> - Downloads
> - Configuring Protocol Conditions with Parameters (SRC CLI)
> - Related Topics
> - Before You Configure Classify-Traffic Conditions
> - Overview of Global and Local Parameters
> - Configuring Classify-Traffic Conditions
> - Configuring Protocol Conditions with Parameters (C-Web Interface)
> - Configuring Protocol Conditions (SRC CLI)

> # Configuring Protocol Conditions with Parameters (SRC CLI)

> Use the following configuration statements to configure classify-traffic conditions that contain a parameter value for the protocol:

> `
> policies group name list name rule name traffic-condition name parameter-protocol-condition {
>   protocol protocol ;
>   protocol-operation protocol-operation ;
>   tcp-flags tcp-flags ;
>   tcp-flags-mask tcp-flags-mask ;
>   spi spi ;
>   ip-flags ip-flags ;
>   ip-flags-mask ip-flags-mask ;
>   fragment-offset fragment-offset ;
>   packet-length packet-length ;
> }
> policies group name list name rule name traffic-condition name parameter-protocol-condition proto-attr {
>   icmp-type icmp-type ;
>   icmp-code icmp-code ;
>   igmp-type igmp-type ;
> }
> policies group name list name rule name traffic-condition name parameter-protocol-condition proto-attr destination-port port {
>   port-operation port-operation ;
>   from-port from-port ;
> }
> policies group name list name rule name traffic-condition name parameter-protocol-condition proto-attr source-port port {
>   port-operation port-operation ;
>   from-port from-port ;
> }
> `

> To configure a protocol condition that contains a parameter value for the protocol:

> 1. From configuration mode, enter the parameter protocol condition configuration. For example:
>    `
>    user@host# edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition
>    `
> 2. Assign a parameter as the protocol matched by this classify-traffic condition.

>    Before you assign a parameter, you must create a parameter of type protocol and commit the parameter configuration.

>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set protocol protocol
>    `
> 3. (Optional) Configure the policy to match packets with the protocol that is either equal or not equal to the specified protocol.
>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set protocol-operation protocol-operation
>    `
> 4. (Optional) Configure the value of the TCP flags field in the IP header.
>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set tcp-flags tcp-flags
>    `
> 5. (Optional) Configure the mask associated with TCP flags.
>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set tcp-flags-mask tcp-flags-mask
>    `
> 6. (Optional) Specify the authentication header (AH) or the encapsulating security payload (ESP) security parameter index (SPI).
>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set spi spi
>    `
> 7. (Optional) Configure the value of the IP flags field in the IP header.
>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set ip-flags ip-flags
>    `
> 8. (Optional) Configure the mask that is associated with the IP flag.
>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set ip-flags-mask ip-flags-mask
>    `
> 9. (Optional) Configure the value of the fragment offset field.
>    `
>    [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>    user@host# set fragment-offset fragment-offset
>    `
> 10. (Optional) Configure the packet length on which to match. The length refers only to the IP packet, including the packet header, and does not include any layer 2 encapsulation overhead.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>     user@host# set packet-length packet-length
>     `
> 11. (Optional) Enter the protocol attribute configuration.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>     user@host# edit proto-attr
>     `
> 12. (Optional) Configure the ICMP packet type.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr]
>     user@host# set icmp-type icmp-type
>     `
> 13. (Optional) Configure the ICMP code.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr]
>     user@host# set icmp-code icmp-code
>     `
> 14. (Optional) Configure the IGMP packet type on which to match.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr]
>     user@host# set igmp-type igmp-type
>     `
> 15. (Optional) Enter the destination port configuration.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr]
>     user@host# edit destination-port port
>     `
> 16. (Optional) Configure the policy to match packets with a port that is either equal or not equal to the specified port.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr destination-port port]
>     user@host# set port-operation port-operation
>     `
> 17. (Optional) Configure the TCP or UDP destination port.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr destination-port port]
>     user@host# set from-port from-port
>     `
> 18. (Optional) Enter the source port configuration.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr destination-port port]
>     user@host# up
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc param-proto-condition proto-attr]
>     user@host# edit source-port port
>     `
> 19. (Optional) Configure the policy to match packets with a port that is either equal or not equal to the specified port.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr source-port port]
>     user@host# set port-operation port-operation
>     `
> 20. (Optional) Configure the TCP or UDP source port.
>     `
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr source-port port]
>     user@host# set from-port from-port
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr source-port port]
>     user@host# up
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr source-port]
>     user@host# up
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition proto-attr]
>     user@host# up
>     [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>     user@host# up
>     `
> 21. (Optional) Verify the parameter protocol configuration.

>         [edit policies group junose list dhcp rule forward-dhcp traffic-condition ctc parameter-protocol-condition]
>         user@host# show
>         protocol protocol;
>         protocol-operation is;
>         tcp-flags 0;
>         tcp-flags-mask 0;
>         ip-flags 0;
>         ip-flags-mask 0;
>         proto-attr {
>           icmp-type 255;
>           icmp-code 255;
>           destination-port {
>             port {
>               port-operation eq;
>               from-port outsidePort;
>             }
>           }
>         }

> #### Published: 2009-09-22

> Copyright © 2009, Juniper Networks, Inc. All rights reserved. Trademark Notice.