Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Filter to Match on Two Unrelated Criteria

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you use a standard stateless firewall filter to match IPv4 packets that are either OSPF packets or packets that come from an address in the prefix 10.108/16, and send an administratively-prohibited ICMP message for all packets that do not match.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configuring the IPv4 Firewall Filter
• Applying the IPv4 Firewall Filter to a Logical Interface

CLI Quick Configuration

Configuring the IPv4 Firewall Filter

Step-by-Step Procedure

1. Enable configuration of the IPv4 firewall filter.

   [edit]user@host# edit firewall family inet filter ospf_or_131

2. Configure the first term to accept OSPF packets.

   [edit firewall family inet filter ospf_or_131]user@host# set term protocol_match from protocol ospf
   Packets that match the condition are accepted by default. Because another term follows this term, packets that do not match this condition are evaluated by the next term.

3. Configure the second term to accept packets from any IPv4 address in a particular prefix.

   [edit firewall family inet filter ospf_or_131]user@host# set term address_match from source-address 10.108.0.0/16
   Packets that match this condition are accepted by default. Because this is the last term in the filter, packets that do not match this condition are discarded by default.

Results

Applying the IPv4 Firewall Filter to a Logical Interface

Step-by-Step Procedure

1. Enable configuration of a logical interface.

   [edit]user@host# edit interfaces ge-0/0/1 unit 0 family inet

2. Configure an IP address for the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set address 10.1.2.3/30

3. Apply the IPv4 firewall filter to the logical interface.

   [edit interfaces ge-0/0/1 unit 0 family inet]user@host# set filter input ospf_or_131

Results

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, enter the show firewall filter ospf_or_131 operational mode command.