Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Guidelines for Configuring Standard Firewall Filters

Statement Hierarchy for Configuring Standard Firewall Filters

• [edit]
• [edit logical-systems logical-system-name]

Note: For stateless firewall filtering, you must allow the output tunnel traffic through the firewall filter applied to input traffic on the interface that is the next-hop interface toward the tunnel destination. The firewall filter affects only the packets exiting the router by way of the tunnel.

Standard Firewall Filter Protocol Families

• family any—To filter protocol-independent traffic.
• family inet—To filter Internet Protocol version 4 (IPv4) traffic.
• family inet6—To filter Internet Protocol version 6 (IPv6) traffic.
• family mpls—To filter MPLS traffic.
• family vpls—To filter virtual private LAN service (VPLS) traffic.
• family ccc—To filter Layer 2 circuit cross-connection (CCC) traffic.
• family bridge—To filter Layer 2 bridging traffic for MX Series 3D Universal Edge Routers only.

The family family-name statement is required only to specify a protocol family other than IPv4. To configure an IPv4 firewall filter, you can configure the filter at the [edit firewall] hierarchy level without including the family inet statement, because the [edit firewall] and [edit firewall family inet] hierarchy levels are equivalent.

Standard Firewall Filter Names and Options

Under the family family-name statement, you can include filter filter-name statements to create and name standard firewall filters. The filter name can contain letters, numbers, and hyphens (-) and be up to 64 characters long. To include spaces in the name, enclose the entire name in quotation marks (“ ”).

• accounting-profile
• interface-specific
• physical-interface-filter

Standard Firewall Filter Terms

• You must configure at least one term in a firewall filter.
• You must specify a unique name for each term within a firewall filter. The term name can contain letters, numbers, and hyphens (-) and can be up to 64 characters long. To include spaces in the name, enclose the entire name in quotation marks (“ ”).
• The order in which you specify terms within a firewall filter configuration is important. Firewall filter terms are evaluated in the order in which they are configured. By default, new terms are always added to the end of the existing filter. You can use the insert configuration mode command to reorder the terms of a firewall filter.

At the [edit firewall family family-name filter filter-name term term-name] hierarchy level, the filter filter-name statement is not valid in the same term as from or then statements. When included at this hierarchy level, the filter filter-name statement is used to nest firewall filters.

Standard Firewall Filter Match Conditions

Standard firewall filter match conditions are specific to the type of traffic being filtered.

With the exception of MPLS-tagged IPv4 or IPv6 traffic, you specify the term’s match conditions under the from statement. For MPLS-tagged IPv4 traffic, you specify the term’s IPv4 address-specific match conditions under the ip-version ipv4 statement and the term’s IPv4 port-specific match conditions under the protocol (tcp | udp) statement.

For MPLS-tagged IPv6 traffic, you specify the term’s IPv6 address-specific match conditions under the ip-version ipv6 statement and the term’s IPv6 port-specific match conditions under the protocol (tcp | udp) statement.

Table 1 describes the types of traffic for which you can configure standard stateless firewall filters.

If you specify an IPv6 address in a match condition (the address, destination-address, or source-address match conditions), use the syntax for text representations described in RFC 4291, IP Version 6 Addressing Architecture. For more information about IPv6 addresses, see IPv6 Overviewand Supported IPv6 Standards.

Standard Firewall Filter Actions

Under the then statement for a standard stateless firewall filter term, you can specify the actions to be taken on a packet that matches the term.

Table 2 summarizes the types of actions you can specify in a standard stateless firewall filter term.