max-drop-flows
Syntax
max-drop-flows {
ingress ingress-flows;
egress egress-flows;
}
Hierarchy Level
[edit services service-set service-set-name]
Description
Configure the maximum drop flows allowed per ingress and egress direction. The configuration is per service set. The configured limits indicate the maximum number of drop flows that can be created at a given instance of time in both directions. If max drop flows ingress is 10 and egress is 5 then at a given instance of time maximum of 10 ingress drop flows and 5 egress drop flows can be present. Two counters, one for each direction ingress and egress, are to be added to service set stateful-firewall statistics to track the number of drop flows not created due to the drop flow limits exceeded. These limits applies to all types of drop flows i.e., TCP, UDP, ICMP etc. Ingress drop flows are forward flows for match-direction input rules and reverse flows for match-direction output rules. Similarly egress drop flows are reverse flows for match-direction input and forward flows for match-direction output rules. The limits are applied cumulatively on all the nat rules associated with the service-set.
If you specify the maximum drop flows to be zero, it indicates that the configuration is not effective. You must specify a value higher than zero for maximum drop flows.
Options
| ingress-flows | Maximum number of drop flows on the ingress interface. |
| egress-flows | Maximum number of drop flows on the egress interface. |
Required Privilege Level
interface—To view this statement in the configuration.
interface-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 12.3