Syntax
protocols {
(protocol-name | all <protocol-name except>);
}
Hierarchy Level
[edit security zones security-zone zone-name host-inbound-traffic]
Description
Specify the types of protocol traffic
that can reach the device for all interfaces in a zone. You can do
this in one of several ways:
You can enable traffic from each protocol individually.
You can enable traffic from all protocols.
You can enable traffic from all but some protocols.
Options
| protocol-name |
Protocol for which traffic is allowed. The following
protocols are supported:
all—Enable traffic from
all possible protocols available. Use the except option to disallow specific protocols.
bfd—Enable incoming Bidirectional
Forwarding Detection (BFD) protocol traffic.
bgp—Enable incoming BGP
traffic.
dvmrp—Enable incoming
Distance Vector Multicast Routing Protocol (DVMRP) traffic.
igmp—Enable incoming
Internet Group Management Protocol (IGMP) traffic.
ldp—Enable incoming Label
Distribution Protocol (LDP) traffic (UDP and TCP port 646).
msdp—Enable incoming
Multicast Source Discovery Protocol (MSDP) traffic.
nhrp—Enable incoming
Next Hop Resolution Protocol (NHRP) traffic.
ospf—Enable incoming
OSPF traffic.
ospf3—Enable incoming
OSPF version 3 traffic.
pgm—Enable incoming Pragmatic
General Multicast (PGM) protocol traffic (IP protocol number 113).
pim—Enable incoming Protocol
Independent Multicast (PIM) traffic.
rip—Enable incoming RIP
traffic.
ripng—Enable incoming
RIP next generation traffic.
router-discovery—Enable
incoming router discovery traffic.
rsvp—Enable incoming
Resource Reservation Protocol (RSVP) traffic (IP protocol number 46).
sap— Enable incoming
Session Announcement Protocol (SAP) traffic. SAP always listens on 224.2.127.254:9875. New addresses and ports can be added dynamically.
This information must be propagated to the Packet Forwarding Engine
(PFE).
vrrp—Enable incoming
Virtual Router Redundancy Protocol (VRRP) traffic.
|
| except |
(Optional) Disable specific incoming protocol traffic, but only
when the all option has been defined . For example,
to enable all but BGP and VRRP protocol traffic:
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust host-inbound-traffic protocols bgp except
set security zones security-zone trust host-inbound-traffic protocols vrrp except
|
Required Privilege Level
security—To view this statement
in the configuration.
security-control—To
add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release
8.5.
