address address except

Do not match the IP source or destination address field.

family inet

family inet6

ah-spi-except spi-value

(M Series routers, except M120 and M320) Do not match on the IPsec AH SPI value.

family inet

—

destination-address address address

Do not match the IP destination address field.

You cannot specify both the address and destination-address match conditions in the same term.

family inet

family inet6

destination-port-except number

Do not match the UDP or TCP destination port field. For details, see the destination-port match description.

family inet

family inet6

esp-spi value

Match the IPsec encapsulating security payload (ESP) SPI value. Specify a single value or a range of values. You can specify a value in hexadecimal, binary, or decimal form. To specify the value in hexadecimal form, include 0x as a prefix. To specify the value in binary form, include b as a prefix.

family inet

family inet6

first-fragment

Match if the packet is the first fragment of a fragmented packet. Do not match if the packet is a trailing fragment of a fragmented packet. The first fragment of a fragmented packet has a fragment offset value of 0.

This match condition is an alias for the bit-field match condition fragment-offset 0 match condition.

To match both first and trailing fragments, you can use two terms that specify different match conditions: first-fragment and is-fragment.

family inet

—

fragment-offset number

Match the 13-bit fragment offset field in the IP header. The value is the offset, in 8-byte units, in the overall datagram message to the data fragment. Specify a numeric value, a range of values, or a set of values. An offset value of 0 indicates the first fragment of a fragmented packet.

The first-fragment match condition is an alias for the fragment-offset 0 match condition.

To match both first and trailing fragments, you can use two terms that specify different match conditions (first-fragment and is-fragment).

family inet

—

interface-group group-number

Match the interface group (set of one or more logical interfaces) on which the packet was received. For group-number, specify a value from 0 through 255.

For information about configuring interface groups, see Filtering Packets Received on a Set of Interface Groups Overview.

family inet

family inet6

ip-options values

Match the 8-bit IP option field, if present, to the specified value or list of values.

In place of a numeric value, you can specify one of the following text synonyms (the option values are also listed): loose-source-route (131), record-route (7), router-alert (148), security (130), stream-id (136), strict-source-route (137), or timestamp (68).

To match any value for the IP option, use the text synonym any. To match on multiple values, specify the list of values within square brackets ('[’ and ']’). To match a range of values, use the value specification [ value1-value2 ].

For example, the match condition ip-options [ 0-147 ] matches on an IP options field that contains the loose-source-route, record-route, or security values, or any other value from 0 through 147. However, this match condition does not match on an IP options field that contains only the router-alert value (148).

• For a firewall filter term that specifies an ip-option match on one or more specific IP option values, you cannot specify the count, log, or syslog nonterminating actions unless you also specify the discard terminating action in the same term. This behavior prevents double-counting of packets for a filter applied to a transit interface on the router (or switch).
• Packets processed on the kernel might be dropped in case of a system bottleneck. To ensure that matched packets are instead sent to the Packet Forwarding Engine (where packet processing is implemented in hardware), use the ip-options any match condition.

The 10-Gigabit Ethernet Modular Port Concentrator (MPC), 60-Gigabit Ethernet MPC, 60-Gigabit Queuing Ethernet MPC, 60-Gigabit Ethernet Enhanced Queuing MPC on MX Series routers and EX Series switches are capable of parsing the IP option field of the IPv4 packet header. This capability is supported on EX Series switches also. For interfaces configured on those MPCs, all packets that are matched using the ip-options match condition are sent to the Packet Forwarding Engine for processing.

family inet

—

is-fragment

Match if the packet is a trailing fragment of a fragmented packet. Do  not match the first fragment of a fragmented packet.

This match condition is an alias for the bit-field match condition fragment-offset 0 except bits.

Note: To match both first and trailing fragments, you can use two terms that specify different match conditions (first-fragment and is-fragment).

family inet

—

port-except number

Do not match the UDP or TCP source or destination port field. For details, see the port match condition.

family inet

family inet6

protocol number

Match the IP protocol type field.

In place of the numeric value, you can specify one of the following text synonyms (the field values are also listed): ah (51), dstopts (60), egp (8), esp (50), fragment (44), gre (47), hop-by-hop (0), icmp (1), icmp6 (58), icmpv6 (58), igmp (2), ipip (4), ipv6 (41), ospf (89), pim (103), rsvp (46), sctp (132), tcp (6), udp (17), or vrrp (112).

family inet

—

source-address address

Match the IP source address.

You cannot specify both the address and source-address match conditions in the same term.

family inet

family inet6

source-port number

Match the UDP or TCP source port field.

You cannot specify the port and source-port match conditions in the same term.

If you configure this match condition for IPv4 traffic, we recommend that you also configure the protocol udp or protocol tcp match statement in the same term to specify which protocol is being used on the port.

If you configure this match condition for IPv6 traffic, we recommend that you also configure the next-header udp or next-header tcp match condition in the same term to specify which protocol is being used on the port.

In place of the numeric value, you can specify one of the text synonyms listed with the destination-port number match condition.

family inet

family inet6

source-prefix-list name

Match source prefixes in the specified list. Specify the name of a prefix list defined at the [edit policy-options prefix-list prefix-list-name] hierarchy level.

family inet

family inet6