[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Configuring Service Filters

You can optionally include filters associated with each service set to refine the target and additionally process the traffic. If you include the service-set statement without a service-filter definition, the router software assumes that the match condition is true and selects the service set for processing automatically.

To configure service filters, include the firewall statement at the [edit] hierarchy level:



firewall {


family inet {


service-filter filter-name {


term term-name {


from {

match-conditions;
}




then {

action; 

action-modifiers; 
}


}


}


}


}

Note: You must specify inet as the address family to configure a service filter.

You configure service filters in a similar way to firewall filters. Service filters have the same match conditions as firewall filters, but the following specific actions:

count—Add the packet to a counter total.
log—Log the packet.
port-mirror—Port-mirror the packet.
sample—Sample the packet.
service—Forward the packet for service processing.
skip—Omit the packet from service processing.

For more information about configuring firewall filters, see the JUNOS Policy Framework Configuration Guide.

You can also include more than one service set definition on each side of the interface. If you include multiple service sets, the router software evaluates them in the order specified in the configuration. It executes the first service set for which it finds a match in the service filter and ignores the subsequent definitions.

An additional statement allows you to specify a filter for processing the traffic after the input service set is executed. To configure this type of filter, include the post-service-filter statement at the [edit interfaces interface-name unit logical-unit-number family inet service input] hierarchy level:




post-service-filter filter-name;

Note: The software performs postservice filtering only when it has selected and executed a service set. If the traffic does not meet the match criteria for any of the configured service sets, the postservice filter is ignored.

For an example of applying a service set to an interface, see Examples: Configuring a Services Interface.

For more information on applying filters to interfaces, see the JUNOS Network Interfaces Configuration Guide. For general information on filters, see the JUNOS Policy Framework Configuration Guide.

Note: After NAT processing is applied to packets, they are not subject to output service filters. The service filters affect only untranslated traffic.

[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]