参数化过滤器的动态配置文件配置示例
在以下示例配置中，配置文件 my-svc-prof 提供了两种不同的过滤器： my-filt-1gw 和 my-filt-2gw。这些过滤器会匹配一个或两个网关地址，并为该流量应用监管器。要应用的过滤器的名称、网关地址和监管器的带宽将从 RADIUS 服务激活传递到服务配置文件中。uid-reference 类型支持从配置文件中的多个对象中选择特定的 UID 生成对象。UID 类型表示变量用于生成 UID。
dynamic-profile {
[my-svc-prof] {
variable {
[my-in-filter] {
mandatory;
uid-reference;
}
gw1 {
mandatory;
}
gw2 {
mandatory;
}
bw {
mandatory;
}
my-filt-1gw {
uid;
}
my-filt-2gw {
uid;
}
[my-policer] {
uid;
}
}
interfaces {
[$junos-interface-ifd-name] {
unit [$junos-underlying-interface-unit] {
family inet {
filter {
input [$my-in-filter];
}
}
}
}
}
firewall {
policer [$my-policer] {
if-exceeding {
bandwidth-limit $bw;
burst-size-limit 15000;
}
then discard;
}
family inet {
filter [$my-filt-1gw] {
interface-specific;
term t0 {
from {
destination-address $gw1;
}
then {
policer [$my-policer];
}
}
term last {
then {
count drops;
discard;
}
}
}
filter [$my-file-2gw] {
interface-specific;
term t0 {
from {
destination-address {
$gw1;
$gw2;
}
}
then {
policer [$my-policer];
}
}
term last {
then {
count drops;
discard;
}
}
}
}
}
}
}