TechLibrary

Classic Filters
Classic Filters Overview Basic Classic Filter Syntax Ascend-Data-Filter Policies for Subscriber Management Overview Ascend-Data-Filter Attribute Fields Firewall Filters and Enhanced Network Services Mode Overview

Classic Filters

Classic Filters Overview

Basic Classic Filter Syntax

Ascend-Data-Filter Policies for Subscriber Management Overview

Ascend-Data-Filter Attribute Fields

Firewall Filters and Enhanced Network Services Mode Overview

Parameterized Filters
Parameterized Filters Overview Basic Parameterized Filter Syntax Unique Identifiers for Firewall Variables in Dynamic Profiles Sample Dynamic-Profile Configuration for Parameterized Filters Dynamic Profile After UID Substitutions for Parameterized Filters Dynamic Profile Configuration and UID Substitution Comparison for Parameterized Filters Parameterized Filters Configuration Considerations Guidelines for Creating and Applying Parameterized Filters for Subscriber Interfaces Parameterized Filter Processing Overview Multiple Parameterized Filters IPv4 Parameterized Filter Match Conditions IPv6 Parameterized Filter Match Conditions Parameterized Filter Actions and Modifiers Parameterized Filter Policer Actions Hierarchical Policer Overview Hierarchical Policer as Filter Action Enhanced Policer Statistics Overview Interface-Shared Filters Overview

Parameterized Filters

Parameterized Filters Overview

Basic Parameterized Filter Syntax

Unique Identifiers for Firewall Variables in Dynamic Profiles

Sample Dynamic-Profile Configuration for Parameterized Filters

Dynamic Profile After UID Substitutions for Parameterized Filters

Dynamic Profile Configuration and UID Substitution Comparison for Parameterized Filters

Parameterized Filters Configuration Considerations

Guidelines for Creating and Applying Parameterized Filters for Subscriber Interfaces

Parameterized Filter Processing Overview

Multiple Parameterized Filters

IPv4 Parameterized Filter Match Conditions

IPv6 Parameterized Filter Match Conditions

Parameterized Filter Actions and Modifiers

Parameterized Filter Policer Actions

Hierarchical Policer Overview

Hierarchical Policer as Filter Action

Enhanced Policer Statistics Overview

Interface-Shared Filters Overview

Fast Update Filters
Fast Update Filters Overview Basic Fast Update Filter Syntax Match Conditions and Actions in Fast Update Filters Fast Update Filter Match Conditions Fast Update Filter Actions and Action Modifiers

Fast Update Filters

Fast Update Filters Overview

Basic Fast Update Filter Syntax

Match Conditions and Actions in Fast Update Filters

Fast Update Filter Match Conditions

Fast Update Filter Actions and Action Modifiers

Unicast RPF and Fail Filters
Unicast RPF in Dynamic Profiles for Subscriber Interfaces

Configuration Tasks For Filters and Dynamic Profiles
Dynamically Attaching Statically Created Filters for a Specific Interface Family Type Dynamically Attaching Statically Created Filters for Any Interface Type Dynamically Attaching Filters Using RADIUS Variables Defining Dynamic Filter Processing Order Configuring Firewall Filter Bypass Configuring Filters to Permit Expected Traffic Configuring a Filter for Use with Enhanced Network Services Mode Dynamically Applying Ascend-Data-Filter Policies to Subscriber Sessions

Configuration Tasks For Filters and Dynamic Profiles

Dynamically Attaching Statically Created Filters for a Specific Interface Family Type

Dynamically Attaching Statically Created Filters for Any Interface Type

Dynamically Attaching Filters Using RADIUS Variables

Defining Dynamic Filter Processing Order

Configuring Firewall Filter Bypass

Configuring Filters to Permit Expected Traffic

Configuring a Filter for Use with Enhanced Network Services Mode

Dynamically Applying Ascend-Data-Filter Policies to Subscriber Sessions

Configuration Tasks for Fast Update Filters
Configuring Fast Update Filters Configuring the Match Order for Fast Update Filters Configuring Terms for Fast Update Filters Avoiding Conflicts When Terms Match Associating Fast Update Filters with Interfaces in a Dynamic Profile

Configuration Tasks for Fast Update Filters

Configuring Fast Update Filters

Configuring the Match Order for Fast Update Filters

Configuring Terms for Fast Update Filters

Avoiding Conflicts When Terms Match

Associating Fast Update Filters with Interfaces in a Dynamic Profile

Configuration Tasks for Dynamic Service Sets
Associating Service Sets with Interfaces in a Dynamic Profile

Configuration Tasks for Unicast and Fail Filters
Configuring Unicast RPF and Fail Filters in Dynamic Profiles for Subscriber Interfaces Configuring Unicast RPF in Dynamic Profiles for Subscriber Interfaces Configuring a Fail Filter for Unicast RPF in Dynamic Profiles for Subscriber Interfaces

Configuration Tasks for Unicast and Fail Filters

Configuring Unicast RPF and Fail Filters in Dynamic Profiles for Subscriber Interfaces

Configuring Unicast RPF in Dynamic Profiles for Subscriber Interfaces

Configuring a Fail Filter for Unicast RPF in Dynamic Profiles for Subscriber Interfaces

Examples
Examples: Configuring Static Filters Example: Configuring Dynamic Ascend-Data-Filter Support for Subscriber Access Example: Configuring Static Ascend-Data-Filter Support for Subscriber Access Example: Configuring Fast Update Filters for Subscriber Access Example: Bypassing Firewall Filters Example: Dynamic-Profile Parsing Example: Configuring Hierarchical Policers as Filter Actions Example: Interface-Shared Filter Configuration Example: Configuring Unicast RPF in a Dynamic Profile on MX Series Routers

Examples

Examples: Configuring Static Filters

Example: Configuring Dynamic Ascend-Data-Filter Support for Subscriber Access

Example: Configuring Static Ascend-Data-Filter Support for Subscriber Access

Example: Configuring Fast Update Filters for Subscriber Access

Example: Bypassing Firewall Filters

Example: Dynamic-Profile Parsing

Example: Configuring Hierarchical Policers as Filter Actions

Example: Interface-Shared Filter Configuration

Example: Configuring Unicast RPF in a Dynamic Profile on MX Series Routers

Configuration Statements
[edit dynamic-profiles] Hierarchy Level action adf aggregate bandwidth-limit bandwidth-percent burst-size-limit (Hierarchical Policer) burst-size-limit (Policer) color-aware color-blind committed-burst-size committed-information-rate dynamic-profiles enhanced-policer excess-burst-size fail-filter family family (Dynamic Firewalls) fast-update-filter filter filter (Dynamic Firewalls) filter (Dynamic Interface Unit) filter-specific firewall hierarchical-policer if-exceeding (Policer) if-exceeding (Hierarchical Policer) input interface-shared interface-specific interfaces logical-bandwidth-policer logical-interface-policer loss-priority high then discard match-order output peak-burst-size peak-information-rate physical-interface-policer policer policy-options post-service-filter precedence premium rpf-check service service-filter service-set interface-shared single-rate term three-color-policer two-rate unit

Configuration Statements

[edit dynamic-profiles] Hierarchy Level

burst-size-limit (Hierarchical Policer)

burst-size-limit (Policer)

color-aware

color-blind

committed-burst-size

committed-information-rate

family (Dynamic Firewalls)

fast-update-filter

filter

filter (Dynamic Firewalls)

filter (Dynamic Interface Unit)

filter-specific

firewall

hierarchical-policer

if-exceeding (Policer)

if-exceeding (Hierarchical Policer)

logical-bandwidth-policer

logical-interface-policer

loss-priority high then discard

match-order

output

peak-burst-size

peak-information-rate

physical-interface-policer

Verifying and Managing Filter and Service Set Configurations
Verifying and Managing Firewall Filter Configuration Verifying and Managing Dynamic Ascend-Data-Filter Policy Configuration Verifying and Managing Service Sets Information

Verifying and Managing Filter and Service Set Configurations

Verifying and Managing Firewall Filter Configuration

Verifying and Managing Dynamic Ascend-Data-Filter Policy Configuration

Verifying and Managing Service Sets Information

Monitoring Commands
clear firewall show firewall show firewall log show firewall templates-in-use show services service-sets summary show subscribers show subscribers summary

Monitoring Commands

clear firewall

show firewall

show firewall log

show firewall templates-in-use

show services service-sets summary

show subscribers

show subscribers summary

Troubleshooting
Acquiring Troubleshooting Information
Collecting Subscriber Access Logs Before Contacting Juniper Technical Support
Knowledge Base
http://kb.juniper.net/

Acquiring Troubleshooting Information
Collecting Subscriber Access Logs Before Contacting Juniper Technical Support

Knowledge Base
http://kb.juniper.net/

Supported Platforms

MX Series

Downloads

Download this page: Dynamic Firewall