Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Filtering Packets Received on an Interface Set

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you apply a stateless firewall filter to the input of the router or switch loopback interface. The firewall filter includes a term that matches packets tagged for a particular interface set.

Topology

• fe-0/0/0.0
• fe-1/0/0.0
• fe-1/1/0.0

Note: The interface type in this topic is just an example. The fe- interface type is not supported by EX Series switches.

First, for protocol-independent traffic received on fe-0/0/0.0, the firewall filter term t1 applies policer p1.

For protocol-independent traffic received on any other Fast Ethernet interfaces, firewall filter term t2 applies policer p2. To define an interface set that consists of all Fast Ethernet interfaces, you include the interface-set interface-set-name interface-name statement at the [edit firewall] hierarchy level. To define a packet-matching criteria based on the interface on which a packet arrives to a specified interface set, you configure a term that uses the interface-set firewall filter match condition.

Finally, for any other protocol-independent traffic, firewall filter term t3 applies policer p3.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

• Configuring the Interfaces for Which the Stateless Firewall Filter Terms Take Rate-Limiting Actions
• Configuring the Stateless Firewall Filter That Rate-Limits Protocol-Independent Traffic Based on the Interfaces on Which Packets Arrive
• Applying the Stateless Firewall Filter to the Routing Engine Input Interface

CLI Quick Configuration

Configuring the Interfaces for Which the Stateless Firewall Filter Terms Take Rate-Limiting Actions

Step-by-Step Procedure

1. Configure the logical interface whose input traffic will be matched by the first term of the firewall filter.

   [edit]user@host# set interfaces fe-0/0/0 unit 0 family inet address 10.1.1.1/30

2. Configure the logical interfaces whose input traffic will be matched by the second term of the firewall filter.

   [edit ]user@host# set interfaces fe-1/0/0 unit 0 family inet address 10.2.2.1/30user@host# set interfaces fe-1/1/0 unit 0 family inet address 10.4.4.1/30

3. If you are done configuring the device, commit the configuration.

   [edit]user@host# commit

Results

Configuring the Stateless Firewall Filter That Rate-Limits Protocol-Independent Traffic Based on the Interfaces on Which Packets Arrive

Step-by-Step Procedure

1. Configure the firewall statements.

   [edit]user@host# edit firewall

2. Configure the policer p1 to discard traffic that exceeds a traffic rate of 5m bps or a burst size of 10m bytes.

   [edit firewall]user@host# set policer p1 if-exceeding bandwidth-limit 5muser@host# set policer p1 if-exceeding burst-size-limit 10muser@host# set policer p1 then discard

3. Configure the policer p2 to discard traffic that exceeds a traffic rate of 40m bps or a burst size of 100m bytes .

   [edit firewall]user@host# set policer p2 if-exceeding bandwidth-limit 40muser@host# set policer p2 if-exceeding burst-size-limit 100muser@host# set policer p2 then discard

4. Configure the policer p3 to discard traffic that exceeds a traffic rate of 600m bps or a burst size of 1g bytes.

   [edit firewall]user@host# set policer p3 if-exceeding bandwidth-limit 600muser@host# set policer p3 if-exceeding burst-size-limit 1guser@host# set policer p3 then discard

5. Define the interface set ifset to be the group of all Fast Ethernet interfaces on the router.

   [edit firewall]user@host# set interface-set ifset fe-*

6. Create the stateless firewall filter L2_filter.

   [edit firewall]user@host# edit family any filter L2_filter

7. Configure filter term t1 to match IPv4, IPv6, or MPLS packets received on interface fe-0/0/0.0 and use policer p1 to rate-limit that traffic.

   [edit firewall family any filter L2_filter]user@host# set term t1 from interface fe-0/0/0.0user@host# set term t1 then count c1user@host# set term t1 then policer p1

8. Configure filter term t2 to match packets received on interface-set ifset and use policer p2 to rate-limit that traffic.

   [edit firewall family any filter L2_filter]user@host# set term t2 from interface-set ifsetuser@host# set term t2 then count c2user@host# set term t2 then policer p2

9. Configure filter term t3 to use policer p3 to rate-limit all other traffic.

   [edit firewall family any filter L2_filter]user@host# set term t3 then count c3user@host# set term t3 then policer p3

10. If you are done configuring the device, commit the configuration.

    [edit]user@host# commit

Results

Applying the Stateless Firewall Filter to the Routing Engine Input Interface

Step-by-Step Procedure

1. Apply the stateless firewall filter to the Routing Engine interface in the input direction.

   [edit]user@host# set interfaces lo0 unit 0 family inet address 1.1.1.157/30user@host# set interfaces lo0 unit 0 filter input L2_filter

2. If you are done configuring the device, commit the configuration.

   [edit]user@host# commit

Results

Verification

To confirm that the configuration is working properly, use the show firewall filter L2_filter operational mode command to monitor traffic statistics about the firewall filter and three counters.