[Contents] [Prev] [Next] [Index] [Report an Error]

Example: Configure a Filter Action Statement

Count, sample, and accept the traffic:



term all {


then {
count sam-1;
sample; # default action is accept
}


}

Display the packet counter:

user@host> show firewall filter sam

Filter:
Counters:
Name              Bytes                Packets
sam
sam-1             98                   8028

Display the firewall log output:

user@host> show firewall log

Time     Filter     A Interface        Pro Source address  Destination address
23:09:09 -          A at-2/0/0.301     TCP 10.2.0.25       10.211.211.1:80
23:09:07 -          A at-2/0/0.301     TCP 10.2.0.25       10.211.211.1:56
23:09:07 -          A at-2/0/0.301     ICM 10.2.0.25       10.211.211.1:49552
23:02:27 -          A at-2/0/0.301     TCP 10.2.0.25       10.211.211.1:56
23:02:25 -          A at-2/0/0.301     TCP 10.2.0.25       10.211.211.1:80
23:01:22 -          A at-2/0/0.301     ICM 10.2.2.101      10.211.211.1:23251
23:01:21 -          A at-2/0/0.301     ICM 10.2.2.101      10.211.211.1:16557
23:01:20 -          A at-2/0/0.301     ICM 10.2.2.101      10.211.211.1:29471
23:01:19 -          A at-2/0/0.301     ICM 10.2.2.101      10.211.211.1:26873

This output file contains the following fields:

Time—Time at which the packet was received (not shown in the default).
Filter—Name of a filter that has been configured with the filter statement at the [edit firewall] hierarchy level. A hyphen (-) or the abbreviation pfe indicates that the packet was handled by the Packet Forwarding Engine. A space (no hyphen) indicates that the packet was handled by the Routing Engine.
A—Filter action:
- A—Accept (or next term)
- D—Discard
- R—Reject
Interface—Interface on which the filter is configured.

Note: We strongly recommend that you always explicitly configure an action in the then statement.
Pro—Packet’s protocol name or number.
Source address—Source IP address in the packet.
Destination address—Destination IP address in the packet.

Display the sampling output:

user@host> show log /var/tmp/sam

# Apr  7 15:48:50
Time                    Dest           Src Dest Src Proto TOS Pkt Intf  IP   TCP
                        addr          addr port port          len num frag flags
Apr 7 15:48:54 192.168.9.194 192.168.9.195   0    0   1   0x0  84  8   0x0   0x0
Apr 7 15:48:55 192.168.9.194 192.168.9.195   0    0   1   0x0  84  8   0x0   0x0
Apr 7 15:48:56 192.168.9.194 192.168.9.195   0    0   1   0x0  84  8   0x0   0x0

Note: When you enable reverse path forwarding (RPF) on an interface with an input filter for firewall log and count, the input firewall filter does not log the packets rejected by RPF, although the rejected packets are counted. To log the rejected packets, use an RPF check fail filter.

For more information about sampling output, see Configuring a Forwarding Table Filter.

[Contents] [Prev] [Next] [Index] [Report an Error]