Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Filter to Accept Packets Based on IPv6 TCP Flags

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you create a filter that accepts packets with specific IPv6 TCP flags.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

• Configure the Stateless Firewall Filter
• Apply the Firewall Filter to the Loopback Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the IPv6 stateless firewall filter tcp_filter.

   [edit]user@host# edit firewall family inet6 filter tcp_filter

2. Specify that a packet matches if it is the initial packet in a TCP session and the next header after the IPv6 header is type TCP.

   [edit firewall family inet6 filter tcp_filter]user@host# set term 1 from next-header tcpuser@host# set term 1 from tcp-flags syn

3. Specify that matched packets are counted, logged to the buffer on the Packet Forwarding Engine, and accepted.

   [edit firewall family inet6 filter tcp_filter]user@host# set term 1 then count tcp_syn_pktuser@host# set term 1 then loguser@host# set term 1 then accept

Apply the Firewall Filter to the Loopback Interface

Step-by-Step Procedure

• [edit]user@host# set interfaces lo0 unit 0 family inet6 filter input tcp_filteruser@host# set interfaces lo0 unit 0 family inet6 address ::10.34.1.0/120

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   family inet6 {filter tcp_filter {term 1 {from {next-header tcp;tcp-flags syn;}then {count tcp_syn_pkt;log;accept;}}}}

2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   lo0 {unit 0 {family inet6 {filter {input tcp_filter;}address ::10.34.1.0/120;}}}

3. When you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

To confirm that the configuration is working properly, enter the show firewall operational mode command.