TechLibrary

Table of Contents

Guide That Contains This Content

[+] Expand All

[-] Collapse All

Parameterized Filters Configuration Considerations

Keep the following considerations in mind when configuring parameterized filters.

Subscriber IP Address

In most deployment scenarios, the interface is based on the subscriber’s IP address. Because subscribers may not be unique, they cannot be used in determining similar filters and policers. Do not use the junos-subscriber-ip-address IP address as a match candidate. Doing so causes unique filters per subscriber, which inhibits scaling.

Interaction with Static Configuration

Searching for a filter to attach takes place in the following order:

Static filter. For example, firewall family inet filter my-filter.
Fast update filter within the current dynamic profile. For example, dynamic-profile [profile-name] firewall family inet fast-update-filter my-filter.
Parameterized filter within the current dynamic profile. For example, dynamic-profile [profile-name] firewall family inet filter.

The following static configuration objects may be referenced by a parameterized filter. The search order is first in the static configuration and then in the current dynamic-profile:

firewall policer
firewall hierarchical-policer
three-color policer
policy-options prefix-list

If an object in the static configuration is being used by an active parameterized filter, you cannot delete that object from the configuration while the subscriber is logged in.

Interface-Specific

All dynamic service filters must be defined as interface-specific.

Service Session Support

Parameterized filters and policers are supported for service activations only, not client sessions.

Filter Naming Conventions

The base filter name is based on the interface and direction (ingress and egress) appended to it. With parameterized filters, the filter-naming process comes from the UID.