Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Filter to Count IP Options Packets

Requirements

This example uses an interface on a 10-Gigabit Ethernet Modular Port Concentrator (MPC), 60-Gigabit Ethernet MPC, 60-Gigabit Queuing Ethernet MPC, or 60-Gigabit Ethernet Enhanced Queuing MPC on an MX Series router. This interface enables you to apply an IPv4 firewall filter (standard or service filter) that can use the count, log, and syslog nonterminating actions on packets that match a specific ip-option value without having to also use the discard terminating action.

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you use a stateless firewall filter to count IP options packets but not block any traffic. Also, the filter logs packets that have loose or strict source routing.

The IP option header field is an optional field in IPv4 headers only. The ip-options and ip-options-except match conditions are supported for standard stateless firewall filters and service filters only.

Note: On M and T series routers, firewall filters cannot count ip-options packets on a per option type and per interface basis. A limited work around is to use the show pfe statistics ip options command to see ip-options statistics on a per Packet Forwarding Engine (PFE) basis. See show pfe statistics ip for sample output.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configure the Stateless Firewall Filter
• Apply the Stateless Firewall Filter to a Logical Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the stateless firewall filter ip_option_filter.

   [edit]user@host# edit firewall family inet filter ip_options_filter

2. Configure the first term to count, log, and accept packets with the strict_source_route IP optional header field.

   [edit firewall family inet filter ip_option_filter]user@host# set term match_strict_source from ip-options strict_source_routeuser@host# set term match_strict_source then count strict_source_routeuser@host# set term match_strict_source then loguser@host# set term match_strict_source then accept

3. Configure the next term to count, log, and accept packets with the loose-source-route IP optional header field.

   [edit firewall family inet filter ip_option_filter]user@host# set term match_loose_source from ip-options loose-source-routeuser@host# set term match_loose_source then count loose_source_routeuser@host# set term match_loose_source then loguser@host# set term match_loose_source then accept

4. Configure the next term to count and accept packets with the record-route IP optional header field.

   [edit firewall family inet filter ip_option_filter]user@host# set term match_record from ip-options record-routeuser@host# set term match_record then count record_routeuser@host# set term match_record then accept

5. Configure the next term to count and accept packets with the timestamp IP optional header field.

   [edit firewall family inet filter ip_option_filter]user@host# set term match_timestamp from ip-options timestampuser@host# set term match_timestamp then count timestampuser@host# set term match_timestamp then accept

6. Configure the next term to count and accept packets with the router-alert IP optional header field.

   [edit firewall family inet filter ip_option_filter]user@host# set term match_router_alert from ip-options router-alertuser@host# set term match_router_alert then count router_alertuser@host# set term match_router_alert then accept

7. Create the last term to accept any packet without incrementing any counters.

   [edit firewall family inet filter ip_option_filter]user@host# set term match_all then accept

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

1. Configure the logical interface to which you will apply the stateless firewall filter.

   [edit]user@host# edit interfaces ge-0/0/1 unit 0 family inet

2. Configure the interface address for the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set address 10.1.2.3/30

3. Apply the stateless firewall filter to the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set filter input ip_options_filter

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   family inet {filter ip_options_filter {term match_strict_source {from {ip-options strict-source-route;}then {count strict_source_route;log;accept;}}term match_loose_source {from {ip-options loose-source-route;}then {count loose_source_route;log;accept;}}term match_record {from {ip-options record-route;}then {count record_route;accept;}}term match_timestamp {from {ip-options timestamp;}then {count timestamp;accept;}}term match_router_alert {from {ip-options router-alert;}then {count router_alert;accept;}}term match_all {then accept;}}}

2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   ge-0/0/1 {unit 0 {family inet {filter {input ip_option_filter;}address 10.1.2.3/30;}}}

3. If you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

• show firewall counter strict_source_route
• show firewall counter loose_source_route
• show firewall counter record_route
• show firewall counter timestamp
• show firewall counter router_alert
• show firewall log