TechLibrary

Navigation

Table of Contents

Guide That Contains This Content

[+] Expand All

[-] Collapse All

Dynamic Firewall Services and Service Sets for Subscriber Access

Junos® OS Documentation for ACX, M, MX, PTX, and T Series Routers, Release 12.3

Overview
Configuration
Administration
Troubleshooting

Dynamic Firewall Services and Service Sets in Subscriber Access Networks

Dynamic Firewall Filters Overview

Dynamic Service Sets Overview

Classic Filters

Classic Filters Overview

Basic Classic Filter Syntax

Ascend-Data-Filter Policies for Subscriber Management Overview

Ascend-Data-Filter Attribute Fields

Firewall Filters and Enhanced Network Services Mode Overview

Parameterized Filters

Parameterized Filters Overview

Basic Parameterized Filter Syntax

Unique Identifiers for Firewall Variables in Dynamic Profiles

Sample Dynamic-Profile Configuration for Parameterized Filters

Dynamic Profile After UID Substitutions for Parameterized Filters

Dynamic Profile Configuration and UID Substitution Comparison for Parameterized Filters

Parameterized Filters Configuration Considerations

Guidelines for Creating and Applying Parameterized Filters for Subscriber Interfaces

Parameterized Filter Processing Overview

Multiple Parameterized Filters

IPv4 Parameterized Filter Match Conditions

IPv6 Parameterized Filter Match Conditions

Parameterized Filter Actions and Modifiers

Parameterized Filter Policer Actions

Hierarchical Policer Overview

Hierarchical Policer as Filter Action

Enhanced Policer Statistics Overview

Interface-Shared Filters Overview

Fast Update Filters

Fast Update Filters Overview

Basic Fast Update Filter Syntax

Match Conditions and Actions in Fast Update Filters

Fast Update Filter Match Conditions

Fast Update Filter Actions and Action Modifiers

Unicast RPF and Fail Filters
Unicast RPF in Dynamic Profiles for Subscriber Interfaces

Configuration Tasks For Filters and Dynamic Profiles

Dynamically Attaching Statically Created Filters for a Specific Interface Family Type

Dynamically Attaching Statically Created Filters for Any Interface Type

Dynamically Attaching Filters Using RADIUS Variables

Defining Dynamic Filter Processing Order

Configuring Firewall Filter Bypass

Configuring Filters to Permit Expected Traffic

Configuring a Filter for Use with Enhanced Network Services Mode

Dynamically Applying Ascend-Data-Filter Policies to Subscriber Sessions

Configuration Tasks for Fast Update Filters

Configuring Fast Update Filters

Configuring the Match Order for Fast Update Filters

Configuring Terms for Fast Update Filters

Avoiding Conflicts When Terms Match

Associating Fast Update Filters with Interfaces in a Dynamic Profile

Configuration Tasks for Dynamic Service Sets
Associating Service Sets with Interfaces in a Dynamic Profile

Configuration Tasks for Unicast and Fail Filters

Configuring Unicast RPF and Fail Filters in Dynamic Profiles for Subscriber Interfaces

Configuring Unicast RPF in Dynamic Profiles for Subscriber Interfaces

Configuring a Fail Filter for Unicast RPF in Dynamic Profiles for Subscriber Interfaces

Examples

Examples: Configuring Static Filters

Example: Configuring Dynamic Ascend-Data-Filter Support for Subscriber Access

Example: Configuring Static Ascend-Data-Filter Support for Subscriber Access

Example: Configuring Fast Update Filters for Subscriber Access

Example: Bypassing Firewall Filters

Example: Dynamic-Profile Parsing

Example: Configuring Hierarchical Policers as Filter Actions

Example: Interface-Shared Filter Configuration

Example: Configuring Unicast RPF in a Dynamic Profile on MX Series Routers

Configuration Statements

[edit dynamic-profiles] Hierarchy Level

burst-size-limit (Hierarchical Policer)

burst-size-limit (Policer)

color-aware

color-blind

committed-burst-size

committed-information-rate

family (Dynamic Firewalls)

fast-update-filter

filter

filter (Dynamic Firewalls)

filter (Dynamic Interface Unit)

filter-specific

firewall

hierarchical-policer

if-exceeding (Policer)

if-exceeding (Hierarchical Policer)

logical-bandwidth-policer

logical-interface-policer

loss-priority high then discard

match-order

output

peak-burst-size

peak-information-rate

physical-interface-policer

Verifying and Managing Filter and Service Set Configurations

Verifying and Managing Firewall Filter Configuration

Verifying and Managing Dynamic Ascend-Data-Filter Policy Configuration

Verifying and Managing Service Sets Information

Monitoring Commands

clear firewall

show firewall

show firewall log

show firewall templates-in-use

show services service-sets summary

show subscribers

show subscribers summary

Acquiring Troubleshooting Information
Collecting Subscriber Access Logs Before Contacting Juniper Technical Support

Knowledge Base
http://kb.juniper.net/

Downloads

Junos OS Subscriber Access Configuration Guide