Dynamic Firewall Filters

JUNOS daemons can install dynamic firewall filters on Juniper router interfaces.

Each filter contains rules or terms that are applied to packets or packet flows and either allow, disallow, or count certain packets. Filters can also modify flow behavior. Along with the ability to add dynamic policies, this functionality can be used for standard (programmable) firewall or policing functions on the router. The filters allow a range of tests and checks to be installed, which, in turn, allows you to customize behavior.

You use the functions in libdfwd, on the Routing Engine or the Multiservices PIC, to add firewall filters. The functions are documented in the SDK Library reference.

When you create a firewall filter by calling junos_dfw_filter_trans_alloc() with the JUNOS_DFW_FILTER_OP_ADD operation, you also specify the type of firewall filter:

Most applications use classic filters. For example, if the filter is monitoring an IP address that does not change over time, you would use a classic filter. You might use a fast-update filter if the filter is simple and will be updated frequently in response to rapidly changing conditions; for example, a policer that operates on a stream of voice data.

You can install a policy manager sample application that dynamically applies and removes filters and policers on logical interfaces; that code is in sandbox/src/sbin/dpm-ctrl/dpm-ctrl_dfw.c in your development sandbox. Documentation is at The Dynamic Policy Manager Application.

The following figure shows how applications on the Routing Engine and the Multiservices PIC both use the same libdfwd library to add filters.

firewalls-g017347.gif

Firewall Filters on the Routing Engine and the Multiservices PIC


2007-2009 Juniper Networks, Inc. All rights reserved. The information contained herein is confidential information of Juniper Networks, Inc., and may not be used, disclosed, distributed, modified, or copied without the prior written consent of Juniper Networks, Inc. in an express license. This information is subject to change by Juniper Networks, Inc. Juniper Networks, the Juniper Networks logo, and JUNOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.
Generated on Sun May 30 20:26:47 2010 for Juniper Networks Partner Solution Development Platform JUNOS SDK 10.2R1 by Doxygen 1.4.5