Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring a Filter to Accept DHCP Packets Based on Address

Requirements

This example is supported only on MX Series routers and EX Series switches.

Overview

In this example, you create a filter (rpf_dhcp) that accepts DHCP packets with a source address of 0.0.0.0 and a destination address of 255.255.255.255.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

• Configure the Stateless Firewall Filter
• Apply the Firewall Filter to the Loopback Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the stateless firewall filter rpf_dhcp.

   [edit]user@host# edit firewall family inet filter rpf_dhcp

2. Configure the term to match packets with a source address of 0.0.0.0 and a destination address of 255.255.255.255.

   [edit firewall family inet filter rpf_dhcp]user@host# set term dhcp_term from source-address 0.0.0.0/32 user@host# set term dhcp_term from destination-address 255.255.255.255/32

3. Configure the term to accept packets that match the specified conditions.

   [edit firewall family inet filter rpf_dhcp]set term dhcp_term then accept

Apply the Firewall Filter to the Loopback Interface

Step-by-Step Procedure

1. Apply the rpf_dhcp filter if packets are not arriving on an expected path.

   [edit]user@host# set interfaces lo0 unit 0 family inet rpf-check fail-filter rpf_dhcp

2. Configure an address for the loopback interface.

   [edit]user@host# set interfaces lo0 unit 0 family inet address 127.0.0.1/32

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   family inet {filter rpf_dhcp {term dhcp_term {from {source-address {0.0.0.0/32;}destination-address {255.255.255.255/32;}}then accept;}}}

2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   lo0 {unit 0 {family inet {filter {rpf-check {fail-filter rpf_dhcp;mode loose;}}address 127.0.0.1/32;}}}

3. When you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

To confirm that the configuration is working properly, enter the show firewall operational mode command.