Defining Dynamic Filter Processing Order

You can force filter processing to occur in a particular order by using the precedence statement. You specify a precedence for input and output filters within a dynamic profile at the [edit dynamic-profiles family profile-name interfaces interface-name unit logical-unit-number family family] and [edit dynamic-profiles profile-name interfaces demux0 unit logical-unit-number family family] hierachy level.

The precedence range is from 0 to 250. Setting a lower precedence value for a filter gives it a higher precedence within the dynamic profile. A precedence of zero (the default) gives the filter the highest precedence. If no precedence is specified, the filter receives a precedence of zero (highest precedence). Filters with matching precedence (zero or otherwise) are applied in random order.

Before you define a precedence for a filter in a dynamic profile.

1. Create the filters you want to attach to the dynamic profile.

   See the JUNOS Policy Framework Configuration Guide for detailed information about firewall filters and how to create them.

2. Create a basic dynamic profile.

   See Configuring a Basic Dynamic Profile.

3. Attach the filters to the dynamic profile.

   See Dynamically Attaching Statically Created Filters or Dynamically Attaching Filters Using RADIUS Variables.

To define a precedence for an input and output filter:

1. Specify the input filter precedence in the dynamic profile.

   [edit dynamic-profiles access-profile interfaces ge-1/1/1 unit 1 family inet filter]

   user@host# set filter input precedence 50

2. Specify the output filter precedence in the dynamic profile.

   [edit dynamic-profiles access-profile interfaces ge-1/1/1 unit 1 family inet filter]

   user@host# set filter output precedence 5

Related Topics

• Guidelines for Creating and Applying Filters for Subscriber Interfaces
• For information about firewall filters, see the JUNOS Policy Framework Configuration Guide