Configuring a Filter Action Statement

In a firewall filter term, you can specify the action to take if the packet matches the conditions you have configured in the term. To configure a filter action, include the then statement:

For IPv4 traffic, configure the filter action at the [edit firewall family inet filter filter-name term term-name] hierarchy level. For IPv6 traffic, configure the filter action at the [edit firewall family inet6 filter filter-name term term-name] hierarchy level. For MPLS traffic, configure the filter terms at the [edit firewall family mpls filter filter-name term term-name] hierarchy level.

You can specify zero or one then statement in a filter term. If you omit the then statement or do not specify an action, the packets that match the conditions in the from statement are accepted.

NOTE: We strongly recommend that you always explicitly configure an action in the then statement.

In the filter action statement, you can also specify one or more of the following action modifiers:

You can include zero or one action statement, but any combination of action modifiers. For the action or action modifier to take effect, all conditions in the from statement must match. If you specify log as one of the actions in a term, this constitutes a termination action; whether any additional terms in the filter are processed depends on the traffic through the filter.

The action modifier operations carry a default accept action. For example, if you specify an action modifier and do not specify an action, the specified action modifier is implemented and the packet is accepted.

Policing uses a specific type of action, known as a policer action. For more information, see Policer Configuration.

For more information about forwarding classes and loss priority, see the JUNOS Network Interfaces and Class of Service Configuration Guide.

Table 22: Firewall Filter Actions and Action Modifiers

Action or Action Modifier	Description
Actions
`accept`	Accept a packet. This is the default.
`discard`	Discard a packet silently, without sending an Internet Control Message Protocol (ICMP) message. Discarded packets are not available for logging or sampling.
`next term`	Continue to the next term for evaluation.
`reject` `<message-type>`	Discard a packet, sending an ICMP destination unreachable message. Rejected packets can be logged or sampled if you configure either of those action modifiers. You can specify one of the following message codes: `administratively-prohibited` (default), `bad-host-tos`, `bad-network-tos`, `host-prohibited`, `host-unknown`, `host-unreachable`, `network-prohibited`, `network-unknown`, `network-unreachable`, `port-unreachable`, `precedence-cutoff`, `precedence-violation`, `protocol-unreachable`, `source-host-isolated`, `source-route-failed`, or `tcp-reset`. If you specify `tcp-reset`, a Transmission Control Protocol (TCP) reset is returned if the packet is a TCP packet. Otherwise, nothing is returned.
`routing-instance` `routing-instance`	Specify a routing instance to which packets are forwarded.
Action Modifiers
`count` `counter-name`	The number of the packets passing this filter/term/policer. The name can contain letters, numbers, and hyphens (-), and can be up to 24 characters long. A counter name is specific to the filter that uses it, so all interfaces that use the same filter increment the same counter.
`forwarding-class` `class-name`	A particular forwarding class.
`ipsec-sa` `sa-name`	An IPSec SA for the packet. Used with the `source-address` and `destination-address` match conditions.
`log`	Log the packet's header information in the Routing Engine. You can access this information by issuing the `show log` command at the command-line interface (CLI).
`loss-priority` `priority`	Set the PLP to `low` or `high`.
`policer` `policer-name`	Apply rate limits to the traffic using the named policer.
`sample`	Sample the traffic on the interface. Use this modifier only when traffic sampling is enabled. For more information, see Traffic Sampling and Forwarding Configuration.
`syslog`	Log an alert for this packet. The log can be sent to a server for storage and analysis.

Configuring a Filter Action Statement

Example: Configure a Filter Action Statement