Apply Firewall Filters

To apply firewall filters to an interface, include the filter statement at the [edit interfaces interface-name unit logical-unit-number family (inet | inet6 | mpls)] hierarchy level:

[edit interfaces]

interfaces interface-name {

    unit logical-unit-number {

        family (inet | inet6 | mpls) {

            filter { 

                group filter-group-number;

                input filter-name;

                output filter-name;

            }

        }

    }

}

In the group statement, specify the interface group number to associate with the filter.

In the input statement, list the name of one firewall filter to be evaluated when packets are received on the interface.

In the output statement, list the name of one firewall filter to be evaluated when packets are transmitted on the interface.

You can use the same filter one or more times.

If you apply the filter to the interface lo0, it is applied to packets received or transmitted by the Routing Engine. You cannot apply MPLS filters to the management interface (fxp0) or the loopback interface (lo0).

For more information about firewall filters, see the JUNOS Internet Software Configuration Guide: Policy Framework. For more information about MPLS filters, see the JUNOS Internet Software Configuration Guide: MPLS Applications.

Define Interface Groups in Firewall Filters

When applying a firewall filter, you can define an interface to be part of an interface group. Packets received on that interface are tagged as being part of the group. You can then match these packets using the interface-group match statement, as described in the JUNOS Internet Software Configuration Guide: Policy Framework.

To define the interface to be part of an interface group, include the group statement at the [edit interfaces interface-name unit logical-unit-number family (inet | inet6 | mpls) filter] hierarchy level:

[edit interfaces]

interfaces interface-name {

    unit logical-unit-number {

        family (inet | inet6 | mpls) {

            filter {

                group filter-group-number;

            }

        }

    }

}