Configuring Firewall Filters on Shared Interfaces

To allow equitable bandwidth sharing between all logical interfaces on a single shared physical interface, you configure firewall filters on the logical interfaces in the PSD configuration.

Whereas the RSD controls the physical shared interface and allocates a logical interface on it to the PSD, the PSD controls the configuration under the logical interface, including the protocol family. The shared interface on the RSD is not aware of the protocol family information associated with the logical interface. Therefore, on the PSD, the firewall filter must be configured under the [edit firewall family any] hierarchy and the filter is applied to the entire logical interface (as opposed to a protocol family under the interface.) With JUNOS Release 9.4, only output filters are supported.

To configure a firewall filter, create the filter conditions and apply the filter to the logical interfaces:

Configure the firewall filter conditions:
1. Include the filter filter-name statement at the [edit firewall family any] hierarchy level.
2. Include the term term-name statement at the [edit firewall family any filter filter-name] hierarchy level.
3. Include the from match-conditions statement at the [edit firewall family any filter filter-name term term-name] hierarchy level.
4. Include the then action statement at the [edit firewall family any filter filter-name term term-name] hierarchy level.
5. Include the then action-modifiers statement at the [edit firewall family any filter filter-name term term-name] hierarchy level.
Apply the firewall filter to the logical interface on the shared interface by including the filter output filter-name statement at the [edit interfaces interface-name unit logical-unit-number hierarchy level.

In the following example, term 1 and term 2 of the firewall filter-out provide per-class policing and term 3 provides logical interface-based policing. The filter is applied to the so-4/5/6.0 logical interface.


                        
                           firewall family any {
                           
                              
                                 filter filter-out {
                                 
                                    
                                       term 1 {
                                       
                                          
                                             from {
                                             forwarding-class voice;
                                             }
                                          
                                       
                                       
                                          
                                             then {
                                             policer tx-voice;
                                             next term;
                                             }
                                          
                                       
                                       }
                                    
                                 
                                 
                                    
                                       term 2 {
                                       
                                          
                                             from {
                                             forwarding-class data;
                                             }
                                          
                                       
                                       
                                          
                                             then {
                                             policer tx-data;
                                             next term;
                                             }
                                          
                                       
                                       }
                                    
                                 
                                 
                                    
                                       term 3 {
                                       then policer iflpolicer;
                                       }
                                    
                                 
                                 }
                              
                           
                           }
                           interfaces {
                           
                              
                                 ut-1/2/3 {
                                 
                                    
                                       unit 0 {
                                       peer-interface so-4/5/6.0;
                                       }
                                       }
                                    
                                 
                                 }
                              
                           
                           
                              
                                 so-4/5/6 {
                                 encapsulation frame-relay;
                                 
                                    
                                       unit 0 {
                                       peer-interface ut-1/2/3.0;
                                       filter output filter-out;
                                       
                                          
                                             family inet {
                                             address 192.168.0.1/24;
                                             }
                                          
                                       
                                       
                                          
                                             family inet6 {
                                             address fec0::1/64;
                                             }
                                          
                                       
                                       }
                                    
                                 
                                 }

For more information about firewall filters, see the JUNOS Policy Framework Configuration Guide.

Configuring Firewall Filters on Shared Interfaces

Published: 2009-07-23