Restricting Broadcast Packets in VPLS
You can configure filters, policers, and broadcast and unknown filters to determine which kind of traffic is allowed into and out of a VPLS domain. You can apply these filters and policers to CE-facing interfaces only.
To restrict the flow of broadcast and unknown unicast packets
into a VPLS domain, you must create a firewall filter and apply the
filter to one of the forwarding tables of the VPLS routing instance.
When you apply a filter in this way, the filter processes traffic
from all interfaces in the instance, including vt interfaces.
To configure match conditions for a VPLS-based firewall filter, include
the source-mac-address, destination-mac-address, interface-group, ethernet-type, or vlan-ethernet-type statements at the [edit firewall family vpls filter filter-name term term-name from] hierarchy level. Then, specify statements to activate the desired
action (for example, discard) for the matched packets at
the [edit firewall family vpls filter filter-name term term-name then] hierarchy level.
To apply the filter to the broadcast and unknown unicast table
of a VPLS routing instance, include the input statement
and the name of the filter at the [edit routing-instances instance-name forwarding-options family vpls flood] hierarchy level. To apply the filter to the destination MAC address
table of a VPLS routing instance, include the input statement
and the name of the filter at the [edit routing-instances instance-name forwarding-options family vpls filter] hierarchy level.
[edit]
firewall {
family vpls {
filter vpls-flood {
term 1 {
from {
destination-mac-address {
00.90.69.dc.95.3b/48;
}
}
then discard;
}
term 2 {
then accept;
}
}
}
}
routing-instances {
green {
forwarding-options {
family vpls {
(flood | filter) {
input vpls-flood;
}
}
}
}
}
When you configure VPLS, a priority filter for Spanning Tree
Protocol (STP) bridge protocol data units (BPDUs) is enabled by default.
This BPDU filter matches on the well-known STP MAC address of 01:80:c2:00:00:00/24 and applies high priority to this traffic.
For more information on VPLS policers and filters, see the Junos Policy Framework Configuration Guide and the Junos VPNs Configuration Guide.