Applying Filters to Forwarding Tables
A forwarding table filter allows you to filter data packets based on their components and perform an action on packets that match the filter. You can apply a filter on the ingress or egress packets of a forwarding table. You configure the filter at the [edit firewall family family-name] hierarchy level; for more information, see Configuring Forwarding Table Filters.
To apply a forwarding table filter on ingress packets of a forwarding table, include the filter and input statements at the [edit forwarding-options family family-name] hierarchy level:
On the MX Series router only, to apply a forwarding table filter for a virtual switch, include the filter and input statements at the [edit routing-instances routing-instance-name bridge-domains bridge-domain-name forwarding-options] hierarchy level:
For more information about how to configure a virtual switch, see the Junos Layer 2 Configuration Guide.
You can filter based upon destination-class information by applying a firewall filter on the egress packets of the forwarding table. By applying firewall filters to packets that have been forwarded by a routing table, you can match based on certain parameters that are decided by the route lookup. For example, routes can be classified into specific destination and source classes. Firewall filters used for policing and mirroring are able to match based upon these classes.
To apply a firewall filter on egress packets of a forwarding table, include the filter and output statements at the [edit forwarding-options family family-name] hierarchy level:
 | Note: The egress forwarding table filter is applied on the ingress interface of the Flexible PIC Concentrator (FPC). If different packets to the same destination arrive on different FPCs, they might encounter different policers. |
| Note: You cannot simultaneously include the interface-group statement at the [edit firewall family inet filter filter-name term term-name from] hierarchy level and configure an egress forwarding table filter. The egress forwarding table filter is applied to transit packets only. |
| Note: The egress forwarding table filter is not supported for the J Series Services Routers. |
| Note: In Junos OS Release 8.4 and later, you can no longer configure this output statement for VPLS. You can continue to configure ingress forwarding table filters with the input statement at the [edit forwarding-options family vpls filter] hierarchy level. |
To apply a forwarding table filter to a flood table, include the flood and input statements at the [edit forwarding-options family family-name] hierarchy level:
| Note: The flood statement is valid for the vpls protocol family only. |
