Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Example: Configuring a Filter to Count Accepted and Rejected Packets

 

This example shows how to configure a firewall filter to count packets.

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you use a stateless firewall filter to reject all addresses except 192.168.5.0/24.

Topology

In the first term, the match condition address 192.168.5.0/24 except causes this address to be considered a mismatch, and this address is passed to the next term in the filter. The match condition address 0.0.0.0/0 matches all other packets, and these are counted, logged, and rejected.

In the second term, all packets that passed though the first term (that is, packets whose address matches 192.168.5.0/24) are counted, logged, and accepted.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

CLI Quick Configuration

To quickly configure this example, copy the following configuration commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Configure the Stateless Firewall Filter

Step-by-Step Procedure

To configure the stateless firewall filter fire1:

  1. Create the stateless firewall filter fire1.

  2. Configure the first term to reject all addresses except those to or from the 192.168.5.0/24 prefix and then count, log, and reject all other packets.

  3. Configure the next term to count, log, and accept packets in the 192.168.5.0/24 prefix.

Apply the Stateless Firewall Filter to a Logical Interface

Step-by-Step Procedure

To apply the stateless firewall filter to a logical interface:

  1. Configure the logical interface to which you will apply the stateless firewall filter.

  2. Configure the interface address for the logical interface.

  3. Apply the stateless firewall filter to the logical interface.

Confirm and Commit Your Candidate Configuration

Step-by-Step Procedure

To confirm and then commit your candidate configuration:

  1. Confirm the configuration of the stateless firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  2. Confirm the configuration of the interface by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

  3. If you are done configuring the device, commit your candidate configuration.

Verification

To confirm that the configuration is working properly, enter the show firewall filter fire1 operational mode command. You can also display the log and individual counters separately by using the following forms of the command:

  • show firewall counter reject_pref1_1

  • show firewall counter reject_pref1_2

  • show firewall log