Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Filtering Packets Received on an Interface Group

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you configure two router or switch interfaces to belong to the interface group. You also configure a stateless firewall filter that matches packets that have been tagged as received on that interface group, contain a source or destination address within a particular prefix, and contain a TCP source or destination port of a specific type and port number. The filter counts, logs, and rejects packets that match this criteria. The filter counts, logs, and rejects all other packets. By applying this firewall filter to only one of the two interfaces in the interface group, you can apply the filtering mechanism to all packets input to the two interfaces.

Topology

You configure the interface group number 1 to consist of the management port fxp0.0 and the loopback port lo0.0.

You configure the firewall filter filter_if_group to accept only packets from interface group 1, received from or destined for IP addresses in the 192.168.80.114/32 prefix, and received from or destined for TCP port number 79.

You apply the firewall filter filter_if_group to the router’s (or switch’s) loopback interface.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

• Configure the Stateless Firewall Filter
• Assign Interfaces to the Interface Group
• Apply the Firewall Filter to the Loopback Interface
• Confirm and Commit Your Candidate Configuration

CLI Quick Configuration

Configure the Stateless Firewall Filter

Step-by-Step Procedure

1. Create the stateless firewall filter filter_if_group.

   [edit]user@host# edit firewall family inet filter filter_if_group

2. Configure term term1 to match packets received on interface group 1, with the source or destination address field in the 192.168.80.114/32 prefix, and with the TCP source or destination port number 79.

   [edit firewall family inet filter filter_if_group]user@host# set term term1 from interface-group 1user@host# set term term1 from address 192.168.80.114/32user@host# set term term1 from protocol tcpuser@host# set term term1 from port finger

3. Configure term term1 to count, log, and reject matching packets.

   [edit firewall family inet filter filter_if_group]user@host# set term term1 then count if_group_counter1user@host# set term term1 then loguser@host# set term term1 then reject

4. Configure the term term2 to count, log, and accept all other packets.

   [edit firewall family inet filter filter_if_group]user@host# set term term2 then count if_group_counter2user@host# set term term2 then loguser@host# set term term2 then accept

Assign Interfaces to the Interface Group

Step-by-Step Procedure

1. Assign the management port to interface group number 1.

   [edit]user@host# set interfaces fxp0 unit 0 family inet filter group 1user@host# set interfaces fxp0 unit 0 family inet address 192.168.5.38/24

2. Assign a second logical interface to interface group number 1.

   [edit]user@host# set interfaces lo0 unit 0 family inet filter group 1user@host# set interfaces lo0 unit 0 family inet address 10.0.0.1/32user@host# set interfaces lo0 unit 0 family inet address 192.168.77.1/32

Apply the Firewall Filter to the Loopback Interface

Step-by-Step Procedure

• To apply the firewall filter to the router’s (or switch’s) loopback interface:

  [edit]user@host# set interfaces lo0 unit 0 family inet filter input filter_if_group

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show firewall

   family inet {filter filter_if_group {term term1 {from {interface-group 1;address {192.168.80.114/32;}protocol tcp;port finger;}then {count if_group_counter1;log;reject;}}term term2 {then {count if_group_counter2;log;accept;}}}}

2. Confirm the configuration of the interfaces by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

   [edit]user@host# show interfaces

   fxp0 {unit 0 {family inet {filter {group 1;}address 192.168.5.38/24;}}}

   lo0 {unit 0 {family inet {filter {input filter_if_group;group 1;}address 10.0.0.1/32;address 192.168.77.1/32;}}}

3. If you are done configuring the device, commit your candidate configuration.

   [edit]user@host# commit

Verification

To display the firewall filter counters, enter the show firewall filter filter_if_group operational mode command:

Filter: filter_if_group                                        
Counters:
Name                                                Bytes              Packets
if_group_counter1                                       0                    0
if_group_counter2                                 6452105                82667

To display the local log of packet headers for packets evaluated by the firewall filter, enter the show firewall log operational mode command.