You can configure filters, policers, and broadcast/unknown filters to determine which kind of traffic is allowed into and out of a VPLS domain. You can apply these filters and policers to CE-facing interfaces only.
To restrict the flow of broadcast and unknown unicast packets into a VPLS domain, you must create a firewall filter and apply the filter to one of the forwarding tables of the VPLS routing instance. When you apply a filter in this way, the filter processes traffic from all interfaces in the instance, including vt interfaces. To configure match conditions for a VPLS-based firewall filter, include the source-mac-address, destination-mac-address, interface-group, ethernet-type, or vlan-ethernet-type statements at the [edit firewall family vpls filter filter-name term term-name from] hierarchy level. Then, specify statements to activate the desired action (for example, discard) for the matched packets at the [edit firewall family vpls filter filter-name term term-name then] hierarchy level.
To apply the filter to the broadcast and unknown unicast table of a VPLS routing instance, include the input statement and the name of the filter at the [edit routing-instances instance-name forwarding-options family vpls flood] hierarchy level. To apply the filter to the destination MAC address table of a VPLS routing instance, include the input statement and the name of the filter at the [edit routing-instances instance-name forwarding-options family vpls filter] hierarchy level.
- [edit]
- firewall {
-
- family vpls {
-
- filter vpls-flood {
-
- term 1 {
-
- from {
-
- destination-mac-address (broadcast | multicast | unknown-unicast)
{
# The broadcast, multicast,
# and unknown-unicast options apply to MX Series
# routers only.
- 00.90.69.dc.95.3b/48;
- }
- }
- then discard;
- }
-
- term 2 {
- then accept;
- }
- }
- }
- }
- routing-instances {
-
- green {
-
- forwarding-options {
-
- family vpls {
-
- (flood | filter) {
- input vpls-flood;
- }
- }
- }
- }
- }
When you configure VPLS, a priority filter for Spanning Tree Protocol (STP) bridge protocol data units (BPDUs) is enabled by default. This BPDU filter matches on the well-known STP MAC address of 01:80:c2:00:00:00/24 and applies high priority to this traffic.
For more information on VPLS policers and filters, see the JUNOS Policy Framework Configuration Guide and the JUNOS VPNs Configuration Guide.
