Firewall Filter Match Conditions for Layer 2 Bridging Traffic
Only on MX Series routers and EX Series switches, you can configure a standard stateless firewall filter with match conditions for Layer 2 bridging traffic (family bridge). Table 1 describes the match-conditions you can configure at the [edit firewall family bridge filter filter-name term term-name from] hierarchy level.
Table 1: Standard Firewall Filter Match Conditions for Layer 2 Bridging (MX Series Routers and EX Series Switches Only)
Match Condition | Description | |
|---|---|---|
destination-mac-address address | Destination media access control (MAC) address of a Layer 2 packet in a bridging environment. | |
destination-port number | TCP or UDP destination port field. You cannot specify both the port and destination-port match conditions in the same term. | |
destination-port-except | Do not match the TCP/UDP destination port. | |
destination-prefix-list named-list | Match the IP destination prefixes in a named-list. | |
dscp number | Differentiated Services code point (DSCP). The DiffServ protocol uses the type-of-service (ToS) byte in the IP header. The most significant 6 bits of this byte form the DSCP. For more information, see Understanding How Behavior Aggregate Classifiers Prioritize Trusted Traffic. You can specify a numeric value from 0 through 63. To specify the value in hexadecimal form, include 0x as a prefix. To specify the value in binary form, include b as a prefix. In place of the numeric value, you can specify one of the following text synonyms (the field values are also listed):
af11 (10), af12 (12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42 (36), af43 (38) | |
dscp-except number | Do not match on the DSCP number. For more information, see the dscp-except match condition. | |
ether-type value | Match the 2-octet IEEE 802.3 Length/EtherType field to the specified value or list of values. You can specify decimal or hexadecimal values from 0 through 65535 (0xFFFF). A value from 0 through 1500 (0x05DC) specifies the length of an Ethernet Version 1 frame. A value from 1536 (0x0600) through 65535 specifies the EtherType (nature of the MAC client protocol) of an Ethernet Version 2 frame. In place of the numeric value, you can specify one of the following text synonyms (the hexadecimal values are also listed): aarp (0x80F3), appletalk (0x809B), arp (0x0806), ipv4 (0x0800), ipv6 (0x86DD), mpls-multicast (0x8848), mpls-unicast (0x8847), oam (0x8902), ppp (0x880B), pppoe-discovery (0x8863), pppoe-session (0x8864), sna (0x80D5). Note: When matching on ip-address or ipv6-address, the ether-type ipv4 or ipv6, respectively, must also be specified in order to limit matches to ip traffic only. | |
ether-type-except value | Do not match the 2-octet IEEE 802.3 Length/EtherType field to the specified value or list of values. For details about specifying the values, see the ether-type match condition. | |
flexible-match-mask value | bit-length | Length of the data to be matched in bits, not needed for string input (0..128) |
bit-offset | Bit offset after the (match-start + byte) offset (0..7) | |
byte-offset | Byte offset after the match start point | |
flexible-mask-name | Select a flexible match from predefined template field | |
mask-in-hex | Mask out bits in the packet data to be matched | |
match-start | Start point to match in packet | |
prefix | Value data/string to be matched | |
flexible-match-range value | bit-length | Length of the data to be matched in bits (0..32) |
bit-offset | Bit offset after the (match-start + byte) offset (0..7) | |
byte-offset | Byte offset after the match start point | |
flexible-range-name | Select a flexible match from predefined template field | |
match-start | Start point to match in packet | |
range | Range of values to be matched | |
range-except | Do not match this range of values | |
forwarding class class | Forwarding class. Specify assured-forwarding, best-effort, expedited-forwarding, or network-control. | |
forwarding-class-except class | Ethernet type field of a Layer 2 packet environment. Specify assured-forwarding, best-effort, expedited-forwarding, or network-control. | |
icmp-code message-code | Match the ICMP message code field. If you configure this match condition, we recommend that you also configure the ip-protocol icmp, ip-protocol icmp6, or ip-protocol icmpv6 match condition in the same term. If you configure this match condition, you must also configure the icmp-type message-type match condition in the same term. An ICMP message code provides more specific information than an ICMP message type, but the meaning of an ICMP message code is dependent on the associated ICMP message type. In place of the numeric value, you can specify one of the following text synonyms (the field values are also listed). The keywords are grouped by the ICMP type with which they are associated:
| |
icmp-code-except message-code | Do not match the ICMP message code field. For details, see the icmp-code match condition. | |
icmp-type message-type | Match the ICMP message type field. If you configure this match condition, we recommend that you also configure the ip-protocol icmp, ip-protocol icmp6, or ip-protocol icmpv6 match condition in the same term. In place of the numeric value, you can specify one of the following text synonyms (the field values are also listed): destination-unreachable (1), echo-reply (129), echo-request (128), membership-query (130), membership-report (131), membership-termination (132), neighbor-advertisement (136), neighbor-solicit (135), node-information-reply (140), node-information-request (139), packet-too-big (2), parameter-problem (4), redirect (137), router-advertisement (134), router-renumbering (138), router-solicit (133), or time-exceeded (3). | |
icmp-type-except message-type | Do not match the ICMP message type field. For details, see the icmp-type match condition. | |
interface interface-name | Interface on which the packet was received. You can configure a match condition that matches packets based on the interface on which they were received. Note: If you configure this match condition with an interface that does not exist, the term does not match any packet. | |
interface-group group-number | Match the logical interface on which the packet was received to the specified interface group or set of interface groups. For group-number, specify a single value or a range of values from 0 through 255. To assign a logical interface to an interface group group-number, specify the group-number at the [interfaces interface-name unit number family family filter group] hierarchy level. For more information, see Filtering Packets Received on a Set of Interface Groups Overview. | |
interface-group-except number | Do not match the logical interface on which the packet was received to the specified interface group or set of interface groups. For details, see the interface-group match condition. | |
interface-set interface-set-name | Match the interface on which the packet was received to the specified interface set. To define an interface set, include the interface-set statement at the [edit firewall] hierarchy level. For more information, see Filtering Packets Received on an Interface Set Overview. | |
ip-address address | 32-bit address that supports the standard syntax for IPv4 addresses. Note: In order to limit matches to IPv4 traffic only, the ether-type ipv4 must also be specified in the same term. | |
ip-destination-address address | 32-bit address that is the final destination node address for the packet. | |
ip-precedence ip-precedence-field | IP precedence field. In place of the numeric field value, you can specify one of the following text synonyms (the field values are also listed): critical-ecp (0xa0), flash (0x60), flash-override (0x80), immediate (0x40), internet-control (0xc0), net-control (0xe0), priority (0x20), or routine (0x00). | |
ip-precedence-except ip-precedence-field | Do not match on the IP precedence field. | |
ip-protocol number | IP protocol field. | |
ip-protocol-except | Do not match the IP protocol type. | |
ip-source-address address | IP address of the source node sending the packet. | |
ipv6-address address | (MX Series only) 128-bit address that supports the standard syntax for IPv6 addresses. Note: In order to limit matches to IPv6 traffic only, the ether-type ipv6 must also be specified in the same term. | |
ipv6-destination-address address | (MX Series only) 128-bit address that is the final destination node address for this packet. | |
ipv6-destination-prefix-list named-list | (MX Series only) Match the IPv6 destination addresses in a named-list. | |
ipv6-next-header protocol | (MX Series only) Match IPv6 next header protocol type. The following list shows the supported values for protocol:
| |
ipv6-next-header-except protocol | (MX Series only) Do not match the IPv6 next header protocol type. | |
ipv6-payload-protocol protocol | (MX Series only) Match IPv6 payload protocol type. The following list shows the supported values for protocol:
| |
ipv6-payload-protocol-except protocol | (MX Series only) Do not match the IPv6 payload protocol. | |
ipv6-prefix-list named-list | (MX Series only) Match the IPv6 address in a named-list. | |
ipv6-source-address address | (MX Series only) 128-bit address that is the originating source node address for this packet. | |
ipv6-source-prefix-list named-list | (MX Series only) Match the IPv6 source address in a named-list. | |
ipv6-traffic-class number | (MX Series only) Differentiated Services code point (DSCP). The DiffServ protocol uses the type-of-service (ToS) byte in the IP header. The most significant 6 bits of this byte form the DSCP. For more information, see Understanding How Behavior Aggregate Classifiers Prioritize Trusted Traffic. You can specify a numeric value from 0 through 63. To specify the value in hexadecimal form, include 0x as a prefix. To specify the value in binary form, include b as a prefix. In place of the numeric value, you can specify one of the following text synonyms (the field values are also listed):
af11 (10), af12 (12), af13 (14), af21 (18), af22 (20), af23 (22), af31 (26), af32 (28), af33 (30), af41 (34), af42 (36), af43 (38) | |
ipv6-traffic-class-except number | Do not match the DSCP number. | |
isid number | (Supported with Provider Backbone Bridging [PBB]) Match internet service identifier. | |
isid-dei number | (Supported with PBB) Match the Internet service identifier drop eligibility indicator (DEI) bit. | |
isid-dei-except number | (Supported with PBB) Do not match the Internet service identifier DEI bit. | |
isid-priority-code-point number | (Supported with PBB) Match the Internet service identifier priority code point. | |
isid-priority-code-point-except number | (Supported with PBB) Do not match the Internet service identifier priority code point. | |
learn-vlan-1p-priority value | (MX Series routers and EX Series switches only) Match on the IEEE 802.1p learned VLAN priority bits in the provider VLAN tag (the only tag in a single-tag frame with 802.1Q VLAN tags or the outer tag in a dual-tag frame with 802.1Q VLAN tags). Specify a single value or multiple values from 0 through 7. Compare with the user-vlan-1p-priority match condition. | |
learn-vlan-1p-priority-except value | (MX Series routers and EX Series switches only) Do not match on the IEEE 802.1p learned VLAN priority bits. For details, see the learn-vlan-1p-priority match condition. | |
learn-vlan-dei number | (Supported with bridging) Match user virtual LAN (VLAN) identifier DEI bit. | |
learn-vlan-dei-except number | (Supported with bridging) Do not match user VLAN identifier DEI bit. | |
learn-vlan-id number | VLAN identifier used for MAC learning. | |
learn-vlan-id-except number | Do not match on the VLAN identifier used for MAC learning. | |
loss-priority level | Packet loss priority (PLP) level. Specify a single level or multiple levels: low, medium-low, medium-high, or high. Supported on M120 and M320 routers; M7i and M10i routers with the Enhanced CFEB (CFEB-E); and MX Series routers and EX Series switches. For IP traffic on M320, MX Series, and T Series routers with Enhanced II Flexible PIC Concentrators (FPCs), and EX Series switches, you must include the tri-color statement at the [edit class-of-service] hierarchy level to commit a PLP configuration with any of the four levels specified. If the tri-color statement is not enabled, you can only configure the high and low levels. This applies to all protocol families. For information about the tri-color statement, see Configuring and Applying Tricolor Marking Policers. For information about using behavior aggregate (BA) classifiers to set the PLP level of incoming packets, see Understanding How Forwarding Classes Assign Classes to Output Queues. | |
loss-priority-except level | Do not match on the packet loss priority level. Specify a single level or multiple levels: low, medium-low, medium-high, or high. For information about using behavior aggregate (BA) classifiers to set the PLP level of incoming packets, see the Understanding How Behavior Aggregate Classifiers Prioritize Trusted Traffic. | |
port number | TCP or UDP source or destination port. You cannot specify both the port match condition and either the destination-port or source-port match conditions in the same term. | |
source-mac-address address | Source MAC address of a Layer 2 packet. | |
source-port number | TCP or UDP source port field. You cannot specify the port and source-port match conditions in the same term. | |
source-port-except | Do not match the TCP/UDP source port. | |
tcp-flags flags | Match one or more of the low-order 6 bits in the 8-bit TCP flags field in the TCP header. To specify individual bit fields, you can specify the following text synonyms or hexadecimal values:
In a TCP session, the SYN flag is set only in the initial packet sent, while the ACK flag is set in all packets sent after the initial packet. You can string together multiple flags using the bit-field logical operators. Configuring the tcp-flags match condition requires that you configure the next-header-tcp match condition. | |
traffic-type type | Traffic type. Specify broadcast, multicast, unknown-unicast, or known-unicast. | |
traffic-type-except type | Do not match on the traffic type. | |
user-vlan-1p-priority value | (MX Series routers and EX Series switches only) Match on the IEEE 802.1p user priority bits in the customer VLAN tag (the inner tag in a dual-tag frame with 802.1Q VLAN tags). Specify a single value or multiple values from 0 through 7. Compare with the learn-vlan-1p-priority match condition. | |
user-vlan-1p-priority-except value | (MX Series routers and EX Series switches only) Do not match on the IEEE 802.1p user priority bits. For details, see the user-vlan-1p-priority match condition. | |
user-vlan-id number | (MX Series routers and EX Series switches only) Match the first VLAN identifier that is part of the payload. | |
user-vlan-id-except number | (MX Series routers and EX Series switches only) Do not match on the first VLAN identifier that is part of the payload. | |
vlan-ether-type value | VLAN Ethernet type field of a Layer 2 bridging packet. | |
vlan-ether-type-except value | Do not match on the VLAN Ethernet type field of a Layer 2 bridging packet. | |