first term to reject all addresses except those to or from the 192.168.5.0/24 prefix and then count, log, and reject all other packets.

   [edit firewall family inet filter fire1]user@host# set term 1 from address 192.168.5.0/24 exceptuser@host# set term 1 from address 0.0.0.0/0user@host# set term 1 then count reject_pref1_1user@host# set term 1 then loguser@host# set term 1 then reject

3. Configure the next term to count, log, and accept packets in the 192.168.5.0/24 prefix.

   [edit firewall family inet filter fire1]user@host# set term 2 then count reject_pref1_2user@host# set term 2 then loguser@host# set term 2 then accept

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

1. Configure the logical interface to which you will apply the stateless firewall filter.

   [edit]user@host# edit interfaces ge-0/0/1 unit 0 family inet

2. Configure the interface address for the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set address 10.1.2.3/30

3. Apply the stateless firewall filter to the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set filter input fire1

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   family inet {filter fire1 {term 1 {from {address {192.168.5.0/24 except;0.0.0.0/0;}}then {count reject_pref1_1;log;reject;}}term 2 {then {count reject_pref1_2;log;accept;}}}}

2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   ge-0/0/1 {unit 0 {family inet {filter {input fire1;}address 10.1.2.3/30;}}}

3. If you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

• show firewall counter reject_pref1_1
• show firewall counter reject_pref1_2
• show firewall log