Understanding Firewall Filter Match Conditions

Learn how to configure match conditions for firewall filters on Juniper switches.

Before configuring firewall filter terms, understand how match conditions work and how to specify different match types for desired filtering results.

Filter Match Conditions

In the from statement of a firewall filter term, specify conditions that trigger actions in the then statement. All conditions must match for the action to occur. The order of conditions is unimportant.

Specify multiple values for the same condition using either:

Important:

Unlike traditional Junos OS firewall filters:

Individual conditions cannot contain value lists (ranges/multiple addresses)
Conditions cannot be negated using except

If no match conditions are specified, the term matches all packets.

Numeric Match Conditions

Match numeric fields (port/protocol numbers) using:

Single number: source-port 23
Text synonym: source-port telnet

Specify multiple values:

Restriction: Numeric ranges or comma-separated lists are not supported.

Interface Match Conditions

Match interfaces using these formats:

Wildcards are supported:

Note:

QFX/EX/OCX/NFX Series: Always include logical unit where required. For VLAN filtering applications, specify interfaces participating in the VLAN.

IP Address Match Conditions

Match IP prefixes:

Omitted prefix-length defaults to /32:

MAC Address Match Conditions

Match MAC addresses using these formats:

All formats resolve to standard 00:11:22:33:44:55.

Specify multiple MAC addresses:

Bit-Field Match Conditions

Match specific bits in packet headers:

Table 1: Logical Operators for Bit-Field Matching
Operator	Description
`!`	Negation
`&`	Logical AND
`\|`	Logical OR

Operator usage examples: