Technical Documentation

Configuring Filters for inet Family Type (NSM Procedure)

You can configure filters, prefix-actions, service filters, and simple filters for Inet using the following options. See the following topics:

Configuring Firewall Filter for inet Family Type (NSM Procedure)

You can configure a firewall filter for inet family type.

To configure the firewall filter in NSM:

  1. In the NSM navigation tree, select Device Manager > Devices.
  2. Click the Device Tree tab, and then double-click the device to select it.
  3. Click the Configuration tab. In the configuration tree, expand Firewall > Family > Inet.
  4. Select Filter.
  5. Add or modify settings as specified in Table 1.
  6. Click one:
    • OK—Saves the changes.
    • Cancel—Cancels the modifications.

Table 1: Firewall Filter Configuration Details

Task Your Action

Configure a firewall filter to filter IPv4 packets.

  1. Expand Inet.
  2. Click Filter next to Inet.
  3. Click Add new entry next to Filter.
  4. Expand Filter.
  5. In the name box, enter the name that identifies the filter.
  6. In the Comment box, enter the comment.
  7. Select the Interface Specific check box to configure interface-specific names for firewall counters.

Configure accounting for firewall filters.

  1. Click Accounting Profile next to filter.
  2. Click Add new entry next to Accounting Profile.
  3. In the New accounting-profile window, enter the name to be assigned to the accounting profile.

Define firewall filter term.
  1. Click Term next to Accounting Profile.
  2. Click Add new entry next to Term.
  3. Expand Term.
  4. In the Name box, enter the name that identifies the term.
  5. In the Comment box, enter the comment for the term.
  6. From the Filter list, select the name that identifies the filter.
  7. Expand From.
  8. In the Comment box, enter the comment.
  9. Select the Is Fragment check box if the packet is a trailing fragment.
  10. Select the First Fragment check box if it matches the first fragment of a fragmented packet.
  11. In the Fragment Flags box, enter the IP fragmentation flags.
  12. Select the Tcp Initial check box if it matches the first TCP packet of a connection.
  13. Select the Tcp established check box if it matches the TCP packets other than the first packet of a connection.
  14. In the Tcp Flags box, enter the TCP flags.
  15. From the listed protocol-independent match conditions, select the filters defined for the Inet family type.

    The protocol-independent match conditions are Address, Ah Spi, Destination Address, Destination Class, Destination port, Destination prefix List, Dscp, Esp Spi, Forwarding Class, Fragment offset, Icmp Code, Icmp Type, Interface, Interface Group, Interface Set, Ip Options, Loss Priority, Packet Length, Port, Precedence, prefix List, Protocol, Source Address, Source Port, Source Prefix List and Ttl.

  16. Expand Then.
  17. In the Comment box, enter the comment for then.
  18. In the Count box, enter the number of packets.
  19. Select the Log check box to store the header information of a packet on the Routing Engine.
  20. Select Syslog to log an alert for the packet.
  21. Select the Sample check box to sample the packet traffic.
  22. Select the Port Mirror check box to port-mirror the packets.
  23. From the Loss Priority list, set the packet loss priority (PLP) to low, medium-low, medium-high, or high.
  24. In the Forwarding Class box, enter the packet forwarding class name.
  25. From the Prefix Action list, select the prefix specific action.
  26. Click Accept next to Then.
    • Select Accept to accept a packet.
    • Select Discard to discard a packet silently, without sending an ICMP message.
    • Select Next to evaluate the next term in the firewall filter.
    • Select Routing instance to specify a routing table to which packets are forwarded.
    • Select IPsec Sa to specify an IP Security (IPsec) security association (SA) for the packet.
    • Select Reject to discard a packet, and send an ICMP destination unreachable message.
  27. Click Policer next to Then.
  28. Select one of the following:
    • Select Policer to configure a new policer for each filter and select the policer name.
    • Select three-color-policer to configure a tricolor marking policer,
      1. Expand Three Color Policer.
      2. Click Single Rate next to Three Color Policer.
      3. Select one of the following:
        • single-rate—If the named tricolor policer is a single-rate policer.
        • two-rate—If the named tricolor policer is a two-rate policer.

Configuring Prefix-specific Actions (NSM Procedure)

Prefix-specific actions allow you to configure policers and counters for specific addresses or ranges of addresses. This allows you to essentially create policers and counters on a per-prefix level.

To configure the prefix-specific actions in NSM:

  1. In the NSM navigation tree, select Device Manager > Devices.
  2. Click the Device Tree tab, and then double-click the device to select it.
  3. Click the Configuration tab. In the configuration tree, expand Firewall > Family > Inet.
  4. Click Prefix Action.
  5. Add or modify settings as specified in Table 2.
  6. Click one:
    • OK—Saves the changes.
    • Cancel—Cancels the modifications.

Table 2: Prefix Actions Details

Task Your Action

Configure prefix-specific actions.
  1. Click Prefix Action next to Inet.
  2. In the Name box, enter the action name.
  3. From the Policer list, select the actions to be taken.
  4. Select the Count check box to include count as the action modifier.
  5. Select the Filter Specific check box to configure a policer to act as a filter-specific policer.
  6. From the Subnet Prefix Length list, select the subnet prefix length.

    Range: 0 to 32

  7. Click Source Prefix Length next to prefix-action.
  8. Select source-prefix-length to configure the source address range specified for a prefix-specific policer or counter and select the source prefix length.
  9. Select destination-prefix-length to configure the destination address range specified for a prefix-specific policer or counter and select the destination prefix length.

Configuring Service Filters (NSM Procedure)

A service filter identifies packets on which one or more services are to be applied, and which PIC performs the service.

To configure the service filters for inet in NSM:

  1. In the NSM navigation tree, select Device Manager > Devices.
  2. Click the Device Tree tab, and then double-click the device to select it.
  3. Click the Configuration tab. In the configuration tree, expand Firewall > Family > Inet.
  4. Click Prefix Action.
  5. Add or modify settings as specified in Table 3.
  6. Click one:
    • OK—Saves the changes.
    • Cancel—Cancels the modifications.

Table 3: Service Filter Configuration Details

Task Your Action

Configure service filter.
  1. Click Service Filter next to Inet.
  2. Click Add new entry next to Service Filter.
  3. Expand service-filter.
  4. In the Name box, enter the name that identifies the service filter.

Define firewall filter term.
  1. Click Term next to service-filter.
  2. Click Add new entry next to Term.
  3. Expand Term.
  4. In the Name box, enter the name that identifies the term.
  5. In the Comment box, enter the comment for the term.
  6. Expand From.
  7. In the Comment box, enter the comment.
  8. Check the Is Fragment check box if the packet is a trailing fragment.
  9. Check the First Fragment check box if it matches the first fragment of a fragmented packet.
  10. In the Fragment Flags box, enter the IP fragmentation flags.
  11. From the listed protocol-independent match conditions, select the filters defined for the Inet family type.

    The protocol-independent match conditions are Address, Ah Spi, Destination Address, Destination port, Destination prefix List, Esp Spi, Fragment offset, Interface Group, , Ip Options, Loss Priority, Port, Prefix List, Protocol, Source Address, Source Port, and Source Prefix List.

  12. Click Then next to From.
  13. In the Comment box, enter the comment for then.
  14. In the Count box, enter the number of packets.
  15. Select the Log check box to store the header information of a packet on the Routing Engine.
  16. Select the Sample check box to sample the packet traffic.
  17. Select the Port Mirror check box to port-mirror the packets.
  18. Select Service to direct packets for stateful-firewall service.
  19. Select Skip to let packets bypass stateful-firewall service.

Configuring Simple Filters (NSM Procedure)

Simple filters are used to support Ethernet IQ2 PICs. A simple filter is a subset of a firewall filter with the following limitations:

  • The next-term action is not supported.
  • The except and protocol-except match conditions are not supported.
  • Noncontiguous masks are not supported.
  • Only one source-address and one destination-address prefix are allowed for each filter term.

To configure the simple filters for inet in NSM:

  1. In the NSM navigation tree, select Device Manager > Devices.
  2. Click the Device Tree tab, and then double-click the device to select it.
  3. Click the Configuration tab. In the configuration tree, expand Firewall > Family > Inet.
  4. Select Simple Filters.
  5. Add or modify settings as specified in Table 4.
  6. Click one:
    • OK—Saves the changes.
    • Cancel—Cancels the modifications.

Table 4: Simple Filter Details

Task Your Action

Configure simple filter.
  1. Click Simple Filter next to Inet.
  2. Click Add new entry next to Simple Filter.
  3. In the Name box, enter the name that identifies the simple filter.

Define a term.
  1. Click Term next to simple-filter.
  2. Click Add new entry next to Term.
  3. Expand Term.
  4. In the Name box, enter the name that identifies the term.
  5. In the Comment box, enter the comment.
  6. Expand From.
  7. From the listed protocol-independent match conditions, select the filters defined for the Inet family type.

    The protocol-independent match conditions are Destination Address, Destination port, Forwarding Class, Protocol, Source Address, and Source Port.

  8. Click Then next to From.
  9. In the Comment box, enter the comment.
  10. From the Loss Priority list, select the packet loss priority (PLP) level to set it as low, medium-low, medium-high, or high.
  11. In the Forwarding Class box, enter the packet forwarding class name.

Published: 2009-08-23