Configuring Stateful Firewall Actions (SRC CLI)

You can configure stateful firewall actions for JUNOS ASP policy rules. Stateful firewall actions specify the action to take on packets that match the classify-traffic condition.

The type of action that you can create depends on the type of policy rule. See Policy Information Model.

Use the following configuration statements to configure stateful firewall actions:


            
               policies group  name  list  name  rule  name  stateful-firewall  name  {
               
               description  description ; 
               
               }
               policies group  name  list  name  rule  name  stateful-firewall  name  packet-action
                  reject {
               
               message-type  message-type ; 
               
               }
               policies group  name  list  name  rule  name  stateful-firewall  name  packet-action
                  parameter {
               
               action  action ; 
               
               }

To configure a stateful firewall action:

From configuration mode, enter the stateful firewall action configuration. For example, in this procedure, sfa is the name of the stateful firewall action.


                  
                     user@host# edit policies group junos list
                           sfw rule pr stateful-firewall sfa

(Optional) Set the action to take on a packet to one of the following:

Filter.
[edit policies group junos list sfw rule pr stateful-firewall sfa] user@host# set packet-action filter

Forward.
[edit policies group junos list sfw rule pr stateful-firewall sfa] user@host# set packet-action forward

Reject. If you set the action to reject, configure the type of ICMP destination unreachable message sent to the client.
[edit policies group junos list sfw rule pr stateful-firewall sfa] user@host# set packet-action reject message-type message-type
Parameter. Before you assign a parameter, you must create a parameter of type packetOperation and commit the parameter configuration.
[edit policies group junos list sfw rule pr stateful-firewall sfa] user@host# set packet-action parameter action action

(Optional) Enter a description for the stateful firewall action.


                  
                     [edit policies group junos list sfw rule pr stateful-firewall
                        sfa]
                     
                     user@host# set description  description

(Optional) Verify the stateful firewall action configuration.

[edit policies group junos list sfw rule pr stateful-firewall sfa]
user@host# show 
packet-action {
  reject {
    message-type administratively-prohibited;
  }
}
description "Stateful firewall action";

Configuring Stateful Firewall Actions (SRC CLI)

Related Topics