Stateless Firewall Filter Overview
Packet Flow Control
To influence which packets are allowed to transit the system and to apply special actions to packets as necessary, you can configure stateless firewall filters. A stateless firewall specifies a sequence of one or more packet-filtering rules, called filter terms. A filter term specifies match conditions to use to determine a match and actions to take on a matched packet. A stateless firewall filter enables you to manipulate any packet of a particular protocol family, including fragmented packets, based on evaluation of Layer 3 and Layer 4 header fields. You typically apply a stateless firewall filter to one or more interfaces that have been configured with protocol family features. You can apply a stateless firewall filter to an ingress interface, an egress interface, or both.
Data Packet Flow Control
To control the flow of data packets transiting the device as the packets are being forwarded from a source to a destination, you can apply stateless firewall filters to the input or output of the router’s or switch’s physical interfaces.
To enforce a specified bandwidth and maximum burst size for traffic sent or received on an interface, you can configure policers. Policers are a specialized type of stateless firewall filter and a primary component of the Junos OS class-of-service (CoS).
Local Packet Control
To control
local
packets between the physical interfaces and the
Routing Engine, you can apply stateless firewall
filters to the input or output of the loopback
interface. The loopback interface
(lo0) is the interface to the
Routing Engine and carries no data packets.
Junos OS Evolved Local Packet Control
In Junos OS Evolved, you can control local packets by applying a loopback interface filter or management interface filter. With two filters, you have more flexibility. For example, you can configure a stricter filter on control traffic at the management interface.
Management filtering uses Routing Engine filters based on netfilters, a framework provided by the Linux kernel. This difference results in only certain matches and actions being supported. Refer Routing Engine Firewall Filters to read more.
You must explicitly add the filter on the management interface as for Junos OS Evolved, the lo filter no longer applies on the management traffic, as is the case for Junos OS.
Stateless and Stateful Firewall Filters
A stateless firewall filter, also known as an access control list (ACL), does not statefully inspect traffic. Instead, it evaluates packet contents statically and does not keep track of the state of network connections. In contrast, a stateful firewall filter uses connection state information derived from other applications and past communications in the data flow to make dynamic control decisions.
The Routing Policies, Firewall Filters, and Traffic Policers User Guide describes stateless firewall filters.
Purpose of Stateless Firewall Filters
The basic purpose of a stateless firewall filter is to enhance security through the use of packet filtering. Packet filtering enables you to inspect the components of incoming or outgoing packets and then perform the actions you specify on packets that match the criteria you specify. The typical use of a stateless firewall filter is to protect the Routing Engine processes and resources from malicious or untrusted packets.