close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

protocols (Security Zones Host Inbound Traffic)

date_range 20-Nov-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
protocols {
    (protocol-name | all <protocol-name except>);
}

Hierarchy Level

content_copy zoom_out_map
[edit security zones security-zone zone-name host-inbound-traffic]

Description

Specify the types of protocol traffic that can reach the device for all interfaces in a zone. You can do this in one of several ways:

You can enable traffic from each protocol individually.
You can enable traffic from all protocols.
You can enable traffic from all but some protocols.

Options

protocol-name

Protocol for which traffic is allowed. The following protocols are supported:

all—Enable traffic from all possible protocols available. Use the except option to disallow specific protocols.
bfd—Enable incoming Bidirectional Forwarding Detection (BFD) protocol traffic.
bgp—Enable incoming BGP traffic.
dvmrp—Enable incoming Distance Vector Multicast Routing Protocol (DVMRP) traffic.
igmp—Enable incoming Internet Group Management Protocol (IGMP) traffic.
ldp—Enable incoming Label Distribution Protocol (LDP) traffic (UDP and TCP port 646).
msdp—Enable incoming Multicast Source Discovery Protocol (MSDP) traffic.
nhrp—Enable incoming Next Hop Resolution Protocol (NHRP) traffic.
ospf—Enable incoming OSPF traffic.
ospf3—Enable incoming OSPF version 3 traffic.
pgm—Enable incoming Pragmatic General Multicast (PGM) protocol traffic (IP protocol number 113).
pim—Enable incoming Protocol Independent Multicast (PIM) traffic.
rip—Enable incoming RIP traffic.
ripng—Enable incoming RIP next generation traffic.
router-discovery—Enable incoming router discovery traffic.
rsvp—Enable incoming Resource Reservation Protocol (RSVP) traffic (IP protocol number 46).
sap— Enable incoming Session Announcement Protocol (SAP) traffic. SAP always listens on 224.2.127.254:9875. New addresses and ports can be added dynamically. This information must be propagated to the Packet Forwarding Engine (PFE).
vrrp—Enable incoming Virtual Router Redundancy Protocol (VRRP) traffic.

except

(Optional) Disable specific incoming protocol traffic, but only when the all option has been defined . For example, to enable all but BGP and VRRP protocol traffic:

content_copy zoom_out_map
set security zones security-zone trust host-inbound-traffic protocols all 
set security zones security-zone trust host-inbound-traffic protocols bgp except
set security zones security-zone trust host-inbound-traffic protocols vrrp except

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 8.5.

arrow_backward PREVIOUS protocols rsvp expand-flood-reflector-hop

NEXT arrow_forward protocols (Security Zones Interfaces)

Junos CLI Reference

ON THIS PAGE

protocols (Security Zones Host Inbound Traffic)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

protocols (Security Zones Host Inbound Traffic)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Related Documentation

Stay in touch