Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary
Navigation

Supported Platforms

 

Related Documentation

 

Guidelines for Applying Standard Firewall Filters

This topic covers the following information:

Applying Firewall Filters Overview

You can apply a standard firewall filter to a loopback interface on the router or to a physical or logical interface on the router. Table 1 summarizes the behavior of firewall filters based on the point to which you attach the filter.

Table 1: Firewall Filter Behavior by Filter Attachment Point

Filter Attachment Point

Filter Behavior

Loopback interface

The router’s loopback interface, lo0, is the interface to the Routing Engine and carries no data packets. When you apply a firewall filter to the loopback interface, the filter evaluates the local packets received or transmitted by the Routing Engine.

Physical interface or logical interface

When you apply a filter to a physical interface on the router or to a logical interface (or member of an aggregated Ethernet bundle defined on the interface), the filter evaluates all data packet that pass through that interface.

Multiple interfaces

You can use the same firewall filter one or more times.

On M Series routers, except the M120 and M320 routers, if you apply a firewall filter to multiple interfaces, the filter acts on the sum of traffic entering or exiting those interfaces.

On T Series, M120, M320, and MX Series routers, interfaces are distributed among multiple packet-forwarding components. On these routers, you can configure firewall filters and service filters that, when applied to multiple interfaces, act on the individual traffic streams entering or exiting each interface, regardless of the sum of traffic on the multiple interfaces.

For more information, see Interface-Specific Firewall Filter Instances Overview.

Single interface with    protocol-independent and protocol-specific firewall filters attached

For interfaces hosted on the following hardware only, you can attach a protocol-independent (family any) firewall filter and a protocol-specific (family inet or family inet6) firewall filter simultaneously. The protocol-independent firewall executes first.

  • ACX Series Universal Access Routers
  • Flexible PIC Concentrators (FPCs) in M7i and M10i Multiservice Edge Routers
  • Modular Interface Cards (MICs) and Modular Port Concentrators (MPCs) in MX Series 3D Universal Edge Routers
  • T Series Core Routers

Interfaces hosted on the following hardware do not support protocol-independent firewall filters:

  • Forwarding Engine Boards (FEBs) in M120 routers
  • Enhanced III FPCs in M320 routers
  • FPC2 and FPC3 modules in MX Series routers
  • Dense Port Concentrators (DPCs) in MX Series routers
  • PTX Series Packet Transport Routers

Statement Hierarchy for Applying Firewall Filters

To apply a standard firewall filter to a logical interface, configure the filter statement for the logical interface defined under either the [edit] or [edit logical-systems logical-system-name] hierarchy level. Under the filter statement, you can include one or more of the following statements: group group-number, input filter-name, input-list filter-name, output filter-name, or output-list filter-name. The hierarchy level at which you attach the filter statement depends on the filter type and device type you are configuring.

Protocol-Independent Firewall Filters on MX Series Routers

To apply a protocol-independent firewall filter to a logical interface on an MX Series router, configure the filter statement directly under the logical unit:

interfaces {interface-name {unit logical-unit-number {filter {group group-number;input filter-name;input-list [ filter-names ];output filter-name;output-list [ filter-names ];}}}}

All Other Firewall Filters on Logical Interfaces

To apply a standard firewall filter to a logical interface for all cases other than a protocol-independent filter on an MX Series router, configure the filter statement under the protocol family:

interfaces {interface-name {unit logical-unit-number {family family-name {...filter {group group-number;input filter-name;input-list [ filter-names ];output filter-name;output-list [ filter-names ];}}}}}

Restrictions on Applying Firewall Filters

Number of Input and Output Filters Per Logical Interface

Input filters—Although you can use the same filter multiple times, you can apply only one input filter or one input filter list to an interface.

  • To specify a single firewall filter to be used to evaluate packets received on the interface, include the input filter-name statement in the filter stanza.
  • To specify an ordered list of firewall filters to be used to evaluate packets received on the interface, include the input-list [ filter-names ] statement in the filter stanza. You can specify up to 16 firewall filters for the filter input list.

Output filters—Although you can use the same filter multiple times, you can apply only one output filter or one output filter list to an interface.

  • To specify a single firewall filter to be used to evaluate packets transmitted on the interface, include the output filter-name statement in the filter stanza.
  • To specify an ordered list of firewall filters to be used to evaluate packets transmitted on the interface, include the output-list [ filter-names ] statement in the filter stanza. You can specify up to 16 firewall filters in a filter output list.

MPLS and Layer 2 CCC Firewall Filters in Lists

The input-list filter-names and output-list filter-names statements for firewall filters for the ccc and mpls protocol families are supported on all interfaces with the exception of the following:

  • Management interfaces and internal Ethernet interfaces (fxp or em0)
  • Loopback interfaces (lo0)
  • USB modem interfaces (umd)

Layer 2 CCC Firewall Filters on MX Series Routers

On MX Series routers only, you cannot apply a Layer 2 CCC stateless firewall filter (a firewall filter configured at the [edit firewall filter family ccc] hierarchy level) as an output filter. On MX Series routers, firewall filters configured for the family ccc statement can be applied only as input filters.

 

Related Documentation

 

Published: 2013-05-28

Supported Platforms

 

Related Documentation

 

Published: 2013-05-28

Previous Page Next Page