loopback-firewall-optimization
Syntax
loopback-firewall-optimization;
Hierarchy Level
[edit chassis]
Description
Enable this setting to increase the system limit for the number of loopback filter terms that can be configured. When enabled, you can configure up to 768 loopback filter terms for IPv6, and up to 1152 terms for IPv4. The packet forwarding engine (PFE) will restart upon commit for the new system limits to take effect.
TTL (time-to-live) values such as 0/1 are not matched unless explicitly mentioned in the firewall filter term. Terms that include a reserved multicast destination such as 224.0.0.x/24 are not directly supported as match condition in filters used with the loopback address (lo0). Instead, to count packets destined to the reserved multicast address of 224.0. 0.6, you would need to create a filter that specifies protocol OSPF as the match term. An example showing such a configuration is provided below.
[edit interfaces]
lo0 {
unit 0 {
family <inet | inet6> {
filter {
input f1;
}
address 127.0.0.1/32;
}
}
}
[edit firewall]
family <inet | inet6> {
filter f1 {
term t1 {
from {
protocol ospf;
}
then {
count c1;
accept;
}
}
}
}
Required Privilege Level
interface
Release Information
Statement introduced in Junos OS Release 20.3R1.