IPv6 Wildcard Mask Match Conditions

date_range 27-Feb-25

arrow_backward

arrow_forward

Overview

Firewall filters are an important component of network security. You (the network administrator) might have many similar IP addresses in your network that you want to allow or disallow. Configuring each address individually can be time-consuming and inefficient. A more efficient option is to use wildcard masks. To dynamically apply firewall filters to similar IPv6 addresses, configure match conditions based on wildcard masks for your firewall filters.

By default, any IPv6 address you configure in a firewall filter has a subnet mask of 128, which means the address must match exactly. To get a partial match on an address, use a subnet mask where ffff includes that portion of the address and 0000 excludes that portion of the address.

Configuration

Follow these steps to use wildcard masks for IPv6 addresses.

Create an IPv6 stateless firewall filter. In this example, the filter is called f1.
```
[edit]
user@host# edit firewall family inet6 filter f1
```
Specify that a packet matches if it is from a source address or going to a destination address that matches the condition after the subnet mask is applied.
In this example, the firewall filter matches on packets with a source address of the form 2001:db8:0:0:****:1111, where **** stands for any value. The firewall filter also matches on packets with a destination address of 2001:db8:0:0:****:2222, where **** stands for any value.
```
[edit firewall family inet6 filter f1]
user@host# set term 1 from source-address 2001:db8::1111/ ffff:ffff:0:ffff::ffff 
user@host# set term 1 from destination-address 2001:db8::2222/ ffff:ffff:0:ffff::ffff 
```
Specify that matched packets should be counted, logged to the buffer on the Packet Forwarding Engine, and accepted.
```
[edit firewall family inet6 filter f1]
user@host# set term 1 then count cnt1
user@host# set term 1 then log
user@host# set term 1 then accept
```
Specify that for packets not matching the specified source or destination addresses, the firewall filter should count them separately.
```
[edit firewall family inet6 filter f1]
user@host# set term 2 then count default-match
```
Apply the firewall filter to a particular port. In this example, the interface et-0/0/16:4 has address 2001:db8:3c4d:3::2222. We apply the firewall filter to packets that enter the port et-0/0/16:4. Any packets destined for that port match the f1 filter and are logged accordingly.
```
[edit]
user@host# set interfaces et-0/0/16:4 unit 0 family inet6 filter input f1
```
Commit the configuration.
```
[edit]
user@host# commit
```
Verify your configuration was successful.
In the example below, the counter cnt1 shows the number of packets that matched the firewall filter’s match condition. The default-match counter shows the packets that did not match the condition.
```
user@device> show firewall    
Filter: f1      
Counters:
Name                                     Bytes              Packets
cnt1                                     1057536            8262
default-match                            0                  0
```

Platform Support

See Feature Explorer for platform and release support.

AI-ML Data Center Feature Guide

ON THIS PAGE

IPv6 Wildcard Mask Match Conditions

Overview

Configuration

Platform Support

Related Documentation

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry