Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Filter to Match on Port and Protocol Fields

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you configure a stateless firewall filter that accepts all IPv4 packets except for TCP and UDP packets. TCP and UDP packets are accepted if destined for the SSH port or the Telnet port. All other packets are rejected.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

• Configure the Stateless Firewall Filter
• Apply the Stateless Firewall Filter to a Logical Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the IPv4 stateless firewall filter.

   [edit]user@host# edit firewall family inet filter filter1

2. Configure a term to accept all traffic except for TCP and UDP packets.

   [edit firewall family inet filter filter1]user@host# set term term1 from protocol-except tcpuser@host# set term term1 from protocol-except udpuser@host# set term term1 then accept

3. Configure a term to reject packets to or from the 192.168/16 prefix.

   [edit firewall family inet filter filter1]user@host# set term term2 from address 192.168.0.0/16user@host# set term term2 then reject

4. Configure a term to accept packets destined for either the SSH port or the Telnet port.

   [edit firewall family inet filter filter1]user@host# set term term3 from destination-port sshuser@host# set term term3 from destination-port telnetuser@host# set term term3 then accept

5. Configure the last term to reject all packets.

   [edit firewall family inet filter filter1]user@host# set term term4 then reject

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

1. Configure the logical interface to which you will apply the stateless firewall filter.

   [edit]user@host# edit interfaces ge-0/0/1 unit 0 family inet

2. Configure the interface address for the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set address 10.1.2.3/30

3. Apply the stateless firewall filter to the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set filter input filter1

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   family inet {filter filter1 {term term1 {from {protocol-except [tcp udp];}then {accept;}}term term2 {from {address 192.168/16;}then {reject;}}term term3 {from {destination-port [ssh telnet];}then {accept;}}term term4 {then {reject;}}}}

2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   ge-0/0/1 {unit 0 {family inet {filter {input filter1;}address 10.1.2.3/30;}}}

3. If you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

To confirm that the configuration is working properly, enter the show firewall filter filter1 operational mode command.